This tutorial will show you how to turn on or off only allow Windows Hello sign-in for Microsoft accounts for passwordless sign-in on your Windows 11 device.
You can keep your device even more secure by removing passwords when signing in to Windows 11 with Microsoft accounts on your device. All the places on your device where you use your Microsoft account and password (even your apps and browsers) will automatically switch to modern multifactor authentication with Windows Hello Face, Fingerprint, or PIN.
References:
How to go passwordless with your Microsoft account | Microsoft Support
support.microsoft.com
Go passwordless in Windows | Microsoft Support
support.microsoft.com
You must be signed as an administrator to enable or disable passwordless sign-in for all Microsoft accounts on the computer.
If you turn on For improved security, only allow Windows Hello sign-in for Microsoft accounts on this device, the Users must enter a user name and password to use this computer check box in netplwiz will be removed for both local accounts and Microsoft accounts.
If you turn on For improved security, only allow Windows Hello sign-in for Microsoft accounts on this device, the Remove button to remove a PIN from Microsoft accounts will be disabled.
If you turn on For improved security, only allow Windows Hello sign-in for Microsoft accounts on this device, Microsoft accounts on the computer will not have the Password or Picture password sign-in options available.
- Option One: Enable or Disable Passwordless Sign-in for Microsoft Accounts in Settings
- Option Two: Enable or Disable Passwordless Sign-in for Microsoft Accounts using REG file
If you are not currently signed in to Windows with a Microsoft account, then you will need to use Option Two instead.
1 Open Settings (Win+I).
2 Click/tap on Accounts on the left side, and click/tap on Sign-in options on the right side. (see screenshot below)
3 Turn On (default) or Off For improved security, only allow Windows Hello sign-in for Microsoft accounts on this device for what you want on the right side. (see screenshots below)
The For improved security, only allow Windows Hello sign-in for Microsoft accounts on this device setting will be grayed out if you do not have a Windows Hello (ex: PIN, facial recognition, or fingerprint) sign-in option available.
4 You can now close Settings if you like.
1 Do step 2 (enable) or step 3 (disable) below for what you would like to do.
This is the default setting.
(Contents of REG file for reference)
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device]
"DevicePasswordLessBuildVersion"=dword:00000002
"DevicePasswordLessUpdateType"=dword:00000001(Contents of REG file for reference)
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device]
"DevicePasswordLessBuildVersion"=dword:00000000
"DevicePasswordLessUpdateType"=dword:000000014 Save the .reg file to your desktop.
5 If you have Smart App Control turned on, you will need to unblock the downloaded REG file.
6 Double click/tap on the downloaded .reg file to merge it.
7 When prompted, click/tap on Run, Yes (UAC), Yes, and OK to approve the merge.
8 You can now delete the downloaded .reg file if you like.
That's it,
Shawn Brink
- Enable or Disable Password Sign-in Option for Local Accounts in Windows 11
- Sign in to Windows 11
- Enable or Disable Automatically Sign in Account at Startup in Windows 11
- Enable or Disable Require Sign-in on Wakeup in Windows 11
- Add PIN to Account in Windows 11
- Remove PIN from Account in Windows 11
- Fix Something happened and your PIN isn't available on Windows 11
