Windows passwordless experience

Starting in Windows 11, version 22H2 with KB5030310, Windows passwordless experience is a security policy that promotes a user experience without passwords on Microsoft Entra joined devices.
When the policy is enabled, certain Windows authentication scenarios don't offer users the option to use a password, helping organizations and preparing users to gradually move away from passwords.

With Windows passwordless experience, users who sign in with Windows Hello or a FIDO2 security key:

• Can't use the password credential provider on the Windows lock screen

• Aren't prompted to use a password during in-session authentications (for example, UAC elevation, password manager in the browser, etc.)

• Don't have the option Accounts > Change password in the Settings app

  Note

  Users can reset their password using CTRL+ALT+DEL > Manage your account

Windows passwordless experience doesn't affect the initial sign-in experience and local accounts. It only applies to subsequent sign-ins for Microsoft Entra accounts. It also doesn't prevent a user from signing in with a password when using the Other user option in the lock screen.
The password credential provider is hidden only for the last signed in user who signed in Windows Hello or a FIDO2 security key. Windows passwordless experience isn't about preventing users from using passwords, rather to guide and educate them to not use passwords.

This article explains how to enable Windows passwordless experience and describes the user experiences.

System requirements

Windows passwordless experience has the following requirements:

• Windows 11, version 22H2 with KB5030310 or later
• Microsoft Entra joined
• Windows Hello for Business credentials enrolled for the user, or a FIDO2 security key
• MDM-managed: Microsoft Intune or other MDM solution

Windows edition and licensing requirements

The following table lists the Windows editions that support Windows passwordless experience:

Windows passwordless experience license entitlements are granted by the following licenses:

For more information about Windows licensing, see Windows licensing overview.

Enable Windows passwordless experience with Intune

To configure devices with Microsoft Intune, create a Settings catalog policy and use the following settings:

Assign the policy to a group that contains as members the devices or users that you want to configure.

Alternatively, you can configure devices using a custom policy with the Policy CSP.

User experiences

Lock screen experience

In-session authentication experiences

When Windows passwordless experience is enabled, users can't use the password credential provider for in-session authentication scenarios. In-session authentication scenarios include:

• Password Manager in a web browser
• Connecting to file shares or intranet sites
• User Account Control (UAC) elevation, except if a local user account is used for elevation

Example of UAC elevation experience:

Recommendations

Here's a list of recommendations to consider before enabling Windows passwordless experience:

• If Windows Hello for Business is enabled, configure the PIN reset feature to allow users to reset their PIN from the lock screen. The PIN reset experience is improved starting in Windows 11, version 22H2 with KB5030310
• Don't configure the security policy Interactive logon: Don't display last signed-in, as it prevents Windows passwordless experience from working
• Don't disable the password credential provider using the Exclude credential providers policy. The key differences between the two policies are:
  • The Exclude credential providers policy disables passwords for all accounts, including local accounts. Windows passwordless experience only applies to Microsoft Entra accounts that sign in with Windows Hello or a FIDO2 security key. It also excludes Other User from the policy, so users have a backup sign in option
  • Exclude credential providers policy prevents the use of passwords for RDP and Run as authentication scenarios
• To facilitate helpdesk support operations, consider enabling the local administrator account or create a separate one, randomizing its password using the Windows Local Administrator Password Solution (LAPS)

Known issues

There's a known issue affecting the in-session authentication experience when using FIDO2 security keys, where security keys aren't always an available option. The product group is aware of this behavior and plans to improve this in the future.

Provide feedback

To provide feedback for Windows passwordless experience, open Feedback Hub and use the category Security and Privacy > Passwordless experience.