deepblue/windows-itpro-docs
1
0
Fork 0
mirror of https://github.com/MicrosoftDocs/windows-itpro-docs.git synced 2025-05-28 05:07:23 +00:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity

Updates

Browse Source
This commit is contained in:
MokumaPM 2024-10-23 12:40:17 -07:00 committed by GitHub
parent a0b9c033d9
commit 283d4e1ef2
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
windows/security/book/identity-protection-passwordless-sign-in.md
View File

@ -80,7 +80,9 @@ Provisioning methods include:
Windows Hello for Business replaces the username and password by combining a security key or certificate with a PIN or biometric data and then mapping the credentials to a user account during setup. There are multiple ways to deploy Windows Hello for Business depending on an organization's needs. Organizations that rely on certificates typically use on-premises public key infrastructure (PKI) to support authentication through Certificate Trust. Organizations using key trust deployment require root-of-trust provided by certificates on domain controllers.
Organizations with hybrid scenarios can eliminate the need for on-premises domain controllers and simplify passwordless adoption by using Windows Hello for Business cloud Kerberos trust. This solution uses security keys and replaces on-premises domain controllers with a cloud-based root-of-trust. As a result, organizations can take advantage of Windows Hello for Business and deploy security keys with minimal extra setup or infrastructure.
Hybrid cloud Kerberos trust is the simplest deployment model for the organizations with hybrid scenarios, as it reduces any additional deployment requirements. It uses the same infrastructure required for FIDO2 security sign-in. This is for enterprises who do not want to issue end-user certificates and have deployed 2016 domain controllers in each site to support authentication. It is simpler to deploy than key trust and does not require Active Directory Certificate Services. As a result, organization can take advantage of Windows Hello for Business and deploy passwordless credentials with minimal additional setup or infrastructure.
This is the recommended deployment model when compared to the key trust. It is also preferred deployment model if you do not need to support certificate authentication scenarios.
[!INCLUDE [learn-more](includes/learn-more.md)]