Windows passwordless experience

• Applies to:

  ✅ Windows 11

Starting in Windows 11, version 22H2 with KB5030310, Windows passwordless experience is a security policy that promotes a user experience without passwords on Microsoft Entra joined devices.
When the policy is enabled, certain Windows authentication scenarios don't offer users the option to use a password, helping organizations and preparing users to gradually move away from passwords.

With Windows passwordless experience, users who sign in with Windows Hello or a FIDO2 security key:

• Can't use the password credential provider on the Windows lock screen

• Aren't prompted to use a password during in-session authentications (for example, UAC elevation, password manager in the browser, etc.)

• Don't have the option Accounts > Change password in the Settings app

  Note

  Users can reset their password using CTRL+ALT+DEL > Manage your account

Windows passwordless experience doesn't affect the initial sign-in experience and local accounts. It only applies to subsequent sign-ins for Microsoft Entra accounts. It also doesn't prevent a user from signing in with a password when using the Other user option in the lock screen.
The password credential provider is hidden only for the last signed in user who signed in Windows Hello or a FIDO2 security key. Windows passwordless experience isn't about preventing users from using passwords, rather to guide and educate them to not use passwords.

This article explains how to enable Windows passwordless experience and describes the user experiences.

Tip

Windows Hello for Business users can achieve passwordless sign-in from the first sign-in using the Web sign-in feature. For more information about Web sign-in, see Web sign-in for Windows devices.

System requirements

Windows passwordless experience has the following requirements:

• Windows 11, version 22H2 with KB5030310 or later
• Microsoft Entra joined
• Windows Hello for Business credentials enrolled for the user, or a FIDO2 security key
• MDM-managed: Microsoft Intune or other MDM solution

Note

Microsoft Entra hybrid joined devices and Active Directory domain joined devices are currently out of scope.

Windows edition and licensing requirements

The following table lists the Windows editions that support Windows passwordless experience:

Windows Pro	Windows Enterprise	Windows Pro Education/SE	Windows Education
Yes	Yes	Yes	Yes

Windows passwordless experience license entitlements are granted by the following licenses:

Windows Pro/Pro Education/SE	Windows Enterprise E3	Windows Enterprise E5	Windows Education A3	Windows Education A5
Yes	Yes	Yes	Yes	Yes

For more information about Windows licensing, see Windows licensing overview.

Enable Windows passwordless experience with Intune

To configure devices with Microsoft Intune, create a Settings catalog policy and use the following settings:

Category	Setting name	Value
Authentication	Enable Passwordless Experience	Enabled

Assign the policy to a group that contains as members the devices or users that you want to configure.

Alternatively, you can configure devices using a custom policy with the Policy CSP.

Setting
- OMA-URI: ./Device/Vendor/MSFT/Policy/Config/Authentication/EnablePasswordlessExperience - Data type: int - Value: 1

User experiences

Lock screen experience

Passwordless experience turned off: users can sign in using a password, as indicated by the presence of the password credential provider in the Windows lock screen.

Passwordless experience turned on: the password credential provider is missing for the last user who signed in with strong credentials. A user can either sign in using a strong credential or opt to use the Other user option to sign in with a password.

In-session authentication experiences

When Windows passwordless experience is enabled, users can't use the password credential provider for in-session authentication scenarios. In-session authentication scenarios include:

• Password Manager in a web browser
• Connecting to file shares or intranet sites
• User Account Control (UAC) elevation, except if a local user account is used for elevation

Note

RDP sign in defaults to the credential provider used during sign-in. However, a user can select the option Use a different account to sign in with a password.

Run as different user is not impacted by Windows passwordless experience.

Example of UAC elevation experience:

Passwordless experience turned off: UAC elevation allows the user to authenticate using a password.

Passwordless experience turned on: UAC elevation doesn't allow the user to use the password credential provider for the currently logged on user. The user can authenticate using Windows Hello, a FIDO2 security key or a local user account, if available.

Recommendations

Here's a list of recommendations to consider before enabling Windows passwordless experience:

• If Windows Hello for Business is enabled, configure the PIN reset feature to allow users to reset their PIN from the lock screen. The PIN reset experience is improved starting in Windows 11, version 22H2 with KB5030310
• Don't configure the security policy Interactive logon: Don't display last signed-in, as it prevents Windows passwordless experience from working
• Don't disable the password credential provider using the Exclude credential providers policy. The key differences between the two policies are:
  • The Exclude credential providers policy disables passwords for all accounts, including local accounts. Windows passwordless experience only applies to Microsoft Entra accounts that sign in with Windows Hello or a FIDO2 security key. It also excludes Other User from the policy, so users have a backup sign in option
  • Exclude credential providers policy prevents the use of passwords for RDP and Run as authentication scenarios
• To facilitate helpdesk support operations, consider enabling the local administrator account or create a separate one, randomizing its password using the Windows Local Administrator Password Solution (LAPS)

Known issues

There's a known issue affecting the in-session authentication experience when using FIDO2 security keys, where security keys aren't always an available option. The product group is aware of this behavior and plans to improve this in the future.

Provide feedback

To provide feedback for Windows passwordless experience, open Feedback Hub and use the category Security and Privacy > Passwordless experience.