Why did Personal Vault authentication change?

Shortly after my March 20 post above, my remaining machine (of 4 devices I use) began requiring the Authenticator app code.

From March 21 to this morning, all 4 of my devices utilized the obtained from the Authenticator app. All was wonderful!

Sadly, this afternoon, 2 of my 4 devices reverted back to only needing the Hello PIN without requiring the two factor authentication.

For anyone seriously concerned about optimal security, this is an enormous problem...and Microsoft just doesn't have a clue how this is happening or how to fix this....

I think this is my last post here…after multiple tickets, dozens of emails and many hours on support chats and phone calls…with a variety of teams….I have  somewhat of a rant!

First let me say that each and every support representative sincerely tried to do their very best to help me…

It really seems this whole issue of OneDrive/Personal Vault security spans individual device settings; MS account settings; OneDrive settings and MS Authenticator settings and there is simply no support help positioned so handle issues arising from the interactions of these elements.

I went from Windows team to OneDrive team back to Windows team OneDrive team back to Windows team and finally to the Commercial team….

At one point, the Windows rep said his only resolution would be to create new local profiles and link them to my Microsoft account – I asked if there was no way to fix my existing Microsoft profiles which I’ve had for years….

My last interaction with Windows support felt the issue was with the Authenticator app which was handled by the Commercial team (I had explained this was purely personal involving a Microsoft 365 family account).

In any case, I was handed to the Commercial team…one of the representatives told me Authenticator was only for Commercial use – I pointed out One Drive Personal Vault utilized multi-factor authentication. I was handed off to someone else.

On a positive note, 3 of my 4 machines are now working they way they used to….I can sign in with a PIN and Personal Vault requires entry of the 8-digit Authenticator code.

I’m not sure how I got here – at the direction of support, I’ve created multiple local profiles, made setting changes, removed Hello PIN, set my account to Passwordless and then back to password, removed devices from my Microsoft account, re-established a PIN. Multiple Quick Assist sessions on multiple machines.

I may just rebuild the remaining machine from scratch and see what happens.

I spent a career in IT and have dealt with numerous application support scenarios and I empathize with the individual teams. In my career, I also had responsibility of the overall, end-user experience with IT solutions. That perspective seems to be missing….I’m a sophisticated user, fully vested in MS Operating Systems and applications and it’s taken hours of frustration over multiple weeks and I’m not sure why it broke originally or what actually fixed it….or if it will stay fixed.

I was travelling for a couple of weeks but had scheduled a Microsoft OneDrive support call for this morning...

I was on the phone for 1.5 hours and the OneDrive team wanted to turn off Hello PIN but couldn't get that to work. They referred me to the Windows team where I was on chat for another 2.5 hours at which point they were able to remove the Hello PIN option.

I was expecting to go back to using my account password but it seems that is not the case and TFA is required for sign-on to the computer. After trying this for a while, I realized this really wasn't workable as it placed too many dependencies on simply being able to use my PC. If I have no cell service, if my phone is dead, broken or lost my PC is unusable. While this dependency is acceptable for the heightened security of Personal Vault it's a fail point for simple PC use.

While on the phone with OneDrive, they acknowledged some changes that had been rolled out earlier this year producing issues they were working to resolve. The Hello PIN was a 'work around' attempt.

As others note, access is not terribly consistent with varying Authenticator app interactions. I one PC that still works just fine - uses the Hello PIN and Personal Vault asks for the 8-digit Authenticator code to access.

TFA that requires a real-time secondary authentication is inherently safer than any method that relies solely on a single factor or physical possession of a key or fob.

Personal Vault used to have a required TFA step.

The potential for someone to physically possess one of my computer devices and or my PIN is certainly within the realm of possibility.

The potential for some to possess the above AND to have my smart phone + the authentication to my phone is a magnitude less likely.

I started with a trial subscription, determined that it met my requirements and purchased an annual family subscription.

The TFA requirement changes the fundamental decision for my purchase.

This is exactly what happened to me just today - I can select to use another method (so can access Authenticator), but I want it to be the default. Can you share how you solved it please? I never really find the Microsoft answers really answer the question asked. They're always some step away from the real issue. Many thanks.