Why am I being asked for a Passkey? How do I turn off passkeys?

Anonymous

I was opted into this without my knowledge, or without understanding how it works.

I have a solid understanding of Windows, and the security around it. But I do not understand why I suddenly am being forced to use, and constantly asked about passkeys, when I have not opted into them or set them up.

If I don't understand why I am being forced to use these, or why they are required, none of the less savvy users will. This will likely result in Microsoft spending more on tech support due to people being locked out of their devices.

Scenario: I have deleted the passkeys from my settings, and now my Edge logins have a discrepancy, because they are demanding passkeys that no longer exist.

For some reason, Windows is not allowing me to delete my Microsoft Passkey, because now that is required to sign in to my computer. I already have a PIN, a password, a fingerprint, and my face to sign in to my computer.

Is the only option logging out of my Microsoft Account and making it a local account to opt out of passkeys?

Passkeys need to be explained better if they are going to be a requirement, it needs to be a more gentle introduction.

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

Answer accepted by question author

Rob Koch 26,160 Volunteer Moderator

You've been using a passkey to login to Windows since you enabled Windows Hello to perform Face, Fingerprint or PIN login methods, since they' re an integral part of that system. They simply weren't as visible in the past, since the Passkey Management and using them for 3rd-party apps or websites weren't yet supported.

As usual, the problem is there are many documents available covering these and some confusing differences between the Azure Business-based systems using something called Entra for authentication and the consumer version of these related to your Microsoft Personal account. I'll include documents from both here in case you are more technically interested but tell you which I'm providing.

The first is an overview for consumer accounts and should help you understand how crucial they are to Microsoft's future authentication systems intended to remove the need for passwords, so trying to escae them is utterly pointless.

New passkey support for Microsoft consumer accounts | Microsoft Security Blog

This next one has more technical detail and in the first sections describes in general how they work, while a later section is specific to the Microsoft implementation and shows how these functions relate to Windows Hello, the Edge browser and other similar portions of Windows. I wouldn't typically provide this to the average consumer, but it really makes their operation on Windows clear for those wanting to understand them more deeply.

WebAuthn APIs - Windows Security | Microsoft Learn

I think I'll stop there for the moment to make sure you want more iformation, since upon quick review, these two documents cover the basics, while there are many others that provide the How-to explanations for individual portions of passkey operation.

Rob

< EDIT > BTW, here's a FAQ document with some common questions about passkeys, the last of which is titled; How can I provide feedback about my experience with passkeys?

Passkeys frequently asked questions (FAQ) - Microsoft Support

If you click the question to view the answer, you'll find a link to the Windows Feedback where you can submit your comments directly to Microsoft. Anything you post in this forum will only be seen by those who browse here, while virtually no Microsoft employees ever do and so your posts here are only really seen by us volunteer or a few contract helpers.

0 comments

Answer accepted by question author

quietman7 MVP Alumni 19,830 Volunteer Moderator

I appreciate your response. If a password and the multi-authentication code is not sufficient, what does a 'passkey' do?

Why doesn't Microsoft provide some easy-to-understand explanation of what a 'passkey' is and why it is different for every site?

I provided that information in a previous reply (page 11) but here are those and some more links by Microsoft with explanations.

Passkeys Authentication Across Platforms - How Passkeys Registration and Authentication Work Across Devices and Platforms

Quote

To combat such risks, phishing-resistant Passwordless authentication methods, including enhanced support for Microsoft Authenticator, have become critical.

Just for the record...Microsoft has long been a proponent of passwordless authentication for years so this is nothing new. Other industries have been moving in that direction too. .

Microsoft introduces passkeys for consumer account

In a nutshell...Passkeys are stored as secrets locally on a device and use a device's unlock mechanism such as Windows Hello biometrics (fingerprint or facial recognition) or PIN sign-In options to authenticate them before signing in. Passkeys can be used without the need for other sign-in challenges, making the authentication process faster and more convenient. A passkey is invisible, virtual and employ public-key cryptography (keypair concept: a private key and a public key). The passkey is purposely hidden from access inside the TPM (Trusted Platform Module).

A TPM chip is an embedded crypto-processor in laptops and is designed to provide hardware-based, security-related functions (carry out cryptographic operations. The TPM is isolated from the main processor and functions as a vault (a lockbox for keys) so in the event of malware attack or breach, sensitive user data remains secure.

0 comments

129 additional answers

Anonymous

2025-02-18T23:05:52+00:00

"Technically easier" is in the mind of the beholder. Forty years ago I was a whiz at computing in my age group, but today I am 91, with bad eyesight and technical slowness, and trying to navigate the "easier" passkey notion has kept me locked out of my system for months. What good will biometrics do for my family when they try to close down my computers after my death? The new sign-in demands activity at multiple unfamiliar levels of unknown processes, on multiple devicess, with instructions in an alien vocabulary. "Easier" is the last thing I would call passkeys.

Very grumpy old crone. Nan
Was this answer helpful?

6 people found this answer helpful.

0 comments No comments
Anonymous

2025-02-10T20:08:10+00:00

I have the same problem - Passkeys do NOT work for me and I am forced to do work arounds to sign on to my apps.
Was this answer helpful?

6 people found this answer helpful.

0 comments No comments
Rob Koch 26,160 Reputation points Volunteer Moderator

2024-10-14T20:12:29+00:00

Okay Jay,

I see your various points as a past security professional myself, but I disagree that retaining the TOTP or similar legacy systems is viable, since they're inherently flawed unless the entire user population is forced to migrate to password managers to use them, which we both know is unlikely to ever occur. Putting that effort into FIDO2 and the passkey interface is really the better path.

I basically agree with your initial statement that the difficulty of using the current interface is a stumbling block to acceptance and feel that though the FIDO Alliance took nearly a decade to get the core technology working, they spent too little time defining these interface requirements before releasing them to the general user population. It's really the inconsistency in implementation that's the deeper issue, while this Microsoft choice is simply one example of the worst sort of side effects.

I can't really address your specific statements regarding the security key use, since having the preferred Windows Hello option instead with my Surface Go means I won't see the initial issues that those using other methods do when first authenticating Windows, which is likely where the true problem we're discussing lies.

In fact, I've realized that this is likely why many don't understand they've actually already initialized Microsoft's passkey system by selecting Windows Hello, since this is the base over which the system operates, so they've inherently already got a Microsoft passkey if this is enabled.

Unfortunately, if you've seen the chaos that the current state of authentication is causing for everyone, especially consumers, Microsoft and the others can't really wait around to get the entire passkey system polished like they typically might. Instead, they'll need to focus on this issue in order to get at least their Windows 11 user population migrated as soon as possible, though I don't think they should even make this attempt with Windows 10 unless they decide to provide exactly the same management tools there, since that's another can of worms entirely.

Rob
Was this answer helpful?

5 people found this answer helpful.

0 comments No comments