diff --git a/dlls/windows.security.authentication.onlineid/authenticator.c b/dlls/windows.security.authentication.onlineid/authenticator.c
index c79dbdc89b6..b781be2595f 100644
--- a/dlls/windows.security.authentication.onlineid/authenticator.c
+++ b/dlls/windows.security.authentication.onlineid/authenticator.c
@@ -115,13 +115,134 @@ static const struct IActivationFactoryVtbl factory_vtbl =
     factory_ActivateInstance,
 };
 
+struct authenticator
+{
+    IOnlineIdSystemAuthenticatorForUser IOnlineIdSystemAuthenticatorForUser_iface;
+    LONG ref;
+};
+
+static inline struct authenticator *impl_from_IOnlineIdSystemAuthenticatorForUser( IOnlineIdSystemAuthenticatorForUser *iface )
+{
+    return CONTAINING_RECORD( iface, struct authenticator, IOnlineIdSystemAuthenticatorForUser_iface );
+}
+
+static HRESULT WINAPI authenticator_QueryInterface( IOnlineIdSystemAuthenticatorForUser *iface, REFIID iid, void **out )
+{
+    struct authenticator *impl = impl_from_IOnlineIdSystemAuthenticatorForUser( iface );
+
+    TRACE( "iface %p, iid %s, out %p.\n", iface, debugstr_guid( iid ), out );
+
+    if (IsEqualGUID( iid, &IID_IUnknown ) ||
+        IsEqualGUID( iid, &IID_IInspectable ) ||
+        IsEqualGUID( iid, &IID_IAgileObject ) ||
+        IsEqualGUID( iid, &IID_IOnlineIdSystemAuthenticatorForUser ))
+    {
+        *out = &impl->IOnlineIdSystemAuthenticatorForUser_iface;
+        IInspectable_AddRef( *out );
+        return S_OK;
+    }
+
+    FIXME( "%s not implemented, returning E_NOINTERFACE.\n", debugstr_guid( iid ) );
+    *out = NULL;
+    return E_NOINTERFACE;
+}
+
+static ULONG WINAPI authenticator_AddRef( IOnlineIdSystemAuthenticatorForUser *iface )
+{
+    struct authenticator *impl = impl_from_IOnlineIdSystemAuthenticatorForUser( iface );
+    ULONG ref = InterlockedIncrement( &impl->ref );
+    TRACE( "iface %p increasing refcount to %lu.\n", iface, ref );
+    return ref;
+}
+
+static ULONG WINAPI authenticator_Release( IOnlineIdSystemAuthenticatorForUser *iface )
+{
+    struct authenticator *impl = impl_from_IOnlineIdSystemAuthenticatorForUser( iface );
+    ULONG ref = InterlockedDecrement( &impl->ref );
+
+    TRACE( "iface %p decreasing refcount to %lu.\n", iface, ref );
+
+    if (!ref) free( impl );
+    return ref;
+}
+
+static HRESULT WINAPI authenticator_GetIids( IOnlineIdSystemAuthenticatorForUser *iface, ULONG *iid_count, IID **iids )
+{
+    FIXME( "iface %p, iid_count %p, iids %p stub!\n", iface, iid_count, iids );
+    return E_NOTIMPL;
+}
+
+static HRESULT WINAPI authenticator_GetRuntimeClassName( IOnlineIdSystemAuthenticatorForUser *iface, HSTRING *class_name )
+{
+    FIXME( "iface %p, class_name %p stub!\n", iface, class_name );
+    return E_NOTIMPL;
+}
+
+static HRESULT WINAPI authenticator_GetTrustLevel( IOnlineIdSystemAuthenticatorForUser *iface, TrustLevel *trust_level )
+{
+    FIXME( "iface %p, trust_level %p stub!\n", iface, trust_level );
+    return E_NOTIMPL;
+}
+
+static HRESULT WINAPI authenticator_GetTicketAsync( IOnlineIdSystemAuthenticatorForUser *iface, IOnlineIdServiceTicketRequest *request,
+                                                    IAsyncOperation_OnlineIdSystemTicketResult **operation )
+{
+    FIXME( "iface %p, request %p, operation %p stub!\n", iface, request, operation );
+    return E_NOTIMPL;
+}
+
+static HRESULT WINAPI authenticator_put_ApplicationId( IOnlineIdSystemAuthenticatorForUser *iface, GUID value )
+{
+    FIXME( "iface %p, value %s stub!\n", iface, debugstr_guid( &value ) );
+    return E_NOTIMPL;
+}
+
+static HRESULT WINAPI authenticator_get_ApplicationId( IOnlineIdSystemAuthenticatorForUser *iface, GUID *value )
+{
+    FIXME( "iface %p, value %p stub!\n", iface, value );
+    return E_NOTIMPL;
+}
+
+static HRESULT WINAPI authenticator_get_User( IOnlineIdSystemAuthenticatorForUser *iface, __x_ABI_CWindows_CSystem_CIUser **user )
+{
+    FIXME( "iface %p, user %p stub!\n", iface, user );
+    return E_NOTIMPL;
+}
+
+static const struct IOnlineIdSystemAuthenticatorForUserVtbl authenticator_vtbl =
+{
+    authenticator_QueryInterface,
+    authenticator_AddRef,
+    authenticator_Release,
+    /* IInspectable methods */
+    authenticator_GetIids,
+    authenticator_GetRuntimeClassName,
+    authenticator_GetTrustLevel,
+    /* IOnlineIdSystemAuthenticatorForUser methods */
+    authenticator_GetTicketAsync,
+    authenticator_put_ApplicationId,
+    authenticator_get_ApplicationId,
+    authenticator_get_User,
+};
+
 DEFINE_IINSPECTABLE( authenticator_statics, IOnlineIdSystemAuthenticatorStatics, struct authenticator_statics, IActivationFactory_iface )
 
 static HRESULT WINAPI authenticator_statics_get_Default( IOnlineIdSystemAuthenticatorStatics *iface,
                                                          IOnlineIdSystemAuthenticatorForUser **value )
 {
-    FIXME( "iface %p, value %p stub!\n", iface, value );
-    return E_NOTIMPL;
+    struct authenticator *impl;
+
+    TRACE( "iface %p, value %p\n", iface, value );
+
+    if (!value) return E_POINTER;
+    if (!(impl = calloc( 1, sizeof(*impl) ))) return E_OUTOFMEMORY;
+
+    impl->IOnlineIdSystemAuthenticatorForUser_iface.lpVtbl = &authenticator_vtbl;
+    impl->ref = 1;
+
+    *value = &impl->IOnlineIdSystemAuthenticatorForUser_iface;
+    TRACE( "created IOnlineIdSystemAuthenticatorForUser %p.\n", *value );
+    return S_OK;
 }
 
 static HRESULT WINAPI authenticator_statics_GetForUser( IOnlineIdSystemAuthenticatorStatics *iface, __x_ABI_CWindows_CSystem_CIUser *user,
diff --git a/dlls/windows.security.authentication.onlineid/tests/onlineid.c b/dlls/windows.security.authentication.onlineid/tests/onlineid.c
index f58fbb09078..e8f4e06ded3 100644
--- a/dlls/windows.security.authentication.onlineid/tests/onlineid.c
+++ b/dlls/windows.security.authentication.onlineid/tests/onlineid.c
@@ -48,6 +48,7 @@ static void check_interface_( unsigned int line, void *obj, const IID *iid )
 static void test_AuthenticatorStatics(void)
 {
     static const WCHAR *authenticator_statics_name = L"Windows.Security.Authentication.OnlineId.OnlineIdSystemAuthenticator";
+    IOnlineIdSystemAuthenticatorForUser *authenticator_for_user = (void *)0xdeadbeef;
     IOnlineIdSystemAuthenticatorStatics *authenticator_statics = (void *)0xdeadbeef;
     IActivationFactory *factory = (void *)0xdeadbeef;
     HSTRING str;
@@ -73,6 +74,14 @@ static void test_AuthenticatorStatics(void)
     hr = IActivationFactory_QueryInterface( factory, &IID_IOnlineIdSystemAuthenticatorStatics, (void **)&authenticator_statics );
     ok( hr == S_OK, "got hr %#lx.\n", hr );
 
+    hr = IOnlineIdSystemAuthenticatorStatics_get_Default( authenticator_statics, NULL );
+    ok( hr == E_POINTER, "got hr %#lx.\n", hr );
+    hr = IOnlineIdSystemAuthenticatorStatics_get_Default( authenticator_statics, &authenticator_for_user );
+    ok( hr == S_OK, "got hr %#lx.\n", hr );
+
+    check_interface( authenticator_for_user, &IID_IAgileObject );
+
+    IOnlineIdSystemAuthenticatorForUser_Release( authenticator_for_user );
     ref = IOnlineIdSystemAuthenticatorStatics_Release( authenticator_statics );
     ok( ref == 2, "got ref %ld.\n", ref );
     ref = IActivationFactory_Release( factory );