Microsoft Ditches Passwords for Passkeys: Embrace a More Secure and Seamless Login Experience

Today, Microsoft announced the availability of Passkey support for all consumer accounts. Users can now add Passkeys to their Microsoft account settings to experience a seamless and more secure login experience using these cryptographic keys.

While Passkey support is now available, Microsoft still supports traditional password login, passwordless login, and multi-factor authentication (MFA). MFA is only required when using password login.

If users use passwordless login, they can optionally delete the password set for their account and use the Microsoft Authenticator app for tap-to-verify authentication. Without a password, MFA is also not required, and all subsequent logins will be done through the Microsoft Authenticator app.

Advantages of Passkeys:

Replace traditional passwords: Passkeys can replace traditional passwords and do not conflict with the password and MFA set for the Microsoft account. Users can also set multiple Passkeys for their Microsoft account. For example, Windows 11 already supports system-level Passkey binding.

Sync with password managers: If users use third-party password managers such as 1Password, they can sync Passkeys without generating them on each device. After binding Passkeys, they can log in without using a password. If users delete their account password (see additional instructions below), they will no longer need to worry about password leaks.

Best Practices for Passkeys on Microsoft Accounts:

Delete password for enhanced security: For security reasons, users can delete their password after binding a Passkey in their account settings. Subsequent logins can only be done through a Passkey or the Microsoft Authenticator app (if enabled). This greatly improves security and eliminates the need to worry about password leaks or credential stuffing attacks.

Generate multiple Passkeys if needed: If users need to log in to their Microsoft account on multiple devices and do not use a password manager for syncing, they should generate multiple Passkeys. For example, they can also generate Passkeys on iOS and Android devices.

Unlock Passkeys with PIN, face recognition, or fingerprint: Regardless of whether they are using Windows 11, Android, or iOS, users will need to use a PIN, face recognition, or fingerprint to unlock and confirm Passkeys. This prevents others from logging in even if they have the device.

How to Set Up Passkeys for Microsoft Accounts:

Click here: https://aka.ms/addproof  You can click on "Add a new way to sign in or verify" at the bottom to generate more Passkeys.
Should I Delete My Account Password?

There are some minor inconveniences associated with deleting your password. For example, if you need to log in to your Microsoft account when reinstalling your system, you will not be able to use a Passkey in the OOBE interface. Therefore, users should bind the Microsoft Authenticator app as a backup verification method in advance. Of course, you can also choose to skip the Microsoft account login and create a local account, and then log in using your Microsoft account later.

As for Outlook clients and other applications that require dedicated passwords, these applications do not support two-step verification or Passkey login. Dedicated passwords can eliminate the need for two-step verification, and users can create them in the "App passwords" section at the bottom of the above link.