Passwordless authentication: why is Microsoft pushing for the end of passwords?
Passwords are no longer the problem. They have become the risk.
For more than twenty years, the password has been the cornerstone of digital security. It alone embodied trust in the digital world.
That era is gradually coming to an end.
Today, the majority of cyberattacks no longer target infrastructure or applications. They primarily target users. Phishing techniques, credential theft, adversary-in-the-middle attacks, bypassing MFA, and social engineering allow attackers to gain access to systems by impersonating legitimate users.
As Nadim Abdo, Corporate Vice President of Identity and Network Access Engineering at Microsoft, points out: “As identity-based attacks become more sophisticated in the age of artificial intelligence, organizations must adopt more robust authentication methods to protect their users against phishing, credential theft, and social engineering techniques.” (1)
Faced with this reality, a conviction is gradually taking hold within the industry: it is no longer enough to simply strengthen passwords. It is becoming necessary to move beyond them altogether.
Identity has become the new security perimeter
Enterprise security has long relied on protecting networks, workstations, and applications.
With the widespread adoption of the cloud, remote working, and hybrid identities, traditional boundaries have gradually disappeared.
Identity has become the new security perimeter.
This shift explains why cybercriminals are investing heavily in techniques designed to compromise authentication mechanisms rather than exploit software vulnerabilities.
Even when multi-factor authentication is implemented, certain legacy methods such as text messages or phone calls remain vulnerable to now well-documented scenarios: interception, SIM swapping, session hijacking, or psychological manipulation of users.
In this context, the concept of phishing-resistant authentication is becoming a strategic priority.
Passkeys: a new generation of authentication
Passkeys (or access keys) are based on a model that is radically different from the traditional password.
Instead of sharing a secret between the user and the service, they rely on a public-key cryptography mechanism. The private key remains protected on the user’s device, while a public key is registered with the service provider.
The user experience then relies on mechanisms that are already familiar:
- facial recognition;
- fingerprint;
- local PIN;
- physical security key.
This approach eliminates the element most easily exploited by an attacker: the possibility to share the secret.
As Microsoft experts Vasu Jakkal, Corporate Vice President of Microsoft Security, and Nadim Abdo, Corporate Vice President of Identity and Network Access Engineering, point out: “True progress isn’t just about offering more robust ways to sign in. It also involves eliminating authentication mechanisms vulnerable to phishing and strengthening the scenarios frequently exploited by attackers, particularly account recovery processes.” (1)
Access keys are therefore not merely an improvement on existing MFA. They represent a paradigm shift aimed at permanently eliminating the main vectors of identity theft.
Why is Microsoft accelerating its passwordless strategy now?
Recent announcements regarding Microsoft Entra mark a significant turning point.
Microsoft has announced that access keys will gradually become the preferred authentication method in Entra ID (1) and that SMS and voice mechanisms will no longer be provided natively by Microsoft starting in 2027 (2).
Beyond a simple technological evolution, this decision sends a strong message: legacy authentication methods are no longer adequate for the current threat landscape.
Nadim Abdo puts it plainly: “We strongly recommend that organizations migrate their users to passkeys or any other phishing-resistant authentication method as soon as possible.” (1)
To support this transition, Microsoft is also implementing (1) (2):
- automated enrollment campaigns for passkeys;
- a simplified passkey creation experience;
- the ability to use a passkey as the first MFA factor;
- recognition of Windows Hello for Business as a standalone MFA factor;
- the extension of the passwordless model to B2B scenarios.
Passwordless authentication is thus gradually becoming the expected standard, rather than a long-term vision.
A transformation that goes beyond technology
However, it would be a mistake to reduce the transition to a passwordless model to a simple authentication project.
Its adoption requires rethinking several fundamental aspects:
- identity governance;
- account recovery processes;
- business continuity scenarios;
- fallback authentication mechanisms;
- change management for employees.
In other words, this transformation is not solely a technological one; it also requires organizational change.
Companies must identify the affected user groups, adapt their authentication workflows, modernize their applications, and anticipate situations requiring alternative mechanisms.
As with any identity-related transformation, the project’s success depends as much on governance as on technology.
Is the password on its way out?
Passwords won’t disappear overnight.
Some legacy applications will continue to rely on traditional login mechanisms for several more years.
Nevertheless, the market trajectory now appears very clear. After rolling out MFA on a large scale, major identity providers are now directing their investments toward phishing-resistant methods based on modern cryptography.
The goal has shifted: rather than constantly strengthening password protection, the focus is now on doing away with passwords altogether.
Our Belief
At Magellan, we believe that the widespread adoption of passwordless authentication is one of the most transformative developments in modern cybersecurity.
Beyond reducing cyber risk, it offers the opportunity to simplify the user experience, strengthen digital trust, and sustainably modernize identity governance strategies.
Companies that embark on this transformation today will have a significant advantage against threats that are increasingly automated, sophisticated, and driven by artificial intelligence.
The security of the future will not consist of better protecting passwords. It will consist of no longer relying on them.