Microsoft has decided to prioritize passkeys over passwords for users registered with them, a move aimed at enhancing security measures. This adjustment, known as passkey-preferred authentication, is currently in preview for Microsoft Entra ID, the company’s cloud-based identity and access management system. In cases where a user has both a passkey and a password registered, the system will now prompt for the passkey first. The objective behind this change is to decrease reliance on vulnerable credentials like passwords without relying solely on users changing their behavior patterns.
In addition to this alteration, Microsoft has disclosed that security questions will no longer be an option for password resets within Entra ID from January 2027 onwards. This decision is justified by the weaknesses of security questions against techniques like guessing and social engineering.
Furthermore, a new account recovery process has been introduced by Microsoft, which is now widely available. This process enables users locked out of their accounts to regain access by submitting a government-issued ID and completing a biometric face verification. To support this service, two new verification partners, 1Kosmos and CLEAR, have been added alongside existing providers.
These developments align with the increasing adoption of passkeys, with Microsoft reporting that hundreds of millions of consumers utilize passkeys for services like OneDrive, Xbox, and Copilot on a daily basis. Internally, Microsoft boasts that 99.6% of users and devices are safeguarded by phishing-resistant authentication measures. The company views these changes as part of a broader initiative to reduce the potential targets for cyberattacks, especially in light of AI-driven phishing campaigns that are achieving remarkably high click-through rates.
