Massive Microsoft account security change almost snuck out without enough warning

Your Microsoft account will now remain signed in automatically, which could pose a security risk if people don't know about the change.

Microsoft is about to make a major change to how sign-ins work within web browsers. Starting February 2025, you will automatically stay signed in to your Microsoft account. This is a significant change from the current behavior, which would sign out automatically after 24 hours.

The change aligns Microsoft more with Google, which already leaves accounts logged in. But that alignment is not necessarily a good thing. Google has been criticized for this behavior, and Microsoft will likely see some pushback.

The change will save some time for those who use Microsoft accounts on personal computers or within any secure environment. However, unless someone knows about the change, the new behavior could also increase security risks surrounding a Microsoft account.

It's good practice to explicitly sign out of your Microsoft account and other accounts after you've finished using a public or shared PC, but there was a built-in failsafe for those who did not sign out. Signing in an account by accident still leaves your details vulnerable for 24 hours, but after that, your account will be signed out automatically.

Alternatively, you can use private browsing. Microsoft recommends that route as a more secure way to use a public or shared PC.