Microsoft Account Passwordless: What Changes for Outlook.com

Microsoft account passwordless is no longer a niche setting. Microsoft now describes a brand new account as passwordless by default, and the offer to delete the password you already have sits in your own security settings. If you own an Outlook.com or Hotmail address, that raises three practical questions: what signs you in once the password is gone, what happens the week you change phones, and whether you can put a password back. Each answer below comes from a Microsoft page, with a note where the official guidance stops.

Microsoft account passwordless: what it means for Outlook.com and Hotmail

An Outlook.com address and a Hotmail address are the same thing underneath: one consumer Microsoft account. Every setting in this guide lives in the same dashboard and behaves the same way whichever domain your address ends with.

New accounts can be created without a password

Microsoft’s security blog post of May 1, 2025, Pushing passkeys forward, states that brand new Microsoft accounts will now be “passwordless by default”, that new users have several passwordless options, and that they will never need to enroll a password. The same post says Microsoft automatically detects the best available method on your account and sets that as the default. Rechecked on the date of this article, that is still how Microsoft describes signing up.

Existing accounts can remove theirs

Nothing was taken away from accounts that already had a password. The same post puts the choice with you: existing users can visit their account settings to delete their password.

On an account that already has one, in other words, the change is opt-in, and the default Microsoft announces covers brand new accounts only. Dismiss the offer and your sign-in stays exactly as it is today, with the setting still waiting whenever you want it. Microsoft’s step-by-step page is how to go passwordless with your Microsoft account, and it is the source for the instructions further down.

Older apps and devices that still ask for a password

The same Microsoft page is blunt about the exception: “Some older versions of Windows, apps, and services still need a password.” Its own list runs to older Office versions, an older game console, a couple of older Windows versions and some mail services.

Read that list against your own routine before you delete anything. A sign-in you only reach for twice a year is the one you forget until it fails.

Microsoft account sign-in without a password: what replaces it

Microsoft’s passwordless page names what signs you in to a Microsoft account without a password: the Microsoft Authenticator app, Outlook for Android, Windows Hello, physical security keys, and SMS codes. Passkeys sit alongside them with their own setup page.

Microsoft Authenticator approvals

Microsoft’s instructions start before the setting: install Microsoft Authenticator, or Outlook for Android, and add your account to it. After the password is gone, signing in means approving a request in the app rather than typing anything.

The trade is visible. You have moved the credential onto a device, which is why the two sections on changing phones exist.

Passkeys on a phone, computer or security key

Microsoft’s guide to creating a passkey gives the path for a personal account: go to account.live.com/proofs/manage, choose the option for adding another way to sign in or verify, pick the face, PIN or security key choice, and follow the instructions your device shows.

Microsoft lists four places a passkey can be stored: a password manager, including Microsoft Password Manager or another synced credential manager; an iPhone, iPad or Android device; a physical security key; or a Windows device using Windows Hello. The page notes that confirming one may ask for an unlock gesture such as facial recognition or a PIN.

Windows Hello

Windows Hello turns your own PC into the credential. It is convenient and it is local, which cuts both ways: the sign-in works wherever that computer is, and nowhere else. Treat it as one method among several rather than the only one you keep.

One-time codes

Microsoft’s blog post describes being prompted to sign in with a one-time code instead of a password, and the support page lists SMS codes among the methods after removal. A code is only as good as the phone number or email address the account holds for you, which is why the recovery section below carries more weight than it first appears to.

Turning passwordless on, and turning it off

Removing your password in Additional security options

Microsoft’s order of operations, from its passwordless page:

1. Install Microsoft Authenticator, or Outlook for Android, and add your Microsoft account.
2. Sign in to your Microsoft account and open Additional security options.
3. Under “Passwordless account”, select Turn on.
4. Verify your identity when asked.
5. Approve the request when it arrives in the app.

Do steps one and two on a day you are not in a hurry, and do not remove the password until an approval has actually reached your phone once.

Microsoft account disable passwordless: adding a password back

This is the question most people want answered before they start, and the answer is yes. On the same Additional security options page, under “Passwordless account”, select Turn off, then Next, and follow the prompts to set a password.

Nothing here is one-way. Your other methods remain on the account afterwards, so adding a password back gives you an extra way in rather than undoing the rest.

Two recovery methods when two-step verification is on

Microsoft’s page states that if you have two-step verification turned on, you will need access to two recovery methods to go passwordless. Read that as the minimum. The password you are deleting was also a fallback, and removing it without replacing that role is the one mistake in this process that is genuinely hard to undo.

Microsoft Authenticator on a new phone

Microsoft’s route is a cloud backup tied to a Microsoft personal account, documented on its page about backing up your accounts in Microsoft Authenticator. We cover moving Google Authenticator to a new phone separately; read each app’s own page rather than assuming one behaves like the other.

Backing up while you still have the old phone

On Android: open the app, tap the three-dot menu, then Settings, turn on the Cloud Backup control, choose the Microsoft personal account that will hold the backup, and confirm.

On iOS: enable iCloud Drive, iCloud Keychain and iCloud Backup first, then find Authenticator in the iCloud list and turn its toggle on.

Both are things to do now, on the phone in your hand, not on the day the courier delivers the next one.

Restoring on the same phone platform

Microsoft is explicit that you can only back up and restore on the same device type, and that an iOS backup cannot be restored on an Android device. Switching platforms means setting the app up again from each account’s own settings.

What actually comes back is narrower than people expect:

The passwordless row is the one that matters here. If your Microsoft account relies on Authenticator for passwordless sign-in, the backup does not carry that sign-in across for you, so you need another method to get in and re-add it.

The Android backup change Microsoft lists for January 2027

Microsoft’s backup page carries a dated change for Android users: “Starting January 2027, you will no longer use your Microsoft personal account to enable backup.” It adds that you will need to enable ‘Microsoft Authenticator’ from Google One backup. If you are reading this after that date, check the page again before following the Android steps above, because the account that holds your backup will have moved.

Microsoft Authenticator new phone without old phone

A lost, wiped or traded-in phone with no backup behind it is the hard case. There is no reset button for it, only the methods you added earlier.

Signing in with another method you already added

Work through whatever else is on the account: a passkey on a second device, Windows Hello on a computer you own, a physical security key, or a one-time code to the email address or phone number Microsoft holds. Once you are in, add a method on the new phone before you do anything else.

Using a recovery code

A Microsoft account recovery code is a single string you generate in advance. Per Microsoft’s page on getting a recovery code, you open the Manage how I sign in page at account.live.com/proofs/manage/additional, scroll to the Recovery code section, and select Generate a new code. Microsoft advises printing it and keeping it away from the device you sign in with.

Two limits are easy to trip over. Generating a new code stops any previous code working, and Microsoft says you cannot retrieve or download a code you created earlier. A code you cannot find is a code you no longer have.

When only Microsoft’s account recovery form is left

Microsoft’s guidance is to try its account Sign-in Helper first, then the account recovery form, completed where possible on a device you previously signed in from and with a working email address Microsoft can reply to. The same page states the limit without softening it: where two-step verification is on and no alternate verification method can be reached, Microsoft says it cannot help.

Recovery methods to set before going passwordless

Set these while you can still sign in normally. The same instinct applies to the mail Microsoft sends about your account, and our guide to checking whether a Microsoft sign-in alert is real covers reading your own activity page rather than trusting a link.

An alternate email and phone you control

Add an email address and a phone number that you personally own and can still reach next year. Both are keys to the account, not contact details, so a number you rented, bought or share with anyone else has no business being there. Check once a year that both still answer.

A recovery code kept offline

Generate one, print it, and put it where you keep documents rather than where you keep devices. Its whole value is being unreachable from the phone you just lost.

A second passkey on another device

Passkeys are not limited to one. Creating a second one, on a different device or a physical security key, is the closest thing to a spare key for a passwordless account. If one device is gone, the other signs you in without any form, any wait, or any help desk.

Outlook.com and Hotmail accounts you manage for work

Your own sign-in methods on every account

If you run several Outlook.com or Hotmail inboxes for a job, the rule is the same on each: the password, the recovery contacts and the sign-in methods have to be yours and reachable. An account where someone else still holds a recovery address is not an account you control, whatever the inbox shows today. Our guide to Outlook.com grades and the sign-in rules Microsoft applies covers the activity requirements that keep a consumer inbox and its account open.

Be straight about the trade if the accounts were bought. Microsoft’s Services Agreement is explicit at section 4.a.i: the sign-in on a Microsoft account is not yours to pass to another person or company. Paying for a login is that handover, so it sits outside what Microsoft permits, and an account that breaks those terms can be closed at any time under the same agreement. Registering an Outlook.com address yourself costs nothing, and Microsoft 365 covers mailboxes a company has to keep, so one of those two is the right call for most work.

Where PVAVRT lists Outlook and Hotmail grades

For the cases where more inboxes are genuinely part of a legitimate job, PVAVRT publishes its Outlook account grades, where New (Fresh PVA) is $1.25 per account and the Outlook minimum is 5, and its Hotmail account grades, where New (Fresh PVA) is $0.99 and accounts are phone or email verified, with the minimum confirmed on Telegram. PVAVRT states it tests logins before delivery, and bulk pricing is quoted per product on Telegram.

If you manage Outlook.com or Hotmail accounts for work and need more for a legitimate job, ask PVAVRT on Telegram @pvavrt which grade fits, then set your own sign-in methods on arrival: your password first, then your recovery contacts, then a passkey or an Authenticator approval. Going passwordless is worth doing, but only on an account whose ways back in all lead to you.