Microsoft to Abandon Passwords and Support Deletion

At CyberStreams, we protect non-profits from one of the most persistent cybersecurity threats, password-based attacks. And now, one of the biggest names in tech is taking a bold step to help combat them. Microsoft is phasing out passwords for new accounts, defaulting instead to passkeys, a modern and much more secure method of authentication.

So what does this mean for your organization, and why should you care?

Why Passkeys Matter

Passkeys rely on biometrics, like fingerprints or facial recognition or device-stored PINs, making them phishing-resistant and significantly more secure than traditional passwords. It’s like upgrading from a rusty old padlock to a high-tech vault.

Microsoft's move couldn’t come at a more urgent time. In 2024, the company observed an astonishing 7,000 password attacks per second, double the rate from just a year earlier. And they’re not the only ones responding to this alarming trend. When Accenture went passwordless in 2023, they saw a 60% drop in login failures, demonstrating how effective this strategy can be.

A Wake-Up Call for Non-Profits

Unfortunately, non-profits are far from immune. The Red Cross suffered a significant breach in 2022 via stolen passwords, compromising sensitive donor data. And in January 2025, over 60 million students and teachers were affected when attackers accessed PowerSchool software using stolen credentials.

That breach, like many others could have been entirely prevented with the use of passkeys. Unlike passwords, passkeys can’t be stolen, phished, or reused. They work only on the intended device and only for the intended user.

Microsoft’s Passwordless Future

Think of Microsoft’s strategy like a well-planned game night: they’re playing to win by completely removing the hacker’s favorite weapon passwords from the equation.

• New Microsoft accounts now skip passwords entirely, using Windows Hello or Microsoft Authenticator by default.

• Existing users can go into settings and permanently delete their passwords.

This move aligns with the FIDO Alliance standards, a global initiative to create open and phishing-resistant authentication methods. Experts warn that state actors, like those from Russia, may try to exploit the remaining users still clinging to passwords. And with 41% of breaches involving social engineering (Verizon DBIR, 2025), the time to act is now.

Three Key Takeaways and What to Do Next

At CyberStreams, we recommend the following immediate actions to protect your non-profit organization:

1. Adopt Passkeys ASAP

Enable passkeys on all Microsoft accounts. Once verified, delete any remaining passwords and disable the option to create new ones. This cuts off a major attack vector entirely.

2. Use Phishing-Resistant MFA

Until you’re fully password-free, make sure any multi-factor authentication (MFA) method you use is phishing resistant. A simple rule of thumb: if it asks for a 6-digit rotating code, it can be phished. Use Microsoft Authenticator's passwordless sign-on instead.

3. Deploy Real-Time Threat Detection

Even with passkeys, having a real-time monitoring tool is essential. CyberStreams offers Microsoft 365 Protection, which currently boasts 100% effectiveness with zero false positives, and fully remediates compromised accounts in under 10 minutes.

Conclusion: The End of Passwords is a New Beginning

Microsoft’s shift away from passwords isn’t just a tech trend it’s a turning point in cybersecurity. For non-profits, who often work with limited IT resources and sensitive data, this transition offers a much-needed layer of protection against an evolving threat landscape.

By embracing passkeys, enforcing phishing-resistant MFA, and monitoring in real time, non-profits can finally turn the tide against credential-based attacks. At CyberStreams, we're here to guide you through this transition and keep your mission safe.

Now is the time to move beyond passwords, for good.