The whole idea is about moving to passkeys, which are like super passwords unique to a device. The face/finger/pin is the second Auth to use the passkey.

Not saying this is good or bad, but msoft does have an faq about passkeys

The major thing I still don’t understand is, without a password, how do you authenticate people who lost access to their device/passkey.