Password management and passwordless sign-in for UAE businesses.

Why passwords keep being the weak point

Passwords fail for human reasons rather than technical ones. People reuse them, choose predictable patterns, type them into convincing fake sign-in pages and write them down when the rules become too strict. A single reused password from an unrelated website can open a business mailbox. Multi-factor authentication helps a great deal, and our MFA rollout guide covers it, but it does not remove the underlying problem. This guide looks at the two practical levers that sit beside MFA: managing the passwords you still need, and reducing how many you need at all.

What a business password manager should do

Personal browser storage is not a business control. A business-grade manager gives the organisation visibility and a way to recover access. When comparing products, check for these abilities.

• Central administration. You can add and remove users, set policy and see which accounts have a vault.
• Shared vaults with roles. Teams share credentials without pasting them into chat, and access follows the person's role.
• Strong protection of the vault itself. MFA on the manager, and a clear explanation of how the vendor stores and encrypts data.
• Sign-in with your identity provider. Single sign-on with Microsoft Entra ID makes joiners and leavers easier to control.
• Breach and weak-password reporting so reused or exposed credentials can be fixed.
• An audit log showing who viewed, shared or changed an entry.
• Emergency access so the business is never locked out because one person is unavailable.

Data location and the vendor's terms matter too. If regulated or client data is involved, ask where vault data is held and have the answer written down. See our PDPL basics for the wider data-protection context, and verify current vendor terms before you sign.

Rules for shared credentials and service accounts

Shared logins are where good intentions usually fall apart. A marketing account used by five people, a supplier portal or a network device login often has no owner and no history. Set a few firm rules.

1. Give every shared credential a named owner and a reason for existing.
2. Store it in a shared vault, never in email, chat, spreadsheets or sticky notes.
3. Prefer named accounts for each user where the service allows it, so actions can be traced.
4. Change the credential when someone with access leaves. The offboarding checklist should include this step.
5. Keep service accounts, which applications use to talk to each other, out of day-to-day use and record where each one is used.
6. Keep two administrator break-glass accounts with long, unique passwords stored securely, as the MFA guide describes.

Passwordless: what it means and what it does not

"Passwordless" means signing in without typing a shared secret. Instead, you prove who you are with something tied to a device and confirmed by a local check, such as a fingerprint, face scan or device PIN. The main options are:

• Passkeys. A cryptographic key stored on a phone, laptop or security key. The service never holds a secret that can be phished or leaked in a breach.
• Windows Hello for Business. A sign-in tied to a managed Windows device and its biometric or PIN.
• Hardware security keys. Physical keys, best suited to administrators and high-risk roles.
• Authenticator app sign-in. An approval in a managed app, ideally with number matching, as a step on the way.

Passwordless is not the same as "no security". The device, its enrolment and its recovery all become your control points, which is why device management with Intune sits naturally beside it. It also does not remove every password. Expect to keep some for a time.

A staged route from passwords to passkeys

Do not announce a passwordless day. Move in stages and measure what breaks at each one.

1. Get the basics right. MFA on all accounts, legacy authentication blocked and a business password manager in use.
2. Pilot with IT and a small volunteer group. Enrol passkeys or Windows Hello on managed devices and note recovery cases.
3. Extend to administrators first. They carry the highest risk and are the most tolerant of change.
4. Roll out by department. Offer clear instructions, a short walkthrough and a service desk script.
5. Reduce password use gradually. Where a service supports it, remove passwords from daily sign-in. Keep the vault for what remains.

The Microsoft 365 security baseline shows where these settings sit in your tenant. Confirm current licensing and feature availability with Microsoft before planning, because it changes.

Plan for recovery before you plan for convenience

Most passwordless projects meet their first real difficulty when a phone is lost, replaced or reset. Decide in advance how a user registers a second method, how the service desk confirms identity for a reset, and how a lost device is removed from the account. Test this with a real colleague before wider rollout. If recovery is easy to abuse, attackers will use it, and a call to the service desk impersonating an executive is a familiar tactic. Our phishing awareness guide covers how to prepare staff for those moments.

Where to start

Start with an honest look at how people actually sign in today: which systems, which methods, which shared accounts and which administrators. The free IT health check gives you that picture, and Missan's cybersecurity team can help you plan the move. Missan Global has supported UAE organisations since 2004 from its head office in Al Majaz, Sharjah.