For remove the Passwordless Authentication

Question

Hi Team,

when my users try to sign in to any Microsoft application or environment, they are able to be logged in automatically without being prompted for a password. I want to enforce a sign‑in flow where users must first enter their password and then authenticate using MFA. Kindly assist with this.

Answer 1

Passwordless sign-in (for example, using Microsoft Authenticator, Windows Hello, or passkeys/SSO) is designed to let users sign in without entering a password. To enforce a flow where users must always enter a password first and then complete MFA, passwordless and SSO options need to be disabled or avoided, and MFA must be enforced via policy.

From the provided context, the following are relevant points and actions:

1. Passwordless sign-in methods
   • Microsoft accounts and Entra ID accounts can use passwordless methods such as:
     • Microsoft Authenticator app
     • Windows Hello
     • Physical security keys
     • SMS or email codes
   • When passwordless is enabled, users can sign in without a password and only approve a notification or provide a biometric/OTP instead.
   • For Microsoft accounts, passwordless is explicitly enabled under Passwordless account in the security settings; disabling this forces password-based sign-in again.
2. Enforcing MFA after password
   • For external/Entra ID scenarios, MFA is enforced via Conditional Access and user flows:
     • Configure sign-in so that the first factor is a password (for example, “Email with password”).
     • Configure MFA as a second factor (for example, SMS or email OTP) and require it via Conditional Access.
   • In external tenants, when using Email with password as the primary method, MFA can be configured to use:
     • Email one-time passcodes
     • SMS text codes
3. Practical implications for the requested flow
   • To require “password + MFA” instead of passwordless:
     • Disable passwordless sign-in methods for the users (for example, turn off passwordless account options where configured, and avoid enabling passwordless policies).
     • Ensure the primary sign-in method is password-based (for example, “Email with password” in Entra External ID user flows).
     • Enforce MFA via Conditional Access so that, after password entry, users must complete a second factor such as SMS or email OTP.
   • If users are currently being silently signed in via SSO on domain-joined devices (for example, Windows + Teams), this is expected behavior when SSO and/or MFA at device sign-in are in place. In that case, to force password entry in each app, SSO and device-based MFA would need to be relaxed or reconfigured, which is the opposite of typical security guidance.

In summary, the desired behavior requires disabling passwordless sign-in and SSO where applicable, configuring password as the first factor (for example, “Email with password”), and enforcing MFA as a second factor via Conditional Access (for example, SMS or email OTP).

---

References:

• How to go passwordless with your Microsoft account
• Add multifactor authentication (MFA) to an app
• Create a sign-up and sign-in user flow for an external tenant app
• How different technologies affect Microsoft Teams sign-in