Microsoft Adopts Passwordless Defaults for New Accounts with Passkey Rollout

Report by Safarti Tarjuman Technology Desk

Microsoft has officially transitioned to passwordless defaults for new accounts, embracing passkeys as the future of user authentication in a major overhaul of its sign-in system.

This move solidifies Microsoft’s commitment to eliminating traditional passwords, widely seen as vulnerable to cyber threats. The company announced it has joined the FIDO Alliance’s Passkey Pledge, aligning with global efforts to accelerate the adoption of secure, phishing-resistant credentials.

Under the new system:

• All new Microsoft accounts will skip password creation at setup, instead offering passkeys or other passwordless options from the start.
• A redesigned sign-in experience prioritizes the most secure available method — such as biometric verification or one-time codes — by default.
• Existing users will be encouraged to create passkeys, with prompts appearing after sign-in. Early tests show this has already reduced password use by over 20%.

Since the launch of Windows Hello, biometric sign-ins have become standard, with 99% of Microsoft account holders on Windows using the feature.

Introduced in 2023, passkeys allow users to log in without passwords, apps, or authentication codes. Microsoft reports that nearly 1 million new passkeys are now being registered daily across platforms like Xbox and Microsoft Copilot.

The change comes amid alarming statistics: password-based attacks now occur at a rate of 7,000 incidents per second, doubling from 2023. These threats include phishing, brute-force intrusions, and credential stuffing — vulnerabilities passkeys are designed to eliminate.

Passkeys operate on the FIDO2 standard, pairing a device-stored private key with a public key held by Microsoft. Since the private key never leaves the user’s device and is unlocked via biometrics or a PIN, it provides strong resistance against modern cyberattacks.