Microsoft is testing passwordless Windows lock-screen sign-in for devices joined to both an organization’s local directory and Microsoft Entra. The change extends web sign-in to Entra hybrid joined devices, allowing supported users to authenticate with a security key, a phone passkey or a Temporary Access Pass.
The feature is included in Windows 11 Insider Experimental Preview Build 26340.9750, released on October 16. Web sign-in previously supported Entra joined devices without the same hybrid configuration. The experimental build expands that option for organizations retaining local infrastructure alongside Microsoft’s cloud identity service.
Web sign-in is a Windows credential provider, the component that supplies a sign-in method at the lock screen. Microsoft introduced it in Windows 10 with support only for the Temporary Access Pass, a time-limited passcode that an administrator grants to a user, and expanded it in Windows 11. Microsoft’s current web sign-in documentation states that the feature is not supported on Entra hybrid joined or domain joined devices, the limitation this build begins to remove.
After a successful web sign-in, Windows obtains a Kerberos ticket so the user can continue accessing on-premises file shares and internal websites. Kerberos is the authentication system used to provide access to many local corporate applications and network resources. The change lets the initial passwordless sign-in coexist with those resources instead of requiring a separate password at the Windows lock screen.
Web sign-in authenticates over the internet, and Microsoft’s documentation says cached credentials are not supported, so users cannot sign in with it while a device is offline. Organizations can pair it with Windows Hello for Business to hide the password option from the lock screen entirely.
The same preview also adds an optional Windows Hello adjustment for facial recognition in a dark or dimly lit room. When enabled, Windows temporarily brightens the screen during recognition. Users can find the switch under Settings, Accounts, Sign-in options and Facial recognition, where it is labeled Automatically adjust screen brightness during face recognition.
The build is based on Windows 11 version 26H2 and reaches the Experimental channel through an enablement package. Microsoft uses controlled feature rollouts, initially enabling changes for a subset of Insiders before expanding access. These are prerelease features: Microsoft cautions that experimental functionality can change, be removed or never reach a general Windows release.
Sources: Microsoft, Microsoft Learn
–
By the ID Tech Editorial Team
