Microsoft goes passwordless by default for new accounts, aiming to expand to all accounts

Microsoft has shifted its account creation process so that all new Microsoft Accounts are now passwordless by default. Users opening a new account will not be prompted to set a traditional password at any point during setup. Instead, Microsoft requires secure authentication alternatives such as passkeys, push notifications, or hardware security keys.

Passkeys can be configured through Windows Hello on Windows devices or with the Microsoft Authenticator app on mobile phones. Microsoft states that users will never need to enroll a password when registering a new account, marking a significant change from previous security practices.

The company is updating its sign-in flow to prioritize passkeys over passwords when both are set up. After logging in, users will be prompted to set up a passkey if one is not already active. While existing Microsoft Account holders are not required to remove their passwords, they are being encouraged to transition to these more secure methods.