From 342bc7a5e9f888010a2d165670d533739d461073 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Wed, 27 Dec 2023 09:31:49 -0500 Subject: [PATCH] Update deployment guide for Windows Hello for Business --- .../hello-for-business/deploy/cloud.md | 1 - .../deploy/hybrid-cert-trust.md | 1 - .../deploy/hybrid-cloud-kerberos-trust.md | 13 -- .../deploy/hybrid-key-trust.md | 5 - .../hello-for-business/deploy/index.md | 115 ++++++++++++++---- .../hello-for-business/deploy/toc.yml | 2 +- 6 files changed, 90 insertions(+), 47 deletions(-) diff --git a/windows/security/identity-protection/hello-for-business/deploy/cloud.md b/windows/security/identity-protection/hello-for-business/deploy/cloud.md index e576701f02..18d4cc72dc 100644 --- a/windows/security/identity-protection/hello-for-business/deploy/cloud.md +++ b/windows/security/identity-protection/hello-for-business/deploy/cloud.md @@ -24,7 +24,6 @@ If you want to disable the automatic Windows Hello for Business enrollment promp > > - Authentication to Microsoft Entra ID > - Microsoft Entra multifactor authentication -> - Device management solution (Intune or supported third-party MDM), optional > - Microsoft Entra ID P1 or P2 subscription - optional, needed for automatic MDM enrollment when the device joins Microsoft Entra ID Cloud-only deployments use Microsoft Entra multifactor authentication (MFA) during Windows Hello for Business enrollment, and there's no additional MFA configuration needed. If you aren't already registered in MFA, you'll be guided through the MFA registration as part of the Windows Hello for Business enrollment process. diff --git a/windows/security/identity-protection/hello-for-business/deploy/hybrid-cert-trust.md b/windows/security/identity-protection/hello-for-business/deploy/hybrid-cert-trust.md index 7f96eeb160..8133e7a96d 100644 --- a/windows/security/identity-protection/hello-for-business/deploy/hybrid-cert-trust.md +++ b/windows/security/identity-protection/hello-for-business/deploy/hybrid-cert-trust.md @@ -24,7 +24,6 @@ This deployment guide describes how to deploy Windows Hello for Business with a > - Device registration > - Public Key Infrastructure > - Multifactor authentication -> - Device management ### Directories and directory synchronization diff --git a/windows/security/identity-protection/hello-for-business/deploy/hybrid-cloud-kerberos-trust.md b/windows/security/identity-protection/hello-for-business/deploy/hybrid-cloud-kerberos-trust.md index 07da3537ae..7e85bc9527 100644 --- a/windows/security/identity-protection/hello-for-business/deploy/hybrid-cloud-kerberos-trust.md +++ b/windows/security/identity-protection/hello-for-business/deploy/hybrid-cloud-kerberos-trust.md @@ -47,16 +47,6 @@ For more information about how Microsoft Entra Kerberos works with Windows Hello > [!IMPORTANT] > When implementing the cloud Kerberos trust deployment model, you *must* ensure that you have an adequate number of *read-write domain controllers* in each Active Directory site where users will be authenticating with Windows Hello for Business. For more information, see [Capacity planning for Active Directory][SERV-1]. -## Prerequisites - -| Requirement | Notes | -| --- | --- | -| Multifactor authentication | This requirement can be met using [Microsoft Entra multifactor authentication](/azure/active-directory/authentication/howto-mfa-getstarted), multifactor authentication provided through AD FS, or a comparable solution. | -| Windows 10, version 21H2 or Windows 11 and later | If you're using Windows 10 21H2, KB5010415 must be installed. If you're using Windows 11 21H2, KB5010414 must be installed. There's no Windows version support difference between Microsoft Entra joined and Microsoft Entra hybrid joined devices. | -| Windows Server 2016 or later Domain Controllers | If you're using Windows Server 2016, [KB3534307][SUP-1] must be installed. If you're using Server 2019, [KB4534321][SUP-2] must be installed. | -| Microsoft Entra Kerberos PowerShell module | This module is used for enabling and managing Microsoft Entra Kerberos. It's available through the [PowerShell Gallery](https://www.powershellgallery.com/packages/AzureADHybridAuthenticationManagement).| -| Device management | Windows Hello for Business cloud Kerberos trust can be managed with group policy or through mobile device management (MDM) policy. This feature is disabled by default and must be enabled using policy. | - ### Unsupported scenarios The following scenarios aren't supported using Windows Hello for Business cloud Kerberos trust: @@ -89,6 +79,3 @@ Once the prerequisites are met, deploying Windows Hello for Business with a clou [AZ-1]: /azure/active-directory/authentication/howto-authentication-passwordless-security-key-on-premises [SERV-1]: /windows-server/administration/performance-tuning/role/active-directory-server/capacity-planning-for-active-directory-domain-services - -[SUP-1]: https://support.microsoft.com/topic/january-23-2020-kb4534307-os-build-14393-3474-b181594e-2c6a-14ea-e75b-678efea9d27e -[SUP-2]: https://support.microsoft.com/topic/january-23-2020-kb4534321-os-build-17763-1012-023e84c3-f9aa-3b55-8aff-d512911c459f diff --git a/windows/security/identity-protection/hello-for-business/deploy/hybrid-key-trust.md b/windows/security/identity-protection/hello-for-business/deploy/hybrid-key-trust.md index 5d4b28e95f..56e95c2266 100644 --- a/windows/security/identity-protection/hello-for-business/deploy/hybrid-key-trust.md +++ b/windows/security/identity-protection/hello-for-business/deploy/hybrid-key-trust.md @@ -19,12 +19,7 @@ This deployment guide describes how to deploy Windows Hello for Business with a > [!div class="checklist"] >The following prerequisites must be met for a hybrid key trust deployment: > -> - Directories and directory synchronization -> - Authentication to Microsoft Entra ID -> - Device registration > - Public Key Infrastructure -> - Multifactor authentication -> - Device management ### Directories and directory synchronization diff --git a/windows/security/identity-protection/hello-for-business/deploy/index.md b/windows/security/identity-protection/hello-for-business/deploy/index.md index 0621f5a547..0b84edcd00 100644 --- a/windows/security/identity-protection/hello-for-business/deploy/index.md +++ b/windows/security/identity-protection/hello-for-business/deploy/index.md @@ -5,6 +5,24 @@ ms.date: 12/18/2023 ms.topic: overview --- + + # Plan a Windows Hello for Business Deployment This planning guide helps you understand the different topologies, architectures, and components that encompass a Windows Hello for Business infrastructure. @@ -22,9 +40,9 @@ This guide removes the appearance of complexity by helping you make decisions on ### How to Proceed -Read this document and record your decisions. When finished, you should have all the necessary information for your Windows Hello for Business deployment. +Read this document and record your decisions. When finished, you should have all the necessary information to determine the next steps for your Windows Hello for Business deployment. -There are six major categories you need to consider for a Windows Hello for Business deployment: +There are # major categories to consider when planning a Windows Hello for Business deployment: - Deployment Options - Client @@ -66,7 +84,7 @@ There are three trust types from which you can choose: | :black_square_button: | **Key trust**| Users authenticate to the on-premises Active Directory using a device-bound key (hardware or sofware) created during the Windows Hello provisioning experience. It requires to distribute certificates to domain controllers. | | :black_square_button: | **Certificate trust**| The certificate trust type issues authentication certificates to users. Users authenticate using a certificate requested using a device-bound key (hardware or sofware) created during the Windows Hello provisioning experience. | -*Key trust* and *certificate trust* use certificate authentication-based Kerberos for requesting kerberos ticket-granting-tickets (TGTs) for on-premises authentication. This type of authentication requires a PKI for DC certificates, and requires end-user certificates for certificate trust. +*Key trust* and *certificate trust* use certificate authentication-based Kerberos when requesting kerberos ticket-granting-tickets (TGTs) for on-premises authentication. This type of authentication requires a PKI for DC certificates, and requires end-user certificates for certificate trust. The goal of Windows Hello for Business cloud Kerberos trust is to provide a simple deployment experience: @@ -83,19 +101,37 @@ All devices included in the Windows Hello for Business deployment must go throug - For cloud-only and hybrid deployment, the identity provider is Microsoft Entra ID - For on-premises deployments, the identity provider is the on-premises server running the Active Directory Federation Services (AD FS) role +| :ballot_box_with_check:| Deployment model | Device registration options | +|-|-|-|-| +| :ballot_box_without_check:| Cloud-only | Microsoft Entra joined
Microsoft Entra registered | +| :ballot_box_without_check:|Hybrid| Microsoft Entra hybrid joined
Microsoft Entra joined
Microsoft Entra registered | +| :ballot_box_without_check:|On-premises | AD FS | + ### Key registration -The built-in Windows Hello for Business provisioning experience creates a device-bound asymmetric key pair as their user's credentials. The private key is protected by the device's security modules. The credential is a *user key*, not a *device key*. The provisioning experience registers the user's public key with the identity provider: +The built-in Windows Hello for Business provisioning experience creates a device-bound asymmetric key pair as the user's credentials. The private key is protected by the device's security modules. The credential is a *user key*, not a *device key*. The provisioning experience registers the user's public key with the identity provider: - For cloud-only and hybrid deployments, the identity provider is Microsoft Entra ID - For on-premises deployments, the identity provider is the on-premises server running the AD FS role +| :ballot_box_with_check:| Deployment model | Key registration IdP | +|-|-|-|-| +| :ballot_box_without_check:| Cloud-only | Microsoft Entra ID | +| :ballot_box_without_check:|Hybrid| Microsoft Entra ID | +| :ballot_box_without_check:|On-premises | AD FS | + ### Directory synchronization Hybrid and on-premises deployments use directory synchronization, however, each for a different purpose: -- Hybrid deployments use Microsoft Entra Connect to synchronize Active Directory identities or credentials (in key trust model) between itself and Microsoft Entra ID. This synchronization enables SSO to Microsoft Entra ID and its federated components -- On-premises deployments use directory synchronization to import users from Active Directory to the MFA Server, which sends data to the MFA cloud service to perform the verification +- Hybrid deployments use Microsoft Entra Connect to synchronize Active Directory identities (users and devices) or credentials (in key trust model) between itself and Microsoft Entra ID. This synchronization enables SSO to Microsoft Entra ID and its federated components +- On-premises deployments use directory synchronization to import users from Active Directory to the Azure MFA server, which sends data to the MFA cloud service to perform the verification + +| :ballot_box_with_check:| Deployment model | Directory sync options | +|-|-|-|-| +| :ballot_box_without_check:| Cloud-only | n/a | +| :ballot_box_without_check:|Hybrid| Microsoft Entra Connect| +| :ballot_box_without_check:|On-premises | Azure MFA server | ### Multifactor authentication @@ -107,24 +143,38 @@ The goal of Windows Hello for Business is to move organizations away from passwo > [!IMPORTANT] > As of July 1, 2019, Microsoft doesn't offer MFA Server for new deployments. New deployments that require multifactor authentication should use cloud-based Microsoft Entra multifactor authentication. Existing deployment where the MFA Server was activated prior to July 1, 2019 can download the latest version, future updates, and generate activation credentials. See [Getting started with the Azure Multi-Factor Authentication Server][ENTRA-2] for more details. +| :ballot_box_with_check:| Deployment model | MFA options | +|-|-|-|-| +| :ballot_box_without_check:| Cloud-only | Microsoft Entra MFA <> Third-party MFA via Microsoft Entra ID custom controls or federation| +| :ballot_box_without_check:|Hybrid| Microsoft Entra MFA <> Third-party MFA via Microsoft Entra ID custom controls or federation| +| :ballot_box_without_check:|On-premises | AD FS MFA adapter | + ### Device configuration -Windows Hello for Business provides organizations with a rich set of granular policy settings with which they can use to configure their devices. There are two main options to configure Windows Hello for Business: configuration service provider (CSP) and group policy (GPO): +Windows Hello for Business provides organizations with a rich set of granular policy settings with which they can use to configure their devices. There are two main options to configure Windows Hello for Business: configuration service provider (CSP) and group policy (GPO). - The CSP option is ideal for devices that are managed through a Mobile Device Management (MDM) solution, like Microsoft Intune - GPO can be used to configure domain joined devices and where devices aren't managed via MDM +| :ballot_box_with_check:| Deployment model | Device configuration options | +|-|-|-|-| +| :ballot_box_without_check:| Cloud-only | CSP (MDM) or local GPO | +| :ballot_box_without_check:|Hybrid| CSP (MDM) or Active Directory GPOs | +| :ballot_box_without_check:|On-premises | Active Directory GPOs | + ### Public Key Infrastructure (PKI) -While cloud Kerberos trust is the only deployment option that doesn't require the deployment of any certificates, the other models depend on an enterprise PKI as a trust anchor for authentication: +While cloud Kerberos trust is the only hybrid deployment option that doesn't require the deployment of any certificates, the other hybrid and on-premises models depend on an enterprise PKI as a trust anchor for authentication: - Domain controllers for hybrid and on-premises deployments need a certificate for Windows devices to trust the domain controller as legitimate - Deployments using the certificate trust type require an enterprise PKI and a certificate registration authority (CRA) to issue authentication certificates to users. AD FS is used as a CRA - Hybrid deployments might need to issue VPN certificates to users to enable connectivity on-premises resources -### Cloud services - -Some deployment combinations require an Azure account, and some require Microsoft Entra ID for user identities. These cloud requirements may only need an Azure account while other features need a Microsoft Entra ID P1 or P2 subscription. +| :ballot_box_with_check:| Deployment model | PKI | +|-|-|-|-| +| :ballot_box_without_check:| Cloud-only | not required | +| :ballot_box_without_check:|Hybrid| Cloud Kerberos trust: not required
Certificate trust and key trust: required | +| :ballot_box_without_check:|On-premises | required | ### Licensing requirements for cloud services @@ -132,32 +182,40 @@ Here are some considerations regarding licensing requirements for cloud services - Windows Hello for Business doesn't require a Microsoft Entra ID P1 or P2 subscription. However, some dependencies, such as [MDM automatic enrollment](/mem/intune/enrollment/quickstart-setup-auto-enrollment) and [Conditional Access](/azure/active-directory/conditional-access/overview) do - Devices managed via MDM don't require a Microsoft Entra ID P1 or P2 subscription. By forgoing the subscription, users must manually enroll devices in the MDM solution, such as Microsoft Intune or a supported third-party MDM -- You can deploy Windows Hello for Business using the Microsoft Entra ID Free tier. All Microsoft Entra ID Free accounts can use Microsoft Entra multifactor authentication through the use of security defaults +- You can deploy Windows Hello for Business using the Microsoft Entra ID Free tier. All Microsoft Entra ID Free accounts can use Microsoft Entra multifactor authentication for the Windows passwordless features - Some Microsoft Entra multifactor authentication features require a license. For more details, see [Features and licenses for Microsoft Entra multifactor authentication](/azure/active-directory/authentication/concept-mfa-licensing). - Enrolling a certificate using the AD FS registration authority requires devices to authenticate to the AD FS server, which requires device write-back, a Microsoft Entra ID P1 or P2 feature -## Planning a Deployment +| :ballot_box_with_check:| Deployment model | Cloud services licenses (minimum) | +|-|-|-|-| +| :ballot_box_without_check:| Cloud-only | not required | +| :ballot_box_without_check:|Hybrid| - **Cloud Kerberos trust**: not required
- **Key trust**: not required
- **Certificate trust**: Microsoft Entra ID P1| +| :ballot_box_without_check:|On-premises | Azure MFA | -Planning your Windows Hello for Business deployment begins with choosing a deployment type. Like all distributed systems, Windows Hello for Business depends on multiple components within your organization's infrastructure. +### Windows and Windows Server requirements -### Deployment Model +All supported Windows 10 and Windows 11 versions can be used with Windows Hello for Business. However, cloud Kerberos trust requires minimum versions: -Choose the deployment model based on the resources your users access. Use the following guidance to make your decision. +| :ballot_box_with_check:| Deployment model | Windows version | +|-|-|-|-| +| :ballot_box_without_check:| Cloud-only | All supported versions | +| :ballot_box_without_check:|Hybrid| - **Cloud Kerberos trust**: Windows 10 21H2, with KB5010415 and later; Windows 11 21H2, with KB5010414 and later
- **Key trust**: All supported versions
- **Certificate trust**: All supported versions| +| :ballot_box_without_check:|On-premises | All supported versions | -- If your organization doesn't have on-premises resources, use **Cloud Only** -- If your organization syncronizes users to Microsoft Entra ID to access cloud services, select **Hybrid** -- If your organization doesn't have cloud resources, select **On-Premises** +All supported Windows Server versions can be used with Windows Hello for Business as Domain Controller. However, cloud Kerberos trust requires minimum versions: -### Trust type - -Choose a trust type that is best suited for your organizations. The trust type determines whether you issue authentication certificates to your users. One trust model isn't more secure than the other. - -The deployment of certificates to users and Domain Controllers requires more configuration and infrastructure, which could also be a factor to consider in your decision. Additional infrastructure needed for certificate-trust deployments includes a certificate registration authority. In a federated environment, you need to activate the Device Writeback option in Microsoft Entra Connect. +| :ballot_box_with_check:| Deployment model | Domain Controller OS version | +|-|-|-|-| +| :ballot_box_without_check:| Cloud-only | n/a | +| :ballot_box_without_check:|Hybrid| - **Cloud Kerberos trust**: Windows Server 2016, [KB3534307][SUP-1]; Windows Server 2019, [KB4534321][SUP-2], Windows Server 2022
- **Key trust**: All supported versions
- **Certificate trust**: All supported versions| +| :ballot_box_without_check:|On-premises | All supported versions | ## Next steps +Now that you've read about the different deployment options and requirements, you can choose the implementation that best suits your organization. + > [!div class="op_multi_selector" title1="Deployment type:" title2="Trust type:"] -> Select your deployment options to read about the deployment process: +> To learn more about the deployment process, chose a deployment model and trust type from the following drop-down lists: > > - [(cloud-only|Microsoft Entra ID)](cloud.md) > - [(hybrid | cloud Kerberos trust)](hybrid-cloud-kerberos-trust.md) @@ -166,6 +224,7 @@ The deployment of certificates to users and Domain Controllers requires more con > - [(on-premises | key trust)](on-premises-key-trust.md) > - [(on-premises | certificate trust)](on-premises-cert-trust.md) + [ENTRA-1]: /entra/identity/authentication/concept-mfa-howitworks [SERV-1]: /windows-server/identity/ad-fs/operations/configure-additional-authentication-methods-for-ad-fs#microsoft-and-third-party-additional-authentication-methods -[ENTRA-2]: /entra/identity/authentication/howto-mfaserver-deploy \ No newline at end of file +[ENTRA-2]: /entra/identity/authentication/howto-mfaserver-deploy + +[SUP-1]: https://support.microsoft.com/topic/january-23-2020-kb4534307-os-build-14393-3474-b181594e-2c6a-14ea-e75b-678efea9d27e +[SUP-2]: https://support.microsoft.com/topic/january-23-2020-kb4534321-os-build-17763-1012-023e84c3-f9aa-3b55-8aff-d512911c459f diff --git a/windows/security/identity-protection/hello-for-business/deploy/toc.yml b/windows/security/identity-protection/hello-for-business/deploy/toc.yml index 1782535292..5b8270f760 100644 --- a/windows/security/identity-protection/hello-for-business/deploy/toc.yml +++ b/windows/security/identity-protection/hello-for-business/deploy/toc.yml @@ -1,5 +1,5 @@ items: -- name: Cloud-only deployments +- name: Cloud-only deployment href: cloud.md - name: Hybrid deployments items: