Passwordless authentication
Passwordless authentication lets someone sign in without entering an account password, using another authentication method such as a passkey or an enrolled authenticator.
Ask which method replaces the password
“Passwordless” describes the sign-in experience, but it does not tell you everything about its protection. Microsoft Authenticator phone sign-in, for example, lets someone approve a sign-in through their enrolled phone instead of entering an account password.
Microsoft separates passwordless MFA from phishing-resistant MFA in its authentication strengths. Authenticator phone sign-in qualifies for the former, while FIDO2 security keys qualify for both. Removing the password prompt alone does not establish that a credential cannot be relayed through a phishing site.
That distinction matters when someone says an account “has passwordless enabled.” Ask which method was actually used and what the resource required. The MFA claim article explains why a successful MFA result is not a complete description of the authentication.
Registration still grants access
A passwordless credential has to become associated with the right account. In Microsoft’s phone sign-in implementation, enrollment and the tenant’s authentication-method policy determine whether the person can use it.
Treat requests to replace or enroll an authenticator as access decisions. A strong credential registered to the wrong person is still the wrong person’s access. Recovery trust boundaries examines the verification work needed when someone can no longer use their established sign-in method.