Merge pull request #8180 from MaratMussabekov/patch-197

updated the steps for WHfB

windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-base.md

@@ -301,35 +301,32 @@ A **Trusted Certificate** device configuration profile is how you deploy trusted
 
 Sign-in a workstation with access equivalent to a _domain user_.
 
-1. Sign-in to the [Azure Portal](https://portal.azure.com/).
-2. Select **All Services**.  Type **Intune** to filter the list of services.  Click **Microsoft Intune**.
-3. Click **device enrollment**.
-4. Click **Windows enrollment**
-5. Under **Windows enrollment**, click **Windows Hello for Business**.
-   ![Create Intune Windows Hello for Business Policy](images/aadj/IntuneWHFBPolicy-00.png)
-6. Under **Priority**, click **Default**. 
-7. Under **All users and all devices**, click **Settings**.
-8. Select **Enabled** from the **Configure Windows Hello for Business** list.
-9. Select **Required** next to **Use a Trusted Platform Module (TPM)**.  By default, Windows Hello for Business prefers TPM 2.0 or falls backs to software. Choosing **Required** forces Windows Hello for Business to only use TPM 2.0 or TPM 1.2 and does not allow fall back to software based keys.
-10. Type the desired **Minimum PIN length** and **Maximum PIN length**.
+1. Sign in to the [Microsoft Endpoint Manager admin center](https://endpoint.microsoft.com/).
+2. Select **Devices**.
+3. Choose **Enroll devices**.
+4. Select **Windows enrollment**.
+5. Under **Windows enrollment**, select **Windows Hello for Business**.
+   ![Create Windows Hello for Business Policy](images/aadj/MEM.png)
+6. Select **Enabled** from the **Configure Windows Hello for Business** list.
+7. Select **Required** next to **Use a Trusted Platform Module (TPM)**. By default, Windows Hello for Business prefers TPM 2.0 or falls backs to software. Choosing **Required** forces Windows Hello for Business to only use TPM 2.0 or TPM 1.2 and does not allow fall back to software-based keys.
+8. Enter the desired **Minimum PIN length** and **Maximum PIN length**.
     > [!IMPORTANT]
-    > The default minimum PIN length for Windows Hello for Business on Windows 10 is 6.  Microsoft Intune defaults the minimum PIN length to 4, which reduces the security of the user's PIN.  If you do not have a desired PIN length, set the minimum PIN length to 6.
+    > The default minimum PIN length for Windows Hello for Business on Windows 10 is six.  Microsoft Intune defaults the minimum PIN length to four, which reduces the security of the user's PIN.  If you do not have a desired PIN length, set the minimum PIN length to six.
 
-![Intune Windows Hello for Business policy settings](images/aadj/IntuneWHFBPolicy-01.png)
-
-11. Select the appropriate configuration for the following settings.
+9. Select the appropriate configuration for the following settings:
     * **Lowercase letters in PIN**
     * **Uppercase letters in PIN**
     * **Special characters in PIN**
     * **PIN expiration (days)**
     * **Remember PIN history**
+    
     > [!NOTE]
     > The Windows Hello for Business PIN is not a symmetric key (a password).  A copy of the current PIN is not stored locally or on a server like in the case of passwords.  Making the PIN as complex and changed frequently as a password increases the likelihood of forgotten PINs.  Additionally, enabling PIN history is the only scenario that requires Windows 10 to store older PIN combinations (protected to the current PIN). Windows Hello for Business combined with a TPM provides anti-hammering functionality that prevents brute force attacks of the user's PIN.  If you are concerned with user-to-user shoulder surfacing, rather that forcing complex PIN that change frequently, consider using the [Multifactor Unlock](feature-multifactor-unlock.md) feature.
 
-12. Select **Yes** next to **Allow biometric authentication** if you want to allow users to use biometrics (fingerprint and/or facial recognition) to unlock the device.  To further secure the use of biometrics, select **Yes** to **Use enhanced anti-spoofing, when available**.
-13. Select **No** to **Allow phone sign-in**.  This feature has been deprecated.
-14. Click **Save**
-15. Sign-out of the Azure portal.
+10. Select **Yes** next to **Allow biometric authentication** if you want to allow users to use biometrics (fingerprint and/or facial recognition) to unlock the device. To further secure the use of biometrics, select **Yes** to **Use enhanced anti-spoofing, when available**.
+11. Select **No** to **Allow phone sign-in**. This feature has been deprecated.
+12. Choose **Save**.
+13. Sign out of the Microsoft Endpoint Manager admin center.
 
 > [!IMPORTANT]
 > For more details about the actual experience after everything has been configured, please see [Windows Hello for Business and Authentication](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-how-it-works-authentication).