The order that matters
The safe sequence is replacement first, removal second. Before you touch the old passkey, make sure the account already has another way in that you can actually use right now — a different passkey on a device you hold, or another sign-in method already registered. Removing first and adding later is the step that strands people.
Microsoft states the same principle directly:
Microsoft advises adding replacement sign-in information before removing a needed passkey. Source
That sentence is the whole guide in miniature. The rest of this page is about applying it without guessing at menus.
Three things people call “a passkey”
A passkey entry in your Microsoft account is not the same object as the credential stored on your phone or laptop. Keeping the layers separate prevents most bad decisions.
| Layer | What it is | What removal affects |
|---|---|---|
| Account registration | The passkey entry listed in your Microsoft account’s security settings | Whether Microsoft will offer that passkey at sign-in |
| Device-bound storage | The credential held on a specific device, such as a security key or a device-bound passkey | Whether that device can still complete the sign-in it was registered for |
| Synced credential manager | A passkey synced through a password manager or platform keychain across devices | Whether other devices signed into the same manager can still use it |
A single visible passkey can therefore have an account-side record and a device-side copy. Deleting one does not automatically clear the other, which is why Microsoft treats them as two removal steps for work and school accounts.
For a work or school passkey, Microsoft instructs removing it from Security info and from the location where it was stored. Source
For personal accounts, the same separation is a useful mental model even where the exact steps differ. Do not assume a personal account and a work or school account behave identically; the organisation’s policies can add requirements that this page does not cover.
What you can see before you change anything
You do not have to delete blindly to find out what you have. The dashboard is designed to be read first.
Microsoft’s security dashboard lists passkeys, their saved location and last use and allows renaming or removing them. Source
The saved location and last-use fields are the practical decision inputs. A passkey whose last use is recent and whose location matches a device you still hold is probably worth keeping until its replacement is confirmed. A passkey tied to a device you no longer have is the usual candidate for replacement.
Replacement-first ledger
Work through this in order. Each row is a checkpoint, not a menu instruction — the exact labels on your account may differ, and this page does not claim a specific click path.
| Step | Question to answer | Evidence you can point to | Stop if… |
|---|---|---|---|
| 1. Inventory | Which passkeys and other sign-in methods are listed? | The entries and their saved locations in the security dashboard | You cannot see the full list |
| 2. Identify the survivor | Which method can you use today, on a device in your hands? | You have signed in with it recently | Every listed method depends on one device |
| 3. Add the replacement | Is the new passkey or sign-in method registered and confirmed? | It appears in the list and you have completed a sign-in with it | The new entry has not been exercised |
| 4. Remove the old entry | Is the old passkey no longer needed? | You have a working alternative from step 3 | Removal would leave only unverified methods |
| 5. Clear the device copy | Is a copy still stored on the old device or manager? | Microsoft’s two-location instruction for work or school passkeys | You are unsure which device holds it |
Step 3 is where most of the value sits. A replacement that exists only as a pending prompt is not a replacement yet; exercise it once before you remove anything.
Failure paths and what they mean
You removed the passkey and sign-in now fails. Stop adding changes. Use whatever other method your account still has, and treat the missing passkey as a replacement problem rather than a new-registration problem. If no method remains, recovery depends on the account type and the recovery details already on file; this page cannot promise a specific recovery route.
The old device is gone but the entry remains. This is the ordinary replacement case. Add the new method first, confirm it, then remove the stale entry. Do not remove it first on the assumption that you can re-add it later from the same device.
The passkey is a work or school one. Expect an extra step. Microsoft’s instruction to remove it from both Security info and the storage location means an account-side removal alone may not finish the job, and organisational policy may add its own conditions.
You are not sure which credential manager holds the synced copy. Pause at step 5. Removing the account entry is reversible in the sense that you can register again, but a synced copy you cannot locate is a reason to confirm your remaining methods before proceeding.
The dashboard shows a passkey you do not recognise. Do not delete it as a first move. A recent unfamiliar sign-in is a separate question from passkey hygiene, and it is worth reviewing sign-in activity before you decide whether the entry is yours.
Where this fits with other checks
Passkey cleanup is one narrow task. If the reason you opened the dashboard was an unfamiliar location or a sign-in you did not expect, the passkey list alone will not answer that question. Reviewing recent sign-in activity first gives you context for deciding whether an unfamiliar passkey entry is a device you forgot or something that deserves a closer look; see reviewing Microsoft sign-in activity before blaming an unfamiliar location for that separate task.
If your concern is broader — for example, whether an old username is still attached to public profiles elsewhere — that is a different kind of check. TraceSeek is a username lookup app that covers 3,000+ platforms, and its first scan is free and takes 20-30 seconds according to the product. A public username match is a lead, not proof that the same person owns the account, so treat results as pointers for your own verification rather than as confirmation.
A short checklist you can keep
- I have read the full list of passkeys and other sign-in methods on the account.
- I have noted the saved location and last use of each passkey.
- I have at least one method I can use right now, on a device I hold.
- I have added the replacement and completed a sign-in with it.
- I have removed the old account-side entry only after the above.
- For a work or school passkey, I have also cleared it from the location where it was stored.
- I have not assumed personal and organisational policies are the same.
What this page does not tell you
The editorial advice here is the ordering and the checkpoints. The product facts — what the dashboard lists, what Microsoft recommends before removal, and the two-location rule for work and school passkeys — come from Microsoft’s own guidance. This page does not describe specific menu labels, does not claim to have tested any account flow, and does not cover recovery procedures for an account with no remaining method. If your account is managed by an organisation, follow its instructions where they differ from this checklist.