Why did Personal Vault authentication change?

I think this is my last post here…after multiple tickets, dozens of emails and many hours on support chats and phone calls…with a variety of teams….I have  somewhat of a rant!

First let me say that each and every support representative sincerely tried to do their very best to help me…

It really seems this whole issue of OneDrive/Personal Vault security spans individual device settings; MS account settings; OneDrive settings and MS Authenticator settings and there is simply no support help positioned so handle issues arising from the interactions of these elements.

I went from Windows team to OneDrive team back to Windows team OneDrive team back to Windows team and finally to the Commercial team….

At one point, the Windows rep said his only resolution would be to create new local profiles and link them to my Microsoft account – I asked if there was no way to fix my existing Microsoft profiles which I’ve had for years….

My last interaction with Windows support felt the issue was with the Authenticator app which was handled by the Commercial team (I had explained this was purely personal involving a Microsoft 365 family account).

In any case, I was handed to the Commercial team…one of the representatives told me Authenticator was only for Commercial use – I pointed out One Drive Personal Vault utilized multi-factor authentication. I was handed off to someone else.

On a positive note, 3 of my 4 machines are now working they way they used to….I can sign in with a PIN and Personal Vault requires entry of the 8-digit Authenticator code.

I’m not sure how I got here – at the direction of support, I’ve created multiple local profiles, made setting changes, removed Hello PIN, set my account to Passwordless and then back to password, removed devices from my Microsoft account, re-established a PIN. Multiple Quick Assist sessions on multiple machines.

I may just rebuild the remaining machine from scratch and see what happens.

I spent a career in IT and have dealt with numerous application support scenarios and I empathize with the individual teams. In my career, I also had responsibility of the overall, end-user experience with IT solutions. That perspective seems to be missing….I’m a sophisticated user, fully vested in MS Operating Systems and applications and it’s taken hours of frustration over multiple weeks and I’m not sure why it broke originally or what actually fixed it….or if it will stay fixed.

I was travelling for a couple of weeks but had scheduled a Microsoft OneDrive support call for this morning...

I was on the phone for 1.5 hours and the OneDrive team wanted to turn off Hello PIN but couldn't get that to work. They referred me to the Windows team where I was on chat for another 2.5 hours at which point they were able to remove the Hello PIN option.

I was expecting to go back to using my account password but it seems that is not the case and TFA is required for sign-on to the computer. After trying this for a while, I realized this really wasn't workable as it placed too many dependencies on simply being able to use my PC. If I have no cell service, if my phone is dead, broken or lost my PC is unusable. While this dependency is acceptable for the heightened security of Personal Vault it's a fail point for simple PC use.

While on the phone with OneDrive, they acknowledged some changes that had been rolled out earlier this year producing issues they were working to resolve. The Hello PIN was a 'work around' attempt.

As others note, access is not terribly consistent with varying Authenticator app interactions. I one PC that still works just fine - uses the Hello PIN and Personal Vault asks for the 8-digit Authenticator code to access.

Thank you for this, it worked and it didn't.

On my W10 laptop this seems to have reverted to proper 2FA via the MS Authenticator App. I repeated the process on my W11 laptop, and the first time I tried to open the vault it used that slightly different method of 2FA where it uses the app, but displays a code for you to be certain it's the same request. The W10 machine did the same. I authorised it and all was good. However, after a single reboot the W11 laptop reverted to Fingerprint/PIN for the 2FA.

This rather repeated what I seen previously, when I removed both OneDrive for Business and OneDrive Personal. Reinstalled OneDrive personal and all works well. Repeated reboots and 2FA continued to work properly. But as soon as OneDrive for Business is added to this W11 laptop the OneDrive personal reverts to fingerprint/PIN.

Once OD business is installed any attempt tot get to the setting of OD personal causes the system try icon to disappear, I assume it's crashed in the background. If via file explorer or any other app like Word or Excel I attempt to access the files on the OD personal all is fine, it's just the System Tray access that has disappeared. Once restarted you can often get access at the second attempt.

All in all this has become very flaky and with less sense of security and expectation all is well.

Many thanks for the answer!

What other consequences are there of unlinking your MS Account from Windows? I'm not clever enough to understand fully what that means. Does the rest of OneDrive work still?

Hi, you can follow this article to unbind MS account from Windows.

Switch your Windows 10 device to a local account - Microsoft Support

And yes, everything still works the same. OneDrive, MS Edge, MS Outlook and all other MS apps keep you still signed in. As far as I know there is only one lost benefit. When the account is connected on Windows level, then it doesn't require your password. Windows should directly sign you into selected MS services. Plus, there are some synced Windows settings like wallpaper and so on.