Can you remove the option to use password from authenticator prompts?

Question

We are testing the ability to move to passwordless in my company, and for our test we've enabled "Passwordless Experience" via a Device Configuration Profile in InTune. We also enabled "Web Sign-in" in the same configuration profile. See below.

This effectively removes "Password" from the sign-in options, and adds "Web Sign-in".

The "Web Sign-in" option prompts the user to authenticate using Microsoft Authenticator, which is setup for all employees on company phones (we've been using this for years).

On the ensuing prompts (see below) to authenticate using Microsoft Authenticator, the user is presented with two screens that have the option to "Use your password instead".

Is it possible to not have "Use your password instead" as an option here? It defeats the purpose of going passwordless if the users have this ability at this point.

Answer 1

You will always have a password so Enforce Auth Strength with a CA policy instead and that will force users to use a passwordless/phishless auth method

https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-strengths

Answer 2

@Hiaring, Ian, Thanks for posting in Q&A. Based on my checking, there's no such policy in Intune to remove this option. But I find we can set policy in Microsoft Entra to set passwordless sign-in. maybe you can check if it can help.

https://learn.microsoft.com/en-us/entra/identity/authentication/howto-authentication-passwordless-deployment

You can also contact Microsoft Entra ID support to get more help.

https://learn.microsoft.com/en-us/entra/fundamentals/how-to-get-support

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.