We require Windows Hello across our environment, but one user is running the new Outlook client, which opens web-based interfaces through Microsoft Edge. An Outlook-integrated application uses Microsoft 365 for SSO, but its sign-in flow expects a username and password. When the user attempts to log in, Edge automatically tries to authenticate with Windows Hello instead, causing the SSO attempt to fail. The default Windows browser is already set to Chrome, but new Outlook appears to ignore that setting. Removing the saved passkey is not an option because it is required for Windows Hello. Is there a way to prevent this specific sign-in from automatically using Hello, or otherwise make the application work with the current setup?
4 Answers
Changing the default browser generally will not fix this because new Outlook can use Edge internally for Microsoft web authentication. I would avoid deleting the Hello-related passkey, since that could disrupt the required Windows Hello setup. Instead, look for an application-specific authentication policy or an identity-provider setting that allows password fallback for this one application, if your security requirements permit it.
First, check the Microsoft Entra sign-in logs for this user and application. The authentication details should show whether the failure is coming from a passkey, a Windows Hello for Business policy, Conditional Access, or the application's authentication flow. That should help identify whether the fix belongs in identity policy or in the application itself.
The cleanest long-term fix is probably updating the application to support Windows Hello or passkey-based authentication. If it only supports username and password while the tenant is configured to prefer Hello, the two authentication methods are going to conflict. There may be a “sign in another way” option on the Microsoft sign-in page, but it may be hidden or unavailable depending on the tenant policies and the application's embedded browser behavior.
If the new Outlook client is not officially supported by the application vendor, test the same workflow in classic Outlook or Outlook on the web. New Outlook uses its own web-based components and may not honor the system default browser or expose the same authentication controls. If the sign-in works in the supported client, that points to a compatibility issue rather than a Windows Hello setting.
The application can be updated, but we currently have other users who still need username-and-password authentication, and only one sign-in option can be configured. In this case the page automatically attempts Hello and never offers another method.