Windows 10: Why are some users already registered for passwordless sign-in, in Authenticator?

We are in test phase of rolling out passwordless. At the stage of enabling passwordless sign-in with Authenticator, we are finding that some users already have this enabled but we are not clear why. Any ideas?

:)

 

Passwordless Sign-in for MS account

On my desktop running Win10, 22H2, OS build 19045.2364 I'm the admin of the local account with no user accts. While I was reading one of Shawn's excellent tutorial's: Enable or Disable Passwordless Sign-in for Microsoft Accounts in Windows 10, I was hoping to find where to disable Passwordless Sign-in for MS accounts. I have it enabled because the sign-in screen into my Microsoft account lists "other sign-in options" (or something to those words). I also verified in the registry and netplwiz that its enabled. When selecting other sign-in options, a security key that I set up, first of all, disappeared all by itself recently. The security key is only one of two sign-in options for Passwordless sign-in that I ever set up. The other option was a Windows Hello PIN which I had up until this year but its no longer an option after I removed it myself. So where the problem comes in is after the authentication option using a security key is re-added, it ends up disappearing after about 24 hours later. When that happens, it leaves zero Passwordless Sign-in options to use (Windows Hello PIN was removed by myself in June). But Passwordless Sign-In will still remain enabled even though I can't sign-in Passwordless with any options. I'm left with signing in by using 2-step verification processes that I've had. Perhaps this is grasping at straws. I was thinking if there's a switch to disable Passwordless Sign-in to Microsoft Accounts that's turned off first, maybe then the security key can successfully be re-added permanently.

 

Turn off Passwordless sign-in while using Authenticator App

On my personal Microsoft account I have Passwordless sign-in disabled through the website(in the Microsoft web page - account security -additional security - Passwordless account is set to "off"). However in the Microsoft Authenticator app (version 6.2306.4121 on android 13) it shows "Passwordless sign-in enabled" with no option to turn it off. The result is I get multiple authenticator prompts a day from other people trying to login as me. Whether it is people mistyping their email address or malicious actors trying access my account, I don't know. In either instance multiple times a day I get authenticator prompts from login's that aren't me. This results in MFA fatigue.

Ideally I would like to use traditional MFA something you know (password) and something you have (phone/ fido2 key, etc) with the Microsoft authenticator app. Unfortunately that doesn't seem to be an option without removing the authenticator app as a "ways prove who you are" in my Microsoft account.

 

do i still need two factor authentication with passwordless account

Do I still need two factor authentication with a passwordless account? It seems redundant considering the Authenticator is performing both functions. As you roll out the new passwordless account feature, perhaps it would be best to also turn off 2FA. What am I missing?

It also seems like a "Product" that could be listed in the topics selection could be for "Microsoft Account" questions. This question I have is not really Windows related, yet there is no better option. Just a suggestion.