Every team knows they should use a password manager and stronger authentication. The reason it stalls is rarely disagreement — it is that rollouts are attempted everywhere at once, break somebody's workflow in week one, and quietly get abandoned. A sequenced rollout works considerably better than a comprehensive one.
Why passkeys, specifically
A password can be phished. A one-time code can be phished in real time by a proxy that relays it to the real site while you watch a convincing login page. A passkey is bound to the site it was created for and cannot be handed to an attacker on a lookalike domain, because the browser will not offer it there. That single property removes the most common account-takeover method in use today.
Week one: the accounts that matter most
Enrol passkeys or hardware keys on email, your identity provider, and any cloud or hosting console with administrative rights. These are small in number and enormous in consequence. Do not start with the tools everybody uses hourly — start with the ones an attacker would want.
Week two: the password manager, with real migration
Deploy a manager and spend an hour with each person actually importing their existing logins rather than telling them to do it later. Adoption succeeds or fails in this hour. Once credentials live in the manager, generated passwords and per-site uniqueness follow naturally.
Week three: shared logins
Every team has accounts several people use. Inventory them, then fix the cause: add individual seats where the vendor permits, use a shared vault entry where it does not, and remove the ones nobody needs. A shared login that nobody can attribute is both a security and an accountability problem, and it becomes acute the moment someone leaves.
Recovery, planned before enrolment
The predictable failure of strong authentication is lockout. Before rolling out, decide: a second enrolled device or key per person, a documented administrator-assisted recovery process with identity verification, and recovery codes stored somewhere genuinely separate. Without this you will get emergency exceptions, and exceptions become the new normal.
What to measure
Track the percentage of administrative accounts with phishing-resistant authentication, the number of accounts still using shared passwords, and how long it takes to fully revoke access when someone leaves. Those three numbers describe your actual exposure better than any tool dashboard.