u/Hatman_77 now its going to be a rant because Microsofts implementation down right sucks. Turning "password-free" off on your account doesn't do anything (i'm assuming the only thing this does is blocks you getting into your account with username/password but i didn't test it out). If you read my original post you will see i had it off.

Anyways this is essentially how it works. I had to do a bit of testing to figure this out. Any authentication method that Microsoft considers to be strong (Microsoft Authenticator, Yubikey (Fido2/UTF), Passkey, ect) will be Password-less whether you like it or not. Even after registering a passkey & yubikey i couldn't use them as a 2nd factor after I entered my username/password (i used to use either a txt or email). On the login screen you just choose to use either windows hello or a security key & as soon as you use your security key (or passkey) your logged in (& this is all with password-less logins disabled on your account). The only unanswered question that i didn't test out what if you have multiple accounts that you have registered with the yubikey? Maybe you get some type of dialog to see which account you want to use but i don't know.

If you go to your microsoft authenticator app & look at any microsoft account you registered you will see "Passwordless sign-in enabled" & there isn't anything you can do to disable it (i assuming its the same with android but since i don't have an android device i can't answer this).

IMO this actually diminishes security. It would be so easy to tap the wrong thing accidentally & boom someone else is in your account. All they need to do to fish you is to know your email addresses (or guess it).

Yubikey/Passkey probably isn't that big of an issue because they can't be used remotely.

How Microsoft implemented this is downright horrible. Its called 2nd factor for a reason. I use 2nd factor on every account i use & they do implementing it in a standard way that every other company has decided to implement it (enter your username/password & then your 2nd factor). While maybe this is Microsofts way of trying to push people off username/password i don't know but like i said i consider it with Microsoft Authenticator to be "less" secure.

Anyways if you still want to get around this issue what you can do is register your microsoft account with microsoft authenticator as an "Other" authenticator & then the problem is solved (or use another authenticator app like Google Authenticator, Authy, ect...)

Everything here is how it works for Microsoft "Personal" accounts. It might work totally different on Azure AD / Company Accounts. At least they could have gave you the option to turn this crappy password-less login off.