Microsoft now lets users use phone authentication instead of passwords to access accounts
Microsoft's Authenticator app can now save you a step when logging into anything that requires a Microsoft Account. According to a blog post from the company's identity division …
Context & Ripple Effects
This 2017 move is one early rung in a ladder Microsoft has been climbing since it consolidated its separate two-factor apps into Microsoft Authenticator the year before: turn the phone from a second factor into the primary credential. What changes here is that the Authenticator prompt can replace the typed password outright for Microsoft Account sign-ins, not just supplement it.
First-order effects
- Microsoft Account holders can now approve logins with an Authenticator notification instead of entering a password, shifting the trust anchor from a memorized secret to possession of the registered device.
Second-order effects
- Once the consumer flow works, Microsoft extends the same mechanism to enterprises, bringing password-less sign-in via Authenticator to Azure Active Directory-connected apps the following year.
Third-order effects
- If the pattern holds, the password stops being the default at all: Microsoft reaches that endpoint in 2021 when it lets users access accounts without a password entirely, and later makes new accounts passwordless by default.
The trend: Consumer and enterprise identity is migrating from shared-secret passwords to device-bound possession factors, with Microsoft's Authenticator serving as the on-ramp.