diff --git a/.openpublishing.redirection.windows-security.json b/.openpublishing.redirection.windows-security.json index 99509071aa..1569be6c6f 100644 --- a/.openpublishing.redirection.windows-security.json +++ b/.openpublishing.redirection.windows-security.json @@ -175,6 +175,11 @@ "redirect_url": "/windows/security/identity-protection", "redirect_document_id": false }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-overview.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business", + "redirect_document_id": false + }, { "source_path": "windows/security/hardware-protection/tpm/trusted-platform-module-top-node.md", "redirect_url": "/windows/security/information-protection/tpm/trusted-platform-module-top-node", @@ -650,6 +655,11 @@ "redirect_url": "/troubleshoot/windows-client/windows-security/enforcing-bitlocker-policies-by-using-intune-known-issues", "redirect_document_id": false }, + { + "source_path": "windows/security/identity-protection/windows-credential-theft-mitigation-guide-abstract.md", + "redirect_url": "/windows/security/identity-protection", + "redirect_document_id": false + }, { "source_path": "windows/security/information-protection/bitlocker/ts-bitlocker-network-unlock-issues.md", "redirect_url": "/troubleshoot/windows-client/windows-security/bitlocker-network-unlock-known-issues", diff --git a/windows/security/identity-protection/hello-for-business/hello-why-pin-is-better-than-password.md b/windows/security/identity-protection/hello-for-business/hello-why-pin-is-better-than-password.md index e26cc2316e..f137de379f 100644 --- a/windows/security/identity-protection/hello-for-business/hello-why-pin-is-better-than-password.md +++ b/windows/security/identity-protection/hello-for-business/hello-why-pin-is-better-than-password.md @@ -29,7 +29,7 @@ When the PIN is created, it establishes a trusted relationship with the identity Even though local passwords are local to the device, they're less secure than a PIN, as described in the next section. >[!NOTE] ->For details on how Hello uses asymmetric key pairs for authentication, see [Windows Hello for Business](hello-overview.md#benefits-of-windows-hello). +>For details on how Hello uses asymmetric key pairs for authentication, see [Windows Hello for Business](index.md#benefits-of-windows-hello). ## PIN is backed by hardware diff --git a/windows/security/identity-protection/hello-for-business/webauthn-apis.md b/windows/security/identity-protection/hello-for-business/webauthn-apis.md index f2aa96a5ea..7646115753 100644 --- a/windows/security/identity-protection/hello-for-business/webauthn-apis.md +++ b/windows/security/identity-protection/hello-for-business/webauthn-apis.md @@ -1,7 +1,7 @@ --- title: WebAuthn APIs description: Learn how to use WebAuthn APIs to enable passwordless authentication for your sites and apps. -ms.date: 03/09/2023 +ms.date: 07/27/2023 ms.topic: article --- # WebAuthn APIs for passwordless authentication on Windows @@ -14,7 +14,7 @@ Starting in **Windows 11, version 22H2**, WebAuthn APIs support ECC algorithms. ## What does this mean? -By using WebAuthn APIs, developer partners and the developer community can use [Windows Hello](./index.yml) or [FIDO2 Security Keys](/azure/active-directory/authentication/howto-authentication-passwordless-security-key) to implement passwordless multi-factor authentication for their applications on Windows devices. +By using WebAuthn APIs, developer partners and the developer community can use [Windows Hello](./index.md) or [FIDO2 Security Keys](/azure/active-directory/authentication/howto-authentication-passwordless-security-key) to implement passwordless multi-factor authentication for their applications on Windows devices. Users of these apps or sites can use any browser that supports WebAuthn APIs for passwordless authentication. Users will have a familiar and consistent experience on Windows, no matter which browser they use. diff --git a/windows/security/index.yml b/windows/security/index.yml index 8214522e4e..711ec3f94b 100644 --- a/windows/security/index.yml +++ b/windows/security/index.yml @@ -104,9 +104,7 @@ landingContent: - linkListType: concept links: - text: Windows Hello for Business - url: identity-protection/hello-for-business/hello-overview.md - - text: Windows Credential Theft Mitigation - url: identity-protection/windows-credential-theft-mitigation-guide-abstract.md + url: identity-protection/hello-for-business/index.md - text: Protect domain credentials url: identity-protection/credential-guard/credential-guard.md - text: Windows Defender Credential Guard diff --git a/windows/security/introduction/index.md b/windows/security/introduction/index.md index 2f9e0c2dab..781c24730c 100644 --- a/windows/security/introduction/index.md +++ b/windows/security/introduction/index.md @@ -25,7 +25,7 @@ A Zero Trust security model gives the right people the right access at the right 1. When verified, give people and devices access to only necessary resources for the necessary amount of time 1. Use continuous analytics to drive threat detection and improve defenses -For Windows 11, the Zero Trust principle of *verify explicitly* applies to risks introduced by both devices and people. Windows 11 provides *chip-to-cloud security*, enabling IT administrators to implement strong authorization and authentication processes with features like [Windows Hello for Business](../identity-protection/hello-for-business/hello-overview.md). IT administrators also gain attestation and measurements for determining if a device meets requirements and can be trusted. Windows 11 works out-of-the-box with Microsoft Intune and Azure Active Directory, which enable timely and seamless access decisions. Furthermore, IT administrators can easily customize Windows to meet specific user and policy requirements for access, privacy, compliance, and more. +For Windows 11, the Zero Trust principle of *verify explicitly* applies to risks introduced by both devices and people. Windows 11 provides *chip-to-cloud security*, enabling IT administrators to implement strong authorization and authentication processes with features like [Windows Hello for Business](../identity-protection/hello-for-business/index.md). IT administrators also gain attestation and measurements for determining if a device meets requirements and can be trusted. Windows 11 works out-of-the-box with Microsoft Intune and Azure Active Directory, which enable timely and seamless access decisions. Furthermore, IT administrators can easily customize Windows to meet specific user and policy requirements for access, privacy, compliance, and more. ### Security, by default @@ -45,7 +45,7 @@ In Windows 11, [Microsoft Defender Application Guard](/windows-hardware/design/d ### Secured identities -Passwords have been an important part of digital security for a long time, and they're also a top target for cybercriminals. Windows 11 provides powerful protection against credential theft with chip-level hardware security. Credentials are protected by layers of hardware and software security such as [TPM 2.0](../information-protection/tpm/trusted-platform-module-overview.md), [VBS](/windows-hardware/design/device-experiences/oem-vbs), and/or [Windows Defender Credential Guard](../identity-protection/credential-guard/credential-guard.md), making it harder for attackers to steal credentials from a device. With [Windows Hello for Business](../identity-protection/hello-for-business/hello-overview.md), users can quickly sign in with face, fingerprint, or PIN for passwordless protection. Windows 11 also supports [FIDO2 security keys](/azure/active-directory/authentication/howto-authentication-passwordless-security-key) for passwordless authentication. +Passwords have been an important part of digital security for a long time, and they're also a top target for cybercriminals. Windows 11 provides powerful protection against credential theft with chip-level hardware security. Credentials are protected by layers of hardware and software security such as [TPM 2.0](../information-protection/tpm/trusted-platform-module-overview.md), [VBS](/windows-hardware/design/device-experiences/oem-vbs), and/or [Windows Defender Credential Guard](../identity-protection/credential-guard/credential-guard.md), making it harder for attackers to steal credentials from a device. With [Windows Hello for Business](../identity-protection/hello-for-business/index.md), users can quickly sign in with face, fingerprint, or PIN for passwordless protection. Windows 11 also supports [FIDO2 security keys](/azure/active-directory/authentication/howto-authentication-passwordless-security-key) for passwordless authentication. ### Connecting to cloud services diff --git a/windows/security/operating-system-security/data-protection/personal-data-encryption/index.md b/windows/security/operating-system-security/data-protection/personal-data-encryption/index.md index 6538f524ec..83e0433698 100644 --- a/windows/security/operating-system-security/data-protection/personal-data-encryption/index.md +++ b/windows/security/operating-system-security/data-protection/personal-data-encryption/index.md @@ -16,7 +16,7 @@ ms.date: 03/13/2023 ### Required - [Azure AD joined device](/azure/active-directory/devices/concept-azure-ad-join) -- [Windows Hello for Business Overview](../../../identity-protection/hello-for-business/hello-overview.md) +- [Windows Hello for Business Overview](../../../identity-protection/hello-for-business/index.md) - Windows 11, version 22H2 and later Enterprise and Education editions ### Not supported with PDE diff --git a/windows/security/threat-protection/security-policy-settings/interactive-logon-require-smart-card.md b/windows/security/threat-protection/security-policy-settings/interactive-logon-require-smart-card.md index c4c432757d..8d49c17278 100644 --- a/windows/security/threat-protection/security-policy-settings/interactive-logon-require-smart-card.md +++ b/windows/security/threat-protection/security-policy-settings/interactive-logon-require-smart-card.md @@ -38,7 +38,7 @@ Requiring users to use long, complex passwords for authentication enhances netwo ### Best practices -- Set **Interactive logon: Require Windows Hello for Business or smart card** to Enabled. All users will have to use smart cards to sign in to the network, or a Windows Hello for Business method. This requirement means that the organization must have a reliable public key infrastructure (PKI) in place, and provide smart cards and smart card readers for all users. For more information about password-less authentication, see [Windows Hello for Business overview](../../identity-protection/hello-for-business/hello-overview.md). +- Set **Interactive logon: Require Windows Hello for Business or smart card** to Enabled. All users will have to use smart cards to sign in to the network, or a Windows Hello for Business method. This requirement means that the organization must have a reliable public key infrastructure (PKI) in place, and provide smart cards and smart card readers for all users. For more information about password-less authentication, see [Windows Hello for Business overview](../../identity-protection/hello-for-business/index.md). ### Location @@ -92,4 +92,4 @@ All users of a device with this setting enabled must use smart cards or a Window ## Related articles - [Security Options](security-options.md) -- [Windows Hello for Business overview](../../identity-protection/hello-for-business/hello-overview.md) +- [Windows Hello for Business overview](../../identity-protection/hello-for-business/index.md)