Microsoft moves to passwordless future for its more than 1 billion users

Microsoft wants its more than one billion users to stop using passwords to log into their Microsoft accounts.

This doesn't mean that Microsoft will remove any kind of security when trying to log into an account. Instead, it's looking for more of its users to use passkeys.

Passkeys are a more secure way of logging into accounts that Apple and Google have already begun using since 2023. Microsoft plans to have an updated sign-in and sign-up page for these passkeys for its more than one billion users starting at the end of April, according to a new post on the Microsoft Entra blog.

Microsoft laid out its plans to use passkeys back in May 2024. The company eventually wants users to need only an email to sign up and sign on for a Microsoft account, with the passkey handling security.

What is a passkey?

A passkey is a secure way to log in to an account without using a password. Instead, the passkey uses two unique keys, known as a cryptographic key pair. One is stored on a device like a smartphone while the other is stored on the website you would login on. Both need to be used in order to access a site.

What's important with the passkey is that the device user either uses biometrics or a PIN because when a user tries to sign onto the site, the device will need to use either for authentication. As the whole verification process is done electronically, all a person needs to do is enter the PIN, use a fingerprint, or just look at their phone for Face ID to verify who they are for the site.

The strength of passkeys is that they help diminish the effectiveness of phishing. If someone receives a phishing email that links to a website that looks just like a Microsoft login page, the user won't have a password to enter. The bad actors also can't replicate the key.

Passkeys are tied to a device, but they can be synced between multiple devices. This means changing a phone is no big deal as the passkeys just transfer to the new device.

Both Apple and Google began the implementation of passkeys in their respective mobile operating systems back in 2023. While these three tech giants made the jump to passkeys, others have yet to make the jump.