Latest / The Windows Podcast with Fexingo: Microsoft, PC, and Enterprise Windows Conversations / How Windows 11 Is Moving Enterprise Users to Passwordless Login
Transcript
- Lucas: So Microsoft has been talking about a 'passwordless future' for years—but with Windows 11, they're actually forcing the issue for enterprise customers. And it's not just about convenience. It's about the fact that 92 percent of identity attacks start with a compromised password. Luna: That number comes from Microsoft's own Digital Defense Report, right? They've been citing it pretty aggressively. Lucas: Exactly. And the logic is hard to argue with. If you remove the password, you remove the single biggest attack vector. But for IT admins, the question is: how do you actually roll this out across thousands of machines without breaking everything? Windows Hello for Business is the centerpiece, and it's built into Windows 11. Luna: So this isn't a separate app or a third-party tool—it's native to the OS now? Lucas: Right. It's part of the sign-in experience. Windows Hello for Business uses either a PIN—which is device-specific and tied to the TPM chip—or biometrics like fingerprint or facial recognition. The key difference from a traditional password is that the credential never leaves the device. It's not sent over the network, so it can't be intercepted by a phishing site or a man-in-the-middle attack. Luna: But a PIN still feels like a password to a lot of users. What makes it more secure? Lucas: That's the common pushback. The difference is the TPM binding. A PIN is only valid on that specific device—it's backed by a hardware security module. If someone steals the PIN, they can't use it on another machine. And Windows 11 enforces that. Also, the PIN is typically more complex than a password because it can include letters and symbols, and it's tied to the device's Trusted Platform Module. Luna: So the threat model changes. Instead of worrying about credential reuse across sites, you're worrying about physical device theft. Lucas: Exactly. And for that, you have biometric fallback. But the enterprise push is really about FIDO2 security keys. Microsoft has been clear that the gold standard for passwordless is a hardware key—like a YubiKey—that uses public-key cryptography. Windows 11 has native FIDO2 support built into the OS, so you can register a key and use it to sign into both the device and cloud services like Microsoft 365. Luna: What's the adoption rate looking like? Are enterprises actually moving on this? Lucas: It's growing. Microsoft said that as of early 2026, over 200 million users are now using passwordless authentication across Azure AD and Windows. But that's still a fraction of the total enterprise base. The inertia is real. I talked to an IT director at a mid-size consulting firm—about 2,000 employees—who decided to go fully passwordless last year. They gave everyone a FIDO2 key and set Windows Hello as the default sign-in. Luna: How long did the migration take? Lucas: About six months from planning to completion. The hardest part wasn't the technology—it was the change management. Users hated being forced to use a PIN instead of typing their password. But after a few weeks, they got used to it. The IT team saw a 70 percent drop in help desk tickets related to password resets. That alone was worth the effort. Luna: So it's one of those rare security improvements that actually reduces operational costs. Lucas: Yeah, password resets are a huge drain. Forrester estimated that a single password reset costs an enterprise around 70 dollars in IT labor. Multiply that by thousands of users—it adds up fast. And that's not even counting the security incidents you avoid. Luna: What about legacy applications that still require a password? You can't just flip a switch and make everything passwordless. Lucas: That's the honest challenge. You can't. Microsoft's recommendation is to start with the apps that support modern authentication—Azure AD, Microsoft 365, Salesforce, things like that. Then use passwordless for the device login itself. For older on-prem apps that still use NTLM or basic auth, you either need to wrap them in a modern authentication gateway or accept that some passwords will linger. The goal is to reduce the password surface area, not eliminate it overnight. Luna: So it's a phased approach. That feels more realistic than a hard deadline. Lucas: Microsoft did set a soft deadline though. They've said that by the end of 2026, they want all Azure AD users to be passwordless by default. That doesn't mean passwords are banned—it means the default sign-in experience will be passwordless, and you'd have to opt into using a password. In Windows 11, that's already the case in the latest builds. If you set up Windows Hello during OOBE, you may never see a password field again. Luna: Interesting. And if something goes wrong—say the biometric sensor fails or the TPM gets corrupted—how do users get back in? Lucas: That's where the recovery process matters. Windows 11 has a built-in recovery flow that uses a PIN reset through Azure AD—if the user is connected to the internet—or a security key as a fallback. IT can also issue temporary access codes. The key is that the recovery process itself should be phishing-resistant. Microsoft has been pushing for what they call 'recovery without passwords'—using a secondary device like a phone or a hardware key. Luna: So it's not just about removing passwords—it's about redesigning the whole identity lifecycle around passwordless. Lucas: Exactly. And that's a big ask for IT departments that are already stretched thin. But the security payoff is enormous. Phishing attacks that target passwords become irrelevant. Credential stuffing? Irrelevant. Sim-swapping? Still a risk for sms based MFA, but that's why Microsoft is pushing for FIDO2 keys or Windows Hello, which don't rely on phone numbers. Luna: One thing I've heard from security folks is that passwordless can actually increase the risk of device theft—because if the device is the credential, losing the device means losing access. Lucas: That's a valid concern. But the counterargument is that with tpm bound credentials, the data on the device is encrypted. No one can extract the private key. And you can remotely wipe the device or revoke its certificates. Plus, with a hardware security key, you can have a separate factor. The idea is to move from 'something you know' to 'something you have' and 'something you are'. That's inherently more secure against remote attacks. Luna: What about cost? Security keys aren't free. For a 10,000-person organization, that's a significant line item. Lucas: It is. But the cost of a single data breach is orders of magnitude higher. IBM's 2025 breach report put the average cost at 4.88 million dollars. A FIDO2 key costs around 20 to 40 dollars per user. So for 10,000 users, that's maybe 400,000 dollars—less than a tenth of one breach. And you can also use the phone as a passkey via Bluetooth, which reduces the hardware cost. Microsoft's Authenticator app supports passwordless sign-in. Luna: Right, so there's a tiered approach. Phone-based passkeys for lower-risk users, hardware keys for high-privilege accounts like admins. Lucas: Exactly. And Windows 11 makes that distinction easy to enforce—you can set conditional access policies that require a hardware key for certain roles. That's where the real power of passwordless shines: it's not just about user convenience, it's about risk-based authentication. The same user might use a phone passkey to check email, but need a YubiKey to approve a wire transfer. Luna: I want to circle back to the user experience for a moment. Because a lot of enterprise workers are not tech-savvy. They just want to log in and work. How does Windows 11 handle that transition? Lucas: Microsoft has put a lot of effort into the setup flow. When you first set up a Windows 11 device, it prompts you to set up Windows Hello—either a PIN or biometric. If you choose fingerprint, for example, it walks you through enrolling your finger. After that, the login screen shows your picture and asks for your fingerprint. It's actually faster than typing a password. The friction is only during the initial setup. Luna: Except when an IT admin rolls out a policy that requires a security key for login. Then the user has to insert the key and press a button. That's a different muscle memory. Lucas: It is. And some users will resist. But the feedback from early adopters is that after a week, most people prefer it because they don't have to remember a password. And for IT, no more reset requests. That's a huge win. Luna: Let's talk about the elephant in the room: what about users who don't have a biometric sensor? Not every enterprise laptop has a fingerprint reader or IR camera. Lucas: That's a real barrier. Windows Hello requires either a fingerprint sensor or an infrared camera for facial recognition. Many lower-cost enterprise laptops ship without them. In that case, you fall back to a PIN—which is still passwordless in the sense that it's device-bound. Or you use a FIDO2 security key. But the hardware requirement does mean that some organizations will need to upgrade their device fleets to fully embrace passwordless. Microsoft is aware of this, and they've been working with OEMs to make biometric sensors standard on business laptops. In 2026, most new enterprise models include at least a fingerprint reader. Luna: So the trend is clear. But what about the timeline for the average enterprise? When do you think we'll see the majority of businesses fully passwordless? Lucas: If I had to guess, I'd say by 2028 or 2029. The technology is ready, but the organizational change takes time. Windows 11 gives IT the tools to start today—with hybrid deployments, conditional access, and support for multiple authenticators. The biggest variable is will. The security argument is overwhelming, but change management is always the bottleneck. Luna: And I guess the other variable is the legacy app problem. As long as there's an old HR system that requires a password, you can't go completely passwordless. Lucas: Right. But you can isolate that. Use passwordless for everything else, and treat the legacy system as an exception. Over time, those systems get modernized or replaced. The direction is irreversible—passwords are on the way out. Windows 11 is the platform that makes that possible. Luna: It's interesting to see Microsoft putting so much pressure on this. They've been saying it for years, but now the OS itself is designed to discourage passwords. Lucas: Yeah, and that's a good thing for security. I think it's one of the most impactful changes in Windows 11 for enterprises, even though it doesn't get as much attention as the UI changes. Luna: Absolutely. And if you found this conversation valuable, it's exactly the kind of thing that keeps us going here. A couple of dollars a month genuinely makes a difference—helps us keep the show ad-free and focused on real technical depth. If you've gotten something out of it, you can support us at buy me a coffee dot com slash fexingo. No pressure at all, but it helps. Lucas: Yeah, and we really appreciate everyone who does. It lets us spend the time digging into these topics rather than chasing sponsors. So thank you. Now, back to passwordless—Luna, you mentioned the legacy app problem. One thing I want to highlight is that Microsoft is also pushing 'passkeys' as a standard across browsers and devices. Windows 11 integrates passkey management into the OS, so you can use the same biometric to sign into websites. That's another layer of password elimination. Luna: So the vision is a world where you never type a password anywhere. The OS becomes your identity provider. Lucas: Exactly. And with Windows 11, that vision is much closer to reality than most people realize. The infrastructure is in place. The question is just execution at the organizational level. Luna: Well, thanks for the deep dive. It's definitely given me a clearer picture of what's coming. Lucas: Glad to hear it. That's all for this episode of The Windows Podcast. We'll be back next week with another angle on the enterprise Windows experience.