Its totally up to user, but pin will be more secure, and password will be Microsoft account if you sign in with Microsoft account.