Turn off automatic passkey setup

Question

I'm logging into OneNote on a web browser. Any browser, it doesn't matter. After I authenticate with my password and MFA Microsoft will try to automatically create a passkey for me. This is not something I want, regardless of how secure passkeys may be. My current setup with a password and the OTP auth works just fine. Is there a way to turn this forcing of a passkey off? Is my only option to just shed more of the Microsoft services I use in favor of other options? Its quite annoying to be force fed passkeys because Microsoft thinks it knows whats best for me.

Answer 1

A passkey is not being forcibly setup. What's happening is that you are being asked (others might say 'pestered') to setup a passkey, every time you log in to your Microsoft account. This is not limited to Microsoft. You will encounter this at every website you visit that has passkeys implemented. You cannot prevent being asked/pestered, not by Microsoft or any other website.

There is no 'official' explanation for this, other than what you have read about passkeys being safer.

In my personal opinion, if a passkey was only about you and me, we could stop it. But it's not only about you and me. Every data breach exposes the organization to unwanted scrutiny and legal action. A passkey cannot be stolen, even if an organization is breached (which is not going to end.)

Answer 2

We need to hold Microsoft's feet to the fire over this. The support channels need to be clogged with passkey complaints until they finally back off, and let us use our more reliable and private login methods. With how poor of a job they did rushing this unfinished system out, and with the laws surrounding it having to do with law enforcement and the fifth amendment, I will NEVER use passkeys.

Answer 3

AFAIK, there isn’t a clean global “never ask me for passkeys again” switch exposed in the consumer UI, but you might be able to take some steps to increase the possibility of this behavior to go away. Personally, I'd recommend against it, but it's your call as a customer.

Remove any passkeys already registered to your account (assuming if you have any). Go to your Microsoft account security page, then Advanced security options, and look for Passkeys or Security keys. Delete anything listed there. If a passkey exists, Microsoft will keep trying to use or reinforce it.

Next, turn off passwordless sign-in if it’s enabled. In the same security area, make sure “Passwordless account” or similar is disabled.

During login, when the passkey prompt appears, choose the option along the lines of “Other ways to sign in” or “Use your password instead.” After doing this a few times, the default should switch to your last successful method.

Btw. note that if you’re using a work or school account in Microsoft Entra, then there actually is an administrative way to suppress this behavior: disabling FIDO2/passkeys in Authentication methods, turning off “Allow synced passkeys,” and disabling the registration campaign will stop the automatic passkey setup prompts (you may also need to turn off system-preferred MFA or adjust Conditional Access policies to prevent it from being reintroduced indirectly).

---

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin