The Password Problem Isn't Going Away on Its Own

Honestly, we've known for years that passwords are a mess. They get phished, reused, guessed, and leaked — and yet most of us have been stuck managing a growing pile of them. Microsoft has apparently had enough. On World Passkey Day, May 7, the company made a sweeping announcement: passwords aren't just being supplemented anymore. They're being treated as an attack surface to eliminate entirely.

That's a meaningful shift in framing. It's not "here's a better alternative." It's "the old way is the problem."

Microsoft's Own House Is Already in Order

Here's what makes this announcement feel more credible than typical corporate roadmap talk — Microsoft pointed to its own internal transformation as proof of concept. The company has already rolled out phishing-resistant credentials covering 99.6% of its own users and devices, and weaker authentication methods have been stripped out entirely.

The experience, as Microsoft described it: no codes to enter, no extra prompts to manage. Just a clean, straightforward sign-in. When a company this size can pull that off internally, it's harder to dismiss the broader push as wishful thinking.

5 Billion Passkeys and Growing

The timing of Microsoft's announcement wasn't accidental. The FIDO Alliance released its State of Passkeys 2026 report around the same moment, and the numbers are genuinely striking. There are now an estimated 5 billion passkeys in active use worldwide. The research — spanning 11,000 consumers and 1,400 enterprise decision-makers — found that 75% of people have enabled a passkey on at least one account. On the enterprise side, 68% of organizations have either deployed passkeys for employee sign-ins or are actively in the process.

That's not a niche pilot program anymore. That's mainstream adoption.

What's Actually Shipping — The New Features

So what did Microsoft actually announce? A few things worth paying attention to:

Entra Passkeys on Windows — This allows users on personal or unmanaged devices to create and use device-bound passkeys through Windows Hello. General availability is coming in late May 2026.

Entra External ID Passkeys — Aimed at customer-facing applications, these also hit general availability in late May. So if you're building apps on top of Microsoft's identity platform, this matters.

Passkey Sync in Microsoft Edge for Enterprise — This extends a capability that was previously only available for personal accounts. Enterprises can now sync passkeys across devices through Edge, with iOS and Android support rolling out soon through the Microsoft Password Manager.

Entra ID Account Recovery — This one's interesting because recovery has always been the awkward gap in passwordless conversations. If you lose all your authentication methods, you can now regain access through government-issued ID and biometric face checks. That's generally available now.

Security Questions Are Getting Axed

Starting in January 2027, security questions will no longer be a password reset option in Microsoft Entra ID. The reason given is blunt: they're vulnerable to social engineering. And honestly, that's fair — "What was your first pet's name?" was never real security.

But Microsoft also tied this to something more forward-looking. The company specifically flagged the rise of AI agents as a reason the urgency around this has increased. If a compromised identity can be exploited by an automated agent to access systems and execute workflows, the blast radius of weak authentication grows significantly. Security questions in that context aren't just weak — they're a liability.

The Broader Timeline

This isn't a sudden pivot. Microsoft auto-enabled passkey profiles for all Entra ID tenants back in March 2026. Before that, the company joined dozens of other organizations in a broader industry pledge to accelerate passkey adoption. The World Passkey Day announcement is the latest chapter in what's been a deliberate, multi-year strategy.

The throughline is consistent: legacy passwords aren't a fallback to keep around just in case. They're the thing being retired.