fixing ms.author

This commit is contained in:
Matthew Palko 2022-02-22 10:21:11 -08:00
parent 989fe91889
commit 93e4791fdb
68 changed files with 171 additions and 151 deletions

View File

@ -7,7 +7,7 @@ ms.sitesec: library
ms.pagetype: security, mobile ms.pagetype: security, mobile
audience: ITPro audience: ITPro
author: GitPrakhar13 author: GitPrakhar13
ms.author: GitPrakhar13 ms.author: prsriva
manager: dansimp manager: dansimp
ms.collection: M365-identity-device-management ms.collection: M365-identity-device-management
ms.topic: article ms.topic: article

View File

@ -8,7 +8,7 @@ ms.sitesec: library
ms.pagetype: security, mobile ms.pagetype: security, mobile
audience: ITPro audience: ITPro
author: GitPrakhar13 author: GitPrakhar13
ms.author: GitPrakhar13 ms.author: prsriva
manager: dansimp manager: dansimp
ms.collection: M365-identity-device-management ms.collection: M365-identity-device-management
ms.topic: article ms.topic: article

View File

@ -8,7 +8,7 @@ ms.sitesec: library
ms.pagetype: security, mobile ms.pagetype: security, mobile
audience: ITPro audience: ITPro
author: GitPrakhar13 author: GitPrakhar13
ms.author: GitPrakhar13 ms.author: prsriva
manager: dansimp manager: dansimp
ms.collection: M365-identity-device-management ms.collection: M365-identity-device-management
ms.topic: article ms.topic: article

View File

@ -8,7 +8,7 @@ ms.sitesec: library
ms.pagetype: security, mobile ms.pagetype: security, mobile
audience: ITPro audience: ITPro
author: GitPrakhar13 author: GitPrakhar13
ms.author: GitPrakhar13 ms.author: prsriva
manager: dansimp manager: dansimp
ms.collection: M365-identity-device-management ms.collection: M365-identity-device-management
ms.topic: article ms.topic: article

View File

@ -9,7 +9,7 @@ ms.sitesec: library
ms.pagetype: security ms.pagetype: security
audience: ITPro audience: ITPro
author: GitPrakhar13 author: GitPrakhar13
ms.author: GitPrakhar13 ms.author: prsriva
manager: dansimp manager: dansimp
ms.collection: M365-identity-device-management ms.collection: M365-identity-device-management
ms.topic: article ms.topic: article

View File

@ -9,7 +9,7 @@ ms.sitesec: library
ms.pagetype: security ms.pagetype: security
audience: ITPro audience: ITPro
author: GitPrakhar13 author: GitPrakhar13
ms.author: GitPrakhar13 ms.author: prsriva
manager: dansimp manager: dansimp
ms.collection: ms.collection:
- M365-identity-device-management - M365-identity-device-management

View File

@ -8,7 +8,7 @@ ms.sitesec: library
ms.pagetype: security, mobile ms.pagetype: security, mobile
audience: ITPro audience: ITPro
author: GitPrakhar13 author: GitPrakhar13
ms.author: GitPrakhar13 ms.author: prsriva
manager: dansimp manager: dansimp
ms.collection: M365-identity-device-management ms.collection: M365-identity-device-management
ms.topic: article ms.topic: article

View File

@ -8,7 +8,7 @@ ms.sitesec: library
ms.pagetype: security, mobile ms.pagetype: security, mobile
audience: ITPro audience: ITPro
author: GitPrakhar13 author: GitPrakhar13
ms.author: GitPrakhar13 ms.author: prsriva
manager: dansimp manager: dansimp
ms.collection: M365-identity-device-management ms.collection: M365-identity-device-management
ms.topic: article ms.topic: article

View File

@ -8,7 +8,7 @@ ms.sitesec: library
ms.pagetype: security, mobile ms.pagetype: security, mobile
audience: ITPro audience: ITPro
author: GitPrakhar13 author: GitPrakhar13
ms.author: GitPrakhar13 ms.author: prsriva
manager: dansimp manager: dansimp
ms.collection: M365-identity-device-management ms.collection: M365-identity-device-management
ms.topic: article ms.topic: article

View File

@ -8,7 +8,7 @@ ms.sitesec: library
ms.pagetype: security, mobile ms.pagetype: security, mobile
audience: ITPro audience: ITPro
author: GitPrakhar13 author: GitPrakhar13
ms.author: GitPrakhar13 ms.author: prsriva
manager: dansimp manager: dansimp
ms.collection: M365-identity-device-management ms.collection: M365-identity-device-management
ms.topic: article ms.topic: article

View File

@ -8,7 +8,7 @@ ms.sitesec: library
ms.pagetype: security, mobile ms.pagetype: security, mobile
audience: ITPro audience: ITPro
author: GitPrakhar13 author: GitPrakhar13
ms.author: GitPrakhar13 ms.author: prsriva
manager: dansimp manager: dansimp
ms.collection: M365-identity-device-management ms.collection: M365-identity-device-management
ms.topic: article ms.topic: article
@ -19,6 +19,7 @@ ms.reviewer:
# On Premises Certificate Trust Deployment # On Premises Certificate Trust Deployment
**Applies to** **Applies to**
- Windows 10, version 1703 or later - Windows 10, version 1703 or later
- Windows 11 - Windows 11
- On-premises deployment - On-premises deployment
@ -28,6 +29,7 @@ ms.reviewer:
Windows Hello for Business replaces username and password sign-in to Windows with strong user authentication based on asymmetric key pair. The following deployment guide provides the information needed to successfully deploy Windows Hello for Business in an existing environment. Windows Hello for Business replaces username and password sign-in to Windows with strong user authentication based on asymmetric key pair. The following deployment guide provides the information needed to successfully deploy Windows Hello for Business in an existing environment.
Below, you can find all the information you will need to deploy Windows Hello for Business in a Certificate Trust Model in your on-premises environment: Below, you can find all the information you will need to deploy Windows Hello for Business in a Certificate Trust Model in your on-premises environment:
1. [Validate Active Directory prerequisites](hello-cert-trust-validate-ad-prereq.md) 1. [Validate Active Directory prerequisites](hello-cert-trust-validate-ad-prereq.md)
2. [Validate and Configure Public Key Infrastructure](hello-cert-trust-validate-pki.md) 2. [Validate and Configure Public Key Infrastructure](hello-cert-trust-validate-pki.md)
3. [Prepare and Deploy Windows Server 2016 Active Directory Federation Services](hello-cert-trust-adfs.md) 3. [Prepare and Deploy Windows Server 2016 Active Directory Federation Services](hello-cert-trust-adfs.md)

View File

@ -8,7 +8,7 @@ ms.sitesec: library
ms.pagetype: security, mobile ms.pagetype: security, mobile
audience: ITPro audience: ITPro
author: GitPrakhar13 author: GitPrakhar13
ms.author: GitPrakhar13 ms.author: prsriva
manager: dansimp manager: dansimp
ms.collection: ms.collection:
- M365-identity-device-management - M365-identity-device-management

View File

@ -9,7 +9,7 @@ ms.sitesec: library
ms.pagetype: security, mobile ms.pagetype: security, mobile
audience: ITPro audience: ITPro
author: GitPrakhar13 author: GitPrakhar13
ms.author: GitPrakhar13 ms.author: prsriva
manager: dansimp manager: dansimp
ms.collection: M365-identity-device-management ms.collection: M365-identity-device-management
ms.topic: article ms.topic: article

View File

@ -8,7 +8,7 @@ ms.sitesec: library
ms.pagetype: security, mobile ms.pagetype: security, mobile
audience: ITPro audience: ITPro
author: GitPrakhar13 author: GitPrakhar13
ms.author: GitPrakhar13 ms.author: prsriva
manager: dansimp manager: dansimp
ms.collection: M365-identity-device-management ms.collection: M365-identity-device-management
ms.topic: article ms.topic: article

View File

@ -8,7 +8,7 @@ ms.sitesec: library
ms.pagetype: security, mobile ms.pagetype: security, mobile
audience: ITPro audience: ITPro
author: GitPrakhar13 author: GitPrakhar13
ms.author: GitPrakhar13 ms.author: prsriva
manager: dansimp manager: dansimp
ms.collection: M365-identity-device-management ms.collection: M365-identity-device-management
ms.topic: article ms.topic: article

View File

@ -9,7 +9,7 @@ ms.sitesec: library
ms.pagetype: security ms.pagetype: security
audience: ITPro audience: ITPro
author: GitPrakhar13 author: GitPrakhar13
ms.author: GitPrakhar13 ms.author: prsriva
manager: dansimp manager: dansimp
ms.collection: ms.collection:
- M365-identity-device-management - M365-identity-device-management

View File

@ -10,7 +10,7 @@ ms.sitesec: library
ms.pagetype: security ms.pagetype: security
audience: ITPro audience: ITPro
author: GitPrakhar13 author: GitPrakhar13
ms.author: GitPrakhar13 ms.author: prsriva
manager: dansimp manager: dansimp
ms.collection: M365-identity-device-management ms.collection: M365-identity-device-management
ms.topic: article ms.topic: article
@ -25,7 +25,6 @@ ms.date: 07/27/2017
- Windows 10 - Windows 10
- Windows 11 - Windows 11
This event is created when Windows Hello for Business is successfully created and registered with Azure Active Directory (Azure AD). Applications or services can trigger actions on this event. For example, a certificate provisioning service can listen to this event and trigger a certificate request. This event is created when Windows Hello for Business is successfully created and registered with Azure Active Directory (Azure AD). Applications or services can trigger actions on this event. For example, a certificate provisioning service can listen to this event and trigger a certificate request.
## Event details ## Event details

View File

@ -9,7 +9,7 @@ metadata:
ms.pagetype: security, mobile ms.pagetype: security, mobile
audience: ITPro audience: ITPro
author: GitPrakhar13 author: GitPrakhar13
ms.author: GitPrakhar13 ms.author: prsriva
manager: dansimp manager: dansimp
ms.collection: ms.collection:
- M365-identity-device-management - M365-identity-device-management

View File

@ -8,7 +8,7 @@ ms.sitesec: library
ms.pagetype: security, mobile ms.pagetype: security, mobile
audience: ITPro audience: ITPro
author: GitPrakhar13 author: GitPrakhar13
ms.author: GitPrakhar13 ms.author: prsriva
manager: dansimp manager: dansimp
ms.collection: M365-identity-device-management ms.collection: M365-identity-device-management
ms.topic: article ms.topic: article
@ -38,11 +38,11 @@ Read [Conditional access in Azure Active Directory](/azure/active-directory/acti
## Related topics ## Related topics
* [Windows Hello for Business](hello-identity-verification.md) - [Windows Hello for Business](hello-identity-verification.md)
* [Manage Windows Hello for Business in your organization](hello-manage-in-organization.md) - [Manage Windows Hello for Business in your organization](hello-manage-in-organization.md)
* [Why a PIN is better than a password](hello-why-pin-is-better-than-password.md) - [Why a PIN is better than a password](hello-why-pin-is-better-than-password.md)
* [Prepare people to use Windows Hello](hello-prepare-people-to-use.md) - [Prepare people to use Windows Hello](hello-prepare-people-to-use.md)
* [Windows Hello and password changes](hello-and-password-changes.md) - [Windows Hello and password changes](hello-and-password-changes.md)
* [Windows Hello errors during PIN creation](hello-errors-during-pin-creation.md) - [Windows Hello errors during PIN creation](hello-errors-during-pin-creation.md)
* [Event ID 300 - Windows Hello successfully created](hello-event-300.md) - [Event ID 300 - Windows Hello successfully created](hello-event-300.md)
* [Windows Hello biometrics in the enterprise](hello-biometrics-in-enterprise.md) - [Windows Hello biometrics in the enterprise](hello-biometrics-in-enterprise.md)

View File

@ -8,7 +8,7 @@ ms.sitesec: library
ms.pagetype: security, mobile ms.pagetype: security, mobile
audience: ITPro audience: ITPro
author: GitPrakhar13 author: GitPrakhar13
ms.author: GitPrakhar13 ms.author: prsriva
manager: dansimp manager: dansimp
ms.collection: M365-identity-device-management ms.collection: M365-identity-device-management
ms.topic: article ms.topic: article

View File

@ -8,7 +8,7 @@ ms.sitesec: library
ms.pagetype: security, mobile ms.pagetype: security, mobile
audience: ITPro audience: ITPro
author: GitPrakhar13 author: GitPrakhar13
ms.author: GitPrakhar13 ms.author: prsriva
manager: dansimp manager: dansimp
ms.collection: ms.collection:
- M365-identity-device-management - M365-identity-device-management

View File

@ -8,7 +8,7 @@ ms.sitesec: library
ms.pagetype: security, mobile ms.pagetype: security, mobile
audience: ITPro audience: ITPro
author: GitPrakhar13 author: GitPrakhar13
ms.author: GitPrakhar13 ms.author: prsriva
manager: dansimp manager: dansimp
ms.collection: M365-identity-device-management ms.collection: M365-identity-device-management
ms.topic: article ms.topic: article

View File

@ -7,7 +7,7 @@ ms.sitesec: library
ms.pagetype: security ms.pagetype: security
audience: ITPro audience: ITPro
author: GitPrakhar13 author: GitPrakhar13
ms.author: GitPrakhar13 ms.author: prsriva
manager: dansimp manager: dansimp
ms.collection: M365-identity-device-management ms.collection: M365-identity-device-management
ms.topic: article ms.topic: article

View File

@ -7,7 +7,7 @@ ms.sitesec: library
ms.pagetype: security ms.pagetype: security
audience: ITPro audience: ITPro
author: GitPrakhar13 author: GitPrakhar13
ms.author: GitPrakhar13 ms.author: prsriva
manager: dansimp manager: dansimp
ms.collection: M365-identity-device-management ms.collection: M365-identity-device-management
ms.topic: article ms.topic: article

View File

@ -7,7 +7,7 @@ ms.sitesec: library
ms.pagetype: security ms.pagetype: security
audience: ITPro audience: ITPro
author: GitPrakhar13 author: GitPrakhar13
ms.author: GitPrakhar13 ms.author: prsriva
manager: dansimp manager: dansimp
ms.collection: M365-identity-device-management ms.collection: M365-identity-device-management
ms.topic: article ms.topic: article
@ -18,6 +18,7 @@ ms.reviewer:
# Technology and Terms # Technology and Terms
**Applies to:** **Applies to:**
- Windows 10 - Windows 10
- Windows 11 - Windows 11

View File

@ -7,7 +7,7 @@ ms.sitesec: library
ms.pagetype: security ms.pagetype: security
audience: ITPro audience: ITPro
author: GitPrakhar13 author: GitPrakhar13
ms.author: GitPrakhar13 ms.author: prsriva
manager: dansimp manager: dansimp
ms.collection: M365-identity-device-management ms.collection: M365-identity-device-management
ms.topic: article ms.topic: article

View File

@ -8,7 +8,7 @@ ms.sitesec: library
ms.pagetype: security, mobile ms.pagetype: security, mobile
audience: ITPro audience: ITPro
author: GitPrakhar13 author: GitPrakhar13
ms.author: GitPrakhar13 ms.author: prsriva
manager: dansimp manager: dansimp
ms.collection: ms.collection:
- M365-identity-device-management - M365-identity-device-management

View File

@ -8,7 +8,7 @@ ms.sitesec: library
ms.pagetype: security, mobile ms.pagetype: security, mobile
audience: ITPro audience: ITPro
author: GitPrakhar13 author: GitPrakhar13
ms.author: GitPrakhar13 ms.author: prsriva
manager: dansimp manager: dansimp
ms.collection: M365-identity-device-management ms.collection: M365-identity-device-management
ms.topic: article ms.topic: article

View File

@ -8,7 +8,7 @@ ms.sitesec: library
ms.pagetype: security, mobile ms.pagetype: security, mobile
audience: ITPro audience: ITPro
author: GitPrakhar13 author: GitPrakhar13
ms.author: GitPrakhar13 ms.author: prsriva
manager: dansimp manager: dansimp
ms.collection: M365-identity-device-management ms.collection: M365-identity-device-management
ms.topic: article ms.topic: article

View File

@ -8,7 +8,7 @@ ms.sitesec: library
ms.pagetype: security, mobile ms.pagetype: security, mobile
audience: ITPro audience: ITPro
author: GitPrakhar13 author: GitPrakhar13
ms.author: GitPrakhar13 ms.author: prsriva
manager: dansimp manager: dansimp
ms.collection: M365-identity-device-management ms.collection: M365-identity-device-management
ms.topic: article ms.topic: article

View File

@ -8,7 +8,7 @@ ms.sitesec: library
ms.pagetype: security, mobile ms.pagetype: security, mobile
audience: ITPro audience: ITPro
author: GitPrakhar13 author: GitPrakhar13
ms.author: GitPrakhar13 ms.author: prsriva
manager: dansimp manager: dansimp
ms.collection: M365-identity-device-management ms.collection: M365-identity-device-management
ms.topic: article ms.topic: article

View File

@ -8,7 +8,7 @@ ms.sitesec: library
ms.pagetype: security, mobile ms.pagetype: security, mobile
audience: ITPro audience: ITPro
author: GitPrakhar13 author: GitPrakhar13
ms.author: GitPrakhar13 ms.author: prsriva
manager: dansimp manager: dansimp
ms.collection: M365-identity-device-management ms.collection: M365-identity-device-management
ms.topic: article ms.topic: article
@ -19,23 +19,25 @@ ms.reviewer:
# Hybrid Azure AD joined Windows Hello for Business Prerequisites # Hybrid Azure AD joined Windows Hello for Business Prerequisites
**Applies to** **Applies to**
- Windows 10, version 1703 or later - Windows 10, version 1703 or later
- Windows 11 - Windows 11
- Hybrid deployment - Hybrid deployment
- Certificate trust - Certificate trust
Hybrid environments are distributed systems that enable organizations to use on-premises and Azure-based identities and resources. Windows Hello for Business uses the existing distributed system as a foundation on which organizations can provide two-factor authentication that provides a single sign-in like experience to modern resources. Hybrid environments are distributed systems that enable organizations to use on-premises and Azure-based identities and resources. Windows Hello for Business uses the existing distributed system as a foundation on which organizations can provide two-factor authentication that provides a single sign-in like experience to modern resources.
The distributed systems on which these technologies were built involved several pieces of on-premises and cloud infrastructure. High-level pieces of the infrastructure include: The distributed systems on which these technologies were built involved several pieces of on-premises and cloud infrastructure. High-level pieces of the infrastructure include:
* [Directories](#directories)
* [Public Key Infrastructure](#public-key-infrastructure) - [Directories](#directories)
* [Directory Synchronization](#directory-synchronization) - [Public Key Infrastructure](#public-key-infrastructure)
* [Federation](#federation) - [Directory Synchronization](#directory-synchronization)
* [Multifactor Authentication](#multifactor-authentication) - [Federation](#federation)
* [Device Registration](#device-registration) - [Multifactor Authentication](#multifactor-authentication)
- [Device Registration](#device-registration)
## Directories ## ## Directories ##
Hybrid Windows Hello for Business needs two directories: on-premises Active Directory and a cloud Azure Active Directory. The minimum required domain controller, domain functional level, and forest functional level for Windows Hello for Business deployment is Windows Server 2008 R2. Hybrid Windows Hello for Business needs two directories: on-premises Active Directory and a cloud Azure Active Directory. The minimum required domain controller, domain functional level, and forest functional level for Windows Hello for Business deployment is Windows Server 2008 R2.
A hybrid Windows Hello for Business deployment needs an Azure Active Directory subscription. Different deployment configurations are supported by different Azure subscriptions. The hybrid-certificate trust deployment needs an Azure Active Directory premium subscription because it uses the device write-back synchronization feature. Other deployments, such as the hybrid key-trust deployment, may not require Azure Active Directory premium subscription. A hybrid Windows Hello for Business deployment needs an Azure Active Directory subscription. Different deployment configurations are supported by different Azure subscriptions. The hybrid-certificate trust deployment needs an Azure Active Directory premium subscription because it uses the device write-back synchronization feature. Other deployments, such as the hybrid key-trust deployment, may not require Azure Active Directory premium subscription.
@ -57,6 +59,7 @@ Review these requirements and those from the Windows Hello for Business planning
<br> <br>
## Public Key Infrastructure ## ## Public Key Infrastructure ##
The Windows Hello for Business deployment depends on an enterprise public key infrastructure as trust anchor for authentication. Domain controllers for hybrid deployments need a certificate in order for Windows devices to trust the domain controller. The Windows Hello for Business deployment depends on an enterprise public key infrastructure as trust anchor for authentication. Domain controllers for hybrid deployments need a certificate in order for Windows devices to trust the domain controller.
Certificate trust deployments need an enterprise public key infrastructure and a certificate registration authority to issue authentication certificates to users. When using Group Policy, hybrid certificate trust deployment uses the Windows Server 2016 Active Directory Federation Server (AD FS) as a certificate registration authority. Certificate trust deployments need an enterprise public key infrastructure and a certificate registration authority to issue authentication certificates to users. When using Group Policy, hybrid certificate trust deployment uses the Windows Server 2016 Active Directory Federation Server (AD FS) as a certificate registration authority.
@ -64,6 +67,7 @@ Certificate trust deployments need an enterprise public key infrastructure and a
The minimum required enterprise certificate authority that can be used with Windows Hello for Business is Windows Server 2012. The minimum required enterprise certificate authority that can be used with Windows Hello for Business is Windows Server 2012.
### Section Review ### Section Review
> [!div class="checklist"] > [!div class="checklist"]
> * Windows Server 2012 Issuing Certificate Authority > * Windows Server 2012 Issuing Certificate Authority
> * Windows Server 2016 Active Directory Federation Services > * Windows Server 2016 Active Directory Federation Services
@ -71,6 +75,7 @@ The minimum required enterprise certificate authority that can be used with Wind
<br> <br>
## Directory Synchronization ## ## Directory Synchronization ##
The two directories used in hybrid deployments must be synchronized. You need Azure Active Directory Connect to synchronize user accounts in the on-premises Active Directory with Azure Active Directory. The two directories used in hybrid deployments must be synchronized. You need Azure Active Directory Connect to synchronize user accounts in the on-premises Active Directory with Azure Active Directory.
Organizations using older directory synchronization technology, such as DirSync or Azure AD sync, need to upgrade to Azure AD Connect. In case the schema of your local AD DS was changed since the last directory synchronization, you may need to [refresh directory schema](/azure/active-directory/hybrid/how-to-connect-installation-wizard#refresh-directory-schema). Organizations using older directory synchronization technology, such as DirSync or Azure AD sync, need to upgrade to Azure AD Connect. In case the schema of your local AD DS was changed since the last directory synchronization, you may need to [refresh directory schema](/azure/active-directory/hybrid/how-to-connect-installation-wizard#refresh-directory-schema).
@ -82,6 +87,7 @@ Organizations using older directory synchronization technology, such as DirSync
> Windows Hello for Business is tied between a user and a device. Both the user and device need to be synchronized between Azure Active Directory and Active Directory. > Windows Hello for Business is tied between a user and a device. Both the user and device need to be synchronized between Azure Active Directory and Active Directory.
### Section Review ### Section Review
> [!div class="checklist"] > [!div class="checklist"]
> * Azure Active Directory Connect directory synchronization > * Azure Active Directory Connect directory synchronization
> * [Upgrade from DirSync](/azure/active-directory/connect/active-directory-aadconnect-dirsync-upgrade-get-started) > * [Upgrade from DirSync](/azure/active-directory/connect/active-directory-aadconnect-dirsync-upgrade-get-started)
@ -90,11 +96,13 @@ Organizations using older directory synchronization technology, such as DirSync
<br> <br>
## Federation ## ## Federation ##
Windows Hello for Business hybrid certificate trust requires Active Directory being federated with Azure Active Directory and needs Windows Server 2016 Active Directory Federation Services or newer. Windows Hello for Business hybrid certificate trust doesnt support Managed Azure Active Directory using Pass-through authentication or password hash sync. All nodes in the AD FS farm must run the same version of AD FS. Additionally, you need to configure your AD FS farm to support Azure registered devices. Windows Hello for Business hybrid certificate trust requires Active Directory being federated with Azure Active Directory and needs Windows Server 2016 Active Directory Federation Services or newer. Windows Hello for Business hybrid certificate trust doesnt support Managed Azure Active Directory using Pass-through authentication or password hash sync. All nodes in the AD FS farm must run the same version of AD FS. Additionally, you need to configure your AD FS farm to support Azure registered devices.
The AD FS farm used with Windows Hello for Business must be Windows Server 2016 with minimum update of [KB4088889 (14393.2155)](https://support.microsoft.com/help/4088889). If your AD FS farm is not running the AD FS role with updates from Windows Server 2016, then read [Upgrading to AD FS in Windows Server 2016](/windows-server/identity/ad-fs/deployment/upgrading-to-ad-fs-in-windows-server-2016) The AD FS farm used with Windows Hello for Business must be Windows Server 2016 with minimum update of [KB4088889 (14393.2155)](https://support.microsoft.com/help/4088889). If your AD FS farm is not running the AD FS role with updates from Windows Server 2016, then read [Upgrading to AD FS in Windows Server 2016](/windows-server/identity/ad-fs/deployment/upgrading-to-ad-fs-in-windows-server-2016)
### Section Review ### ### Section Review ###
> [!div class="checklist"] > [!div class="checklist"]
> * Windows Server 2016 Active Directory Federation Services > * Windows Server 2016 Active Directory Federation Services
> * Minimum update of [KB4088889 (14393.2155)](https://support.microsoft.com/help/4088889) > * Minimum update of [KB4088889 (14393.2155)](https://support.microsoft.com/help/4088889)
@ -102,11 +110,13 @@ The AD FS farm used with Windows Hello for Business must be Windows Server 2016
<br> <br>
## Multifactor Authentication ## ## Multifactor Authentication ##
Windows Hello for Business is a strong, two-factor credential the helps organizations reduce their dependency on passwords. The provisioning process lets a user enroll in Windows Hello for Business using their username and password as one factor. but needs a second factor of authentication. Windows Hello for Business is a strong, two-factor credential the helps organizations reduce their dependency on passwords. The provisioning process lets a user enroll in Windows Hello for Business using their username and password as one factor. but needs a second factor of authentication.
Hybrid Windows Hello for Business deployments can use Azures Multifactor Authentication service, or they can use multifactor authentication provides by Windows Server 2016 Active Directory Federation Services, which includes an adapter model that enables third parties to integrate their multifactor authentication into AD FS. Hybrid Windows Hello for Business deployments can use Azures Multifactor Authentication service, or they can use multifactor authentication provides by Windows Server 2016 Active Directory Federation Services, which includes an adapter model that enables third parties to integrate their multifactor authentication into AD FS.
### Section Review ### Section Review
> [!div class="checklist"] > [!div class="checklist"]
> * Azure MFA Service > * Azure MFA Service
> * Windows Server 2016 AD FS and Azure > * Windows Server 2016 AD FS and Azure
@ -115,6 +125,7 @@ Hybrid Windows Hello for Business deployments can use Azures Multifactor Auth
<br> <br>
## Device Registration ## ## Device Registration ##
Organizations wanting to deploy hybrid certificate trust need their domain joined devices to register to Azure Active Directory. Just as a computer has an identity in Active Directory, that same computer has an identity in the cloud. This ensures that only approved computers are used with that Azure Active Directory. Each computer registers its identity in Azure Active Directory. Organizations wanting to deploy hybrid certificate trust need their domain joined devices to register to Azure Active Directory. Just as a computer has an identity in Active Directory, that same computer has an identity in the cloud. This ensures that only approved computers are used with that Azure Active Directory. Each computer registers its identity in Azure Active Directory.
Hybrid certificate trust deployments need the device write back feature. Authentication to the Windows Server 2016 Active Directory Federation Services needs both the user and the computer to authenticate. Typically the users are synchronized, but not devices. This prevents AD FS from authenticating the computer and results in Windows Hello for Business certificate enrollment failures. For this reason, Windows Hello for Business deployments need device writeback, which is an Azure Active Directory premium feature. Hybrid certificate trust deployments need the device write back feature. Authentication to the Windows Server 2016 Active Directory Federation Services needs both the user and the computer to authenticate. Typically the users are synchronized, but not devices. This prevents AD FS from authenticating the computer and results in Windows Hello for Business certificate enrollment failures. For this reason, Windows Hello for Business deployments need device writeback, which is an Azure Active Directory premium feature.
@ -128,6 +139,7 @@ You need to allow access to the URL account.microsoft.com to initiate Windows He
### Section Checklist ### ### Section Checklist ###
> [!div class="checklist"] > [!div class="checklist"]
> * Azure Active Directory Device writeback > * Azure Active Directory Device writeback
> * Azure Active Directory Premium subscription > * Azure Active Directory Premium subscription
@ -151,6 +163,7 @@ If your environment is already federated and supports Azure device registration,
<hr> <hr>
## Follow the Windows Hello for Business hybrid certificate trust deployment guide ## Follow the Windows Hello for Business hybrid certificate trust deployment guide
1. [Overview](hello-hybrid-cert-trust.md) 1. [Overview](hello-hybrid-cert-trust.md)
2. Prerequisites (*You are here*) 2. Prerequisites (*You are here*)
3. [New Installation Baseline](hello-hybrid-cert-new-install.md) 3. [New Installation Baseline](hello-hybrid-cert-new-install.md)

View File

@ -8,7 +8,7 @@ ms.sitesec: library
ms.pagetype: security, mobile ms.pagetype: security, mobile
audience: ITPro audience: ITPro
author: GitPrakhar13 author: GitPrakhar13
ms.author: GitPrakhar13 ms.author: prsriva
manager: dansimp manager: dansimp
ms.collection: M365-identity-device-management ms.collection: M365-identity-device-management
ms.topic: article ms.topic: article

View File

@ -8,7 +8,7 @@ ms.sitesec: library
ms.pagetype: security, mobile ms.pagetype: security, mobile
audience: ITPro audience: ITPro
author: GitPrakhar13 author: GitPrakhar13
ms.author: GitPrakhar13 ms.author: prsriva
manager: dansimp manager: dansimp
ms.collection: M365-identity-device-management ms.collection: M365-identity-device-management
ms.topic: article ms.topic: article

View File

@ -7,8 +7,8 @@ ms.mktglfcycl: deploy
ms.sitesec: library ms.sitesec: library
ms.pagetype: security, mobile ms.pagetype: security, mobile
audience: ITPro audience: ITPro
author: mapalko author: GitPrakhar13
ms.author: mapalko ms.author: prsriva
manager: dansimp manager: dansimp
ms.collection: M365-identity-device-management ms.collection: M365-identity-device-management
ms.topic: article ms.topic: article
@ -19,12 +19,12 @@ ms.reviewer:
# Configure Hybrid Azure AD joined Windows Hello for Business: Active Directory # Configure Hybrid Azure AD joined Windows Hello for Business: Active Directory
**Applies to** **Applies to**
- Windows 10, version 1703 or later - Windows 10, version 1703 or later
- Windows 11 - Windows 11
- Hybrid deployment - Hybrid deployment
- Certificate trust - Certificate trust
The key synchronization process for the hybrid deployment of Windows Hello for Business needs the Windows Server 2016 Active Directory schema. The key synchronization process for the hybrid deployment of Windows Hello for Business needs the Windows Server 2016 Active Directory schema.
### Creating Security Groups ### Creating Security Groups

View File

@ -8,7 +8,7 @@ ms.sitesec: library
ms.pagetype: security, mobile ms.pagetype: security, mobile
audience: ITPro audience: ITPro
author: GitPrakhar13 author: GitPrakhar13
ms.author: GitPrakhar13 ms.author: prsriva
manager: dansimp manager: dansimp
ms.collection: M365-identity-device-management ms.collection: M365-identity-device-management
ms.topic: article ms.topic: article

View File

@ -8,7 +8,7 @@ ms.sitesec: library
ms.pagetype: security, mobile ms.pagetype: security, mobile
audience: ITPro audience: ITPro
author: GitPrakhar13 author: GitPrakhar13
ms.author: GitPrakhar13 ms.author: prsriva
manager: dansimp manager: dansimp
ms.collection: M365-identity-device-management ms.collection: M365-identity-device-management
ms.topic: article ms.topic: article

View File

@ -8,7 +8,7 @@ ms.sitesec: library
ms.pagetype: security, mobile ms.pagetype: security, mobile
audience: ITPro audience: ITPro
author: GitPrakhar13 author: GitPrakhar13
ms.author: GitPrakhar13 ms.author: prsriva
manager: dansimp manager: dansimp
ms.collection: M365-identity-device-management ms.collection: M365-identity-device-management
ms.topic: article ms.topic: article

View File

@ -8,7 +8,7 @@ ms.sitesec: library
ms.pagetype: security, mobile ms.pagetype: security, mobile
audience: ITPro audience: ITPro
author: GitPrakhar13 author: GitPrakhar13
ms.author: GitPrakhar13 ms.author: prsriva
manager: dansimp manager: dansimp
ms.collection: M365-identity-device-management ms.collection: M365-identity-device-management
ms.topic: article ms.topic: article

View File

@ -8,7 +8,7 @@ ms.sitesec: library
ms.pagetype: security, mobile ms.pagetype: security, mobile
audience: ITPro audience: ITPro
author: GitPrakhar13 author: GitPrakhar13
ms.author: GitPrakhar13 ms.author: prsriva
manager: dansimp manager: dansimp
ms.collection: M365-identity-device-management ms.collection: M365-identity-device-management
ms.topic: article ms.topic: article

View File

@ -7,8 +7,8 @@ ms.mktglfcycl: deploy
ms.sitesec: library ms.sitesec: library
ms.pagetype: security, mobile ms.pagetype: security, mobile
audience: ITPro audience: ITPro
author: mapalko author: GitPrakhar13
ms.author: mapalko ms.author: prsriva
manager: dansimp manager: dansimp
ms.collection: M365-identity-device-management ms.collection: M365-identity-device-management
ms.topic: article ms.topic: article

View File

@ -8,7 +8,7 @@ ms.sitesec: library
ms.pagetype: security, mobile ms.pagetype: security, mobile
audience: ITPro audience: ITPro
author: GitPrakhar13 author: GitPrakhar13
ms.author: GitPrakhar13 ms.author: prsriva
manager: dansimp manager: dansimp
ms.collection: M365-identity-device-management ms.collection: M365-identity-device-management
ms.topic: article ms.topic: article

View File

@ -8,7 +8,7 @@ ms.sitesec: library
ms.pagetype: security, mobile ms.pagetype: security, mobile
audience: ITPro audience: ITPro
author: GitPrakhar13 author: GitPrakhar13
ms.author: GitPrakhar13 ms.author: prsriva
manager: dansimp manager: dansimp
ms.collection: M365-identity-device-management ms.collection: M365-identity-device-management
ms.topic: article ms.topic: article

View File

@ -7,8 +7,8 @@ ms.mktglfcycl: deploy
ms.sitesec: library ms.sitesec: library
ms.pagetype: security, mobile ms.pagetype: security, mobile
audience: ITPro audience: ITPro
author: mapalko author: GitPrakhar13
ms.author: mapalko ms.author: prsriva
manager: dansimp manager: dansimp
ms.collection: M365-identity-device-management ms.collection: M365-identity-device-management
ms.topic: article ms.topic: article
@ -19,17 +19,17 @@ ms.reviewer:
# Configure Directory Synchronization for Hybrid Azure AD joined key trust Windows Hello for Business # Configure Directory Synchronization for Hybrid Azure AD joined key trust Windows Hello for Business
**Applies to** **Applies to**
- Windows 10, version 1703 or later - Windows 10, version 1703 or later
- Windows 11 - Windows 11
- Hybrid deployment - Hybrid deployment
- Key trust - Key trust
You are ready to configure directory synchronization for your hybrid environment. Hybrid Windows Hello for Business deployment needs both a cloud and an on-premises identity to authenticate and access resources in the cloud or on-premises. You are ready to configure directory synchronization for your hybrid environment. Hybrid Windows Hello for Business deployment needs both a cloud and an on-premises identity to authenticate and access resources in the cloud or on-premises.
## Deploy Azure AD Connect ## Deploy Azure AD Connect
Next, you need to synchronize the on-premises Active Directory with Azure Active Directory. To do this, first review the [Integrating on-prem directories with Azure Active Directory](/azure/active-directory/connect/active-directory-aadconnect) and [hardware and prerequisites](/azure/active-directory/connect/active-directory-aadconnect-prerequisites) needed and then [download the software](https://go.microsoft.com/fwlink/?LinkId=615771).
Next, you need to synchronize the on-premises Active Directory with Azure Active Directory. To do this, first review the [Integrating on-prem directories with Azure Active Directory](/azure/active-directory/connect/active-directory-aadconnect) and [hardware and prerequisites](/azure/active-directory/connect/active-directory-aadconnect-prerequisites) needed and then [download the software](https://go.microsoft.com/fwlink/?LinkId=615771).
> [!NOTE] > [!NOTE]
> If you installed Azure AD Connect prior to upgrading the schema, you will need to re-run the Azure AD Connect installation and refresh the on-premises AD schema to ensure the synchronization rule for msDS-KeyCredentialLink is configured. > If you installed Azure AD Connect prior to upgrading the schema, you will need to re-run the Azure AD Connect installation and refresh the on-premises AD schema to ensure the synchronization rule for msDS-KeyCredentialLink is configured.
@ -39,6 +39,7 @@ Next, you need to synchronize the on-premises Active Directory with Azure Active
<hr> <hr>
## Follow the Windows Hello for Business hybrid key trust deployment guide ## Follow the Windows Hello for Business hybrid key trust deployment guide
1. [Overview](hello-hybrid-key-trust.md) 1. [Overview](hello-hybrid-key-trust.md)
2. [Prerequisites](hello-hybrid-key-trust-prereqs.md) 2. [Prerequisites](hello-hybrid-key-trust-prereqs.md)
3. [New Installation Baseline](hello-hybrid-key-new-install.md) 3. [New Installation Baseline](hello-hybrid-key-new-install.md)

View File

@ -8,7 +8,7 @@ ms.sitesec: library
ms.pagetype: security, mobile ms.pagetype: security, mobile
audience: ITPro audience: ITPro
author: mapalko author: mapalko
ms.author: mapalko ms.author: prsriva
manager: dansimp manager: dansimp
ms.collection: M365-identity-device-management ms.collection: M365-identity-device-management
ms.topic: article ms.topic: article

View File

@ -7,8 +7,8 @@ ms.mktglfcycl: deploy
ms.sitesec: library ms.sitesec: library
ms.pagetype: security, mobile ms.pagetype: security, mobile
audience: ITPro audience: ITPro
author: mapalko author: GitPrakhar13
ms.author: mapalko ms.author: prsriva
manager: dansimp manager: dansimp
ms.collection: M365-identity-device-management ms.collection: M365-identity-device-management
ms.topic: article ms.topic: article

View File

@ -7,8 +7,8 @@ ms.mktglfcycl: deploy
ms.sitesec: library ms.sitesec: library
ms.pagetype: security, mobile ms.pagetype: security, mobile
audience: ITPro audience: ITPro
author: mapalko author: GitPrakhar13
ms.author: mapalko ms.author: prsriva
manager: dansimp manager: dansimp
ms.collection: M365-identity-device-management ms.collection: M365-identity-device-management
ms.topic: article ms.topic: article
@ -19,20 +19,20 @@ ms.reviewer:
# Hybrid Azure AD joined Windows Hello for Business Key Trust Provisioning # Hybrid Azure AD joined Windows Hello for Business Key Trust Provisioning
**Applies to** **Applies to**
- Windows 10, version 1703 or later - Windows 10, version 1703 or later
- Windows 11 - Windows 11
- Hybrid deployment - Hybrid deployment
- Key trust - Key trust
## Provisioning ## Provisioning
The Windows Hello for Business provisioning begins immediately after the user has signed in, after the user profile is loaded, but before the user receives their desktop. Windows only launches the provisioning experience if all the prerequisite checks pass. You can determine the status of the prerequisite checks by viewing the **User Device Registration** in the **Event Viewer** under **Applications and Services Logs\Microsoft\Windows**. The Windows Hello for Business provisioning begins immediately after the user has signed in, after the user profile is loaded, but before the user receives their desktop. Windows only launches the provisioning experience if all the prerequisite checks pass. You can determine the status of the prerequisite checks by viewing the **User Device Registration** in the **Event Viewer** under **Applications and Services Logs\Microsoft\Windows**.
![Event358.](images/Event358-2.png) ![Event358.](images/Event358-2.png)
The first thing to validate is the computer has processed device registration. You can view this from the User device registration logs where the check **Device is AAD joined (AADJ or DJ++): Yes** appears. Additionally, you can validate this using the **dsregcmd /status** command from a console prompt where the value for **AzureADJoined** reads **Yes**. The first thing to validate is the computer has processed device registration. You can view this from the User device registration logs where the check **Device is AAD joined (AADJ or DJ++): Yes** appears. Additionally, you can validate this using the **dsregcmd /status** command from a console prompt where the value for **AzureADJoined** reads **Yes**.
Windows Hello for Business provisioning begins with a full screen page with the title **Setup a PIN** and button with the same name. The user clicks **Setup a PIN**. Windows Hello for Business provisioning begins with a full screen page with the title **Setup a PIN** and button with the same name. The user clicks **Setup a PIN**.
![Setup a PIN Provisioning.](images/setupapin.png) ![Setup a PIN Provisioning.](images/setupapin.png)
@ -46,10 +46,11 @@ After a successful MFA, the provisioning flow asks the user to create and valida
![Create a PIN during provisioning.](images/createPin.png) ![Create a PIN during provisioning.](images/createPin.png)
The provisioning flow has all the information it needs to complete the Windows Hello for Business enrollment. The provisioning flow has all the information it needs to complete the Windows Hello for Business enrollment.
* A successful single factor authentication (username and password at sign-in)
* A device that has successfully completed device registration - A successful single factor authentication (username and password at sign-in)
* A fresh, successful multi-factor authentication - A device that has successfully completed device registration
* A validated PIN that meets the PIN complexity requirements - A fresh, successful multi-factor authentication
- A validated PIN that meets the PIN complexity requirements
The remainder of the provisioning includes Windows Hello for Business requesting an asymmetric key pair for the user, preferably from the TPM (or required if explicitly set through policy). Once the key pair is acquired, Windows communicates with Azure Active Directory to register the public key. When key registration completes, Windows Hello for Business provisioning informs the user they can use their PIN to sign-in. The user may close the provisioning application and see their desktop. While the user has completed provisioning, Azure AD Connect synchronizes the user's key to Active Directory. The remainder of the provisioning includes Windows Hello for Business requesting an asymmetric key pair for the user, preferably from the TPM (or required if explicitly set through policy). Once the key pair is acquired, Windows communicates with Azure Active Directory to register the public key. When key registration completes, Windows Hello for Business provisioning informs the user they can use their PIN to sign-in. The user may close the provisioning application and see their desktop. While the user has completed provisioning, Azure AD Connect synchronizes the user's key to Active Directory.
@ -63,6 +64,7 @@ The remainder of the provisioning includes Windows Hello for Business requesting
<hr> <hr>
## Follow the Windows Hello for Business hybrid key trust deployment guide ## Follow the Windows Hello for Business hybrid key trust deployment guide
1. [Overview](hello-hybrid-key-trust.md) 1. [Overview](hello-hybrid-key-trust.md)
2. [Prerequisites](hello-hybrid-key-trust-prereqs.md) 2. [Prerequisites](hello-hybrid-key-trust-prereqs.md)
3. [New Installation Baseline](hello-hybrid-key-new-install.md) 3. [New Installation Baseline](hello-hybrid-key-new-install.md)

View File

@ -8,7 +8,7 @@ ms.sitesec: library
ms.pagetype: security, mobile ms.pagetype: security, mobile
audience: ITPro audience: ITPro
author: GitPrakhar13 author: GitPrakhar13
ms.author: GitPrakhar13 ms.author: prsriva
manager: dansimp manager: dansimp
ms.collection: M365-identity-device-management ms.collection: M365-identity-device-management
ms.topic: article ms.topic: article

View File

@ -8,7 +8,7 @@ ms.sitesec: library
ms.pagetype: security, mobile ms.pagetype: security, mobile
audience: ITPro audience: ITPro
author: GitPrakhar13 author: GitPrakhar13
ms.author: GitPrakhar13 ms.author: prsriva
manager: dansimp manager: dansimp
ms.collection: M365-identity-device-management ms.collection: M365-identity-device-management
ms.topic: article ms.topic: article

View File

@ -7,8 +7,8 @@ ms.mktglfcycl: deploy
ms.sitesec: library ms.sitesec: library
ms.pagetype: security, mobile ms.pagetype: security, mobile
audience: ITPro audience: ITPro
author: mapalko author: GitPrakhar13
ms.author: mapalko ms.author: prsriva
manager: dansimp manager: dansimp
ms.collection: M365-identity-device-management ms.collection: M365-identity-device-management
ms.topic: article ms.topic: article

View File

@ -7,8 +7,8 @@ ms.mktglfcycl: deploy
ms.sitesec: library ms.sitesec: library
ms.pagetype: security, mobile ms.pagetype: security, mobile
audience: ITPro audience: ITPro
author: mapalko author: GitPrakhar13
ms.author: mapalko ms.author: prsriva
manager: dansimp manager: dansimp
ms.collection: M365-identity-device-management ms.collection: M365-identity-device-management
ms.topic: article ms.topic: article
@ -19,12 +19,12 @@ ms.reviewer:
# Configure Hybrid Azure AD joined Windows Hello for Business: Group Policy # Configure Hybrid Azure AD joined Windows Hello for Business: Group Policy
**Applies to** **Applies to**
- Windows 10, version 1703 or later - Windows 10, version 1703 or later
- Windows 11 - Windows 11
- Hybrid deployment - Hybrid deployment
- Key trust - Key trust
## Policy Configuration ## Policy Configuration
You need at least a Windows 10, version 1703 workstation to run the Group Policy Management Console, which provides the latest Windows Hello for Business and PIN Complexity Group Policy settings. To run the Group Policy Management Console, you need to install the Remote Server Administration Tools for Windows. You can download these tools from the [Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=45520). You need at least a Windows 10, version 1703 workstation to run the Group Policy Management Console, which provides the latest Windows Hello for Business and PIN Complexity Group Policy settings. To run the Group Policy Management Console, you need to install the Remote Server Administration Tools for Windows. You can download these tools from the [Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=45520).

View File

@ -7,8 +7,8 @@ ms.mktglfcycl: deploy
ms.sitesec: library ms.sitesec: library
ms.pagetype: security, mobile ms.pagetype: security, mobile
audience: ITPro audience: ITPro
author: mapalko author: GitPrakhar13
ms.author: mapalko ms.author: prsriva
manager: dansimp manager: dansimp
ms.collection: M365-identity-device-management ms.collection: M365-identity-device-management
ms.topic: article ms.topic: article
@ -19,6 +19,7 @@ ms.reviewer:
# Configure Hybrid Azure AD joined Windows Hello for Business key trust settings # Configure Hybrid Azure AD joined Windows Hello for Business key trust settings
**Applies to** **Applies to**
- Windows 10, version 1703 or later - Windows 10, version 1703 or later
- Windows 11 - Windows 11
- Hybrid deployment - Hybrid deployment
@ -45,6 +46,7 @@ For the most efficient deployment, configure these technologies in order beginni
<hr> <hr>
## Follow the Windows Hello for Business hybrid key trust deployment guide ## Follow the Windows Hello for Business hybrid key trust deployment guide
1. [Overview](hello-hybrid-key-trust.md) 1. [Overview](hello-hybrid-key-trust.md)
2. [Prerequisites](hello-hybrid-key-trust-prereqs.md) 2. [Prerequisites](hello-hybrid-key-trust-prereqs.md)
3. [New Installation Baseline](hello-hybrid-key-new-install.md) 3. [New Installation Baseline](hello-hybrid-key-new-install.md)

View File

@ -9,7 +9,7 @@ ms.sitesec: library
ms.pagetype: security, mobile ms.pagetype: security, mobile
audience: ITPro audience: ITPro
author: GitPrakhar13 author: GitPrakhar13
ms.author: GitPrakhar13 ms.author: prsriva
manager: dansimp manager: dansimp
ms.collection: ms.collection:
- M365-identity-device-management - M365-identity-device-management

View File

@ -8,7 +8,7 @@ ms.sitesec: library
ms.pagetype: security, mobile ms.pagetype: security, mobile
audience: ITPro audience: ITPro
author: GitPrakhar13 author: GitPrakhar13
ms.author: GitPrakhar13 ms.author: prsriva
manager: dansimp manager: dansimp
ms.collection: M365-identity-device-management ms.collection: M365-identity-device-management
ms.topic: article ms.topic: article

View File

@ -8,7 +8,7 @@ ms.sitesec: library
ms.pagetype: security, mobile ms.pagetype: security, mobile
audience: ITPro audience: ITPro
author: GitPrakhar13 author: GitPrakhar13
ms.author: GitPrakhar13 ms.author: prsriva
manager: dansimp manager: dansimp
ms.collection: M365-identity-device-management ms.collection: M365-identity-device-management
ms.topic: article ms.topic: article

View File

@ -9,7 +9,7 @@ ms.pagetype: security, mobile
author: dansimp author: dansimp
audience: ITPro audience: ITPro
ms.author: GitPrakhar13 ms.author: GitPrakhar13
manager: GitPrakhar13 manager: prsriva
ms.collection: M365-identity-device-management ms.collection: M365-identity-device-management
ms.topic: article ms.topic: article
localizationpriority: medium localizationpriority: medium
@ -19,12 +19,12 @@ ms.reviewer:
# Validate Active Directory prerequisites - Key Trust # Validate Active Directory prerequisites - Key Trust
**Applies to** **Applies to**
- Windows 10, version 1703 or later - Windows 10, version 1703 or later
- Windows 11 - Windows 11
- On-premises deployment - On-premises deployment
- Key trust - Key trust
Key trust deployments need an adequate number of 2016 or later domain controllers to ensure successful user authentication with Windows Hello for Business. To learn more about domain controller planning for key trust deployments, read the [Windows Hello for Business planning guide](hello-planning-guide.md), the [Planning an adequate number of Windows Server 2016 or later Domain Controllers for Windows Hello for Business deployments](hello-adequate-domain-controllers.md) section. Key trust deployments need an adequate number of 2016 or later domain controllers to ensure successful user authentication with Windows Hello for Business. To learn more about domain controller planning for key trust deployments, read the [Windows Hello for Business planning guide](hello-planning-guide.md), the [Planning an adequate number of Windows Server 2016 or later Domain Controllers for Windows Hello for Business deployments](hello-adequate-domain-controllers.md) section.
> [!NOTE] > [!NOTE]

View File

@ -8,7 +8,7 @@ ms.sitesec: library
ms.pagetype: security, mobile ms.pagetype: security, mobile
audience: ITPro audience: ITPro
author: GitPrakhar13 author: GitPrakhar13
ms.author: GitPrakhar13 ms.author: prsriva
manager: dansimp manager: dansimp
ms.collection: M365-identity-device-management ms.collection: M365-identity-device-management
ms.topic: article ms.topic: article
@ -35,6 +35,7 @@ For information on available third-party authentication methods see [Configure A
Follow the integration and deployment guide for the authentication provider you select to integrate and deploy it to AD FS. Make sure that the authentication provider is selected as a multi-factor authentication option in the AD FS authentication policy. For information on configuring AD FS authentication policies see [Configure Authentication Policies](/windows-server/identity/ad-fs/operations/configure-authentication-policies). Follow the integration and deployment guide for the authentication provider you select to integrate and deploy it to AD FS. Make sure that the authentication provider is selected as a multi-factor authentication option in the AD FS authentication policy. For information on configuring AD FS authentication policies see [Configure Authentication Policies](/windows-server/identity/ad-fs/operations/configure-authentication-policies).
## Follow the Windows Hello for Business on premises certificate trust deployment guide ## Follow the Windows Hello for Business on premises certificate trust deployment guide
1. [Validate Active Directory prerequisites](hello-key-trust-validate-ad-prereq.md) 1. [Validate Active Directory prerequisites](hello-key-trust-validate-ad-prereq.md)
2. [Validate and Configure Public Key Infrastructure](hello-key-trust-validate-pki.md) 2. [Validate and Configure Public Key Infrastructure](hello-key-trust-validate-pki.md)
3. [Prepare and Deploy Windows Server 2016 Active Directory Federation Services](hello-key-trust-adfs.md) 3. [Prepare and Deploy Windows Server 2016 Active Directory Federation Services](hello-key-trust-adfs.md)

View File

@ -7,8 +7,8 @@ ms.mktglfcycl: deploy
ms.sitesec: library ms.sitesec: library
ms.pagetype: security, mobile ms.pagetype: security, mobile
audience: ITPro audience: ITPro
author: mapalko author: GitPrakhar13
ms.author: mapalko ms.author: prsriva
manager: dansimp manager: dansimp
ms.collection: M365-identity-device-management ms.collection: M365-identity-device-management
ms.topic: article ms.topic: article
@ -20,12 +20,12 @@ ms.reviewer:
# Validate and Configure Public Key Infrastructure - Key Trust # Validate and Configure Public Key Infrastructure - Key Trust
**Applies to** **Applies to**
- Windows 10, version 1703 or later - Windows 10, version 1703 or later
- Windows 11 - Windows 11
- On-premises deployment - On-premises deployment
- Key trust - Key trust
Windows Hello for Business must have a public key infrastructure regardless of the deployment or trust model. All trust models depend on the domain controllers having a certificate. The certificate serves as a root of trust for clients to ensure they are not communicating with a rogue domain controller. Windows Hello for Business must have a public key infrastructure regardless of the deployment or trust model. All trust models depend on the domain controllers having a certificate. The certificate serves as a root of trust for clients to ensure they are not communicating with a rogue domain controller.
## Deploy an enterprise certificate authority ## Deploy an enterprise certificate authority
@ -234,7 +234,6 @@ Look for an event indicating a new certificate enrollment (autoenrollment). The
Certificates superseded by your new domain controller certificate generate an archive event in the CertificateServices-Lifecycles-System event. The archive event contains the certificate template name and thumbprint of the certificate that was superseded by the new certificate. Certificates superseded by your new domain controller certificate generate an archive event in the CertificateServices-Lifecycles-System event. The archive event contains the certificate template name and thumbprint of the certificate that was superseded by the new certificate.
#### Certificate Manager #### Certificate Manager
You can use the Certificate Manager console to validate the domain controller has the properly enrolled certificate based on the correct certificate template with the proper EKUs. Use **certlm.msc** to view certificate in the local computers certificate stores. Expand the **Personal** store and view the certificates enrolled for the computer. Archived certificates do not appear in Certificate Manager. You can use the Certificate Manager console to validate the domain controller has the properly enrolled certificate based on the correct certificate template with the proper EKUs. Use **certlm.msc** to view certificate in the local computers certificate stores. Expand the **Personal** store and view the certificates enrolled for the computer. Archived certificates do not appear in Certificate Manager.
@ -253,8 +252,8 @@ Alternatively, you can forcefully trigger automatic certificate enrollment using
Use the event logs to monitor certificate enrollment and archive. Review the configuration, such as publishing certificate templates to issuing certificate authority and the allow auto enrollment permissions. Use the event logs to monitor certificate enrollment and archive. Review the configuration, such as publishing certificate templates to issuing certificate authority and the allow auto enrollment permissions.
## Follow the Windows Hello for Business on premises key trust deployment guide ## Follow the Windows Hello for Business on premises key trust deployment guide
1. [Validate Active Directory prerequisites](hello-key-trust-validate-ad-prereq.md) 1. [Validate Active Directory prerequisites](hello-key-trust-validate-ad-prereq.md)
2. Validate and Configure Public Key Infrastructure (*You are here*) 2. Validate and Configure Public Key Infrastructure (*You are here*)
3. [Prepare and Deploy Windows Server 2016 Active Directory Federation Services](hello-key-trust-adfs.md) 3. [Prepare and Deploy Windows Server 2016 Active Directory Federation Services](hello-key-trust-adfs.md)

View File

@ -9,7 +9,7 @@ ms.sitesec: library
ms.pagetype: security ms.pagetype: security
audience: ITPro audience: ITPro
author: GitPrakhar13 author: GitPrakhar13
ms.author: GitPrakhar13 ms.author: prsriva
manager: dansimp manager: dansimp
ms.collection: ms.collection:
- M365-identity-device-management - M365-identity-device-management

View File

@ -8,8 +8,8 @@ ms.mktglfcycl: deploy
ms.sitesec: library ms.sitesec: library
ms.pagetype: security, mobile ms.pagetype: security, mobile
audience: ITPro audience: ITPro
author: mapalko author: GitPrakhar13
ms.author: mapalko ms.author: prsriva
manager: dansimp manager: dansimp
ms.collection: ms.collection:
- M365-identity-device-management - M365-identity-device-management
@ -120,7 +120,6 @@ Windows Hello for Business with a key, including cloud trust, does not support s
[Windows 10: The End Game for Passwords and Credential Theft?](https://go.microsoft.com/fwlink/p/?LinkId=533891) [Windows 10: The End Game for Passwords and Credential Theft?](https://go.microsoft.com/fwlink/p/?LinkId=533891)
## Related topics ## Related topics
- [How Windows Hello for Business works](hello-how-it-works.md) - [How Windows Hello for Business works](hello-how-it-works.md)

View File

@ -8,7 +8,7 @@ ms.sitesec: library
ms.pagetype: security, mobile ms.pagetype: security, mobile
audience: ITPro audience: ITPro
author: GitPrakhar13 author: GitPrakhar13
ms.author: GitPrakhar13 ms.author: prsriva
manager: dansimp manager: dansimp
ms.collection: ms.collection:
- M365-identity-device-management - M365-identity-device-management

View File

@ -10,7 +10,7 @@ ms.sitesec: library
ms.pagetype: security ms.pagetype: security
audience: ITPro audience: ITPro
author: GitPrakhar13 author: GitPrakhar13
ms.author: GitPrakhar13 ms.author: prsriva
manager: dansimp manager: dansimp
ms.collection: M365-identity-device-management ms.collection: M365-identity-device-management
ms.topic: article ms.topic: article

View File

@ -8,7 +8,7 @@ ms.sitesec: library
ms.pagetype: security, mobile ms.pagetype: security, mobile
audience: ITPro audience: ITPro
author: GitPrakhar13 author: GitPrakhar13
ms.author: GitPrakhar13 ms.author: prsriva
manager: dansimp manager: dansimp
ms.collection: M365-identity-device-management ms.collection: M365-identity-device-management
ms.topic: article ms.topic: article

View File

@ -9,7 +9,7 @@ ms.sitesec: library
ms.pagetype: security ms.pagetype: security
audience: ITPro audience: ITPro
author: GitPrakhar13 author: GitPrakhar13
ms.author: GitPrakhar13 ms.author: prsriva
manager: dansimp manager: dansimp
ms.collection: ms.collection:
- M365-identity-device-management - M365-identity-device-management

View File

@ -10,7 +10,7 @@ metadata:
ms.topic: landing-page ms.topic: landing-page
author: GitPrakhar13 author: GitPrakhar13
manager: dansimp manager: dansimp
ms.author: GitPrakhar13 ms.author: prsriva
ms.date: 01/22/2021 ms.date: 01/22/2021
ms.collection: ms.collection:
- M365-identity-device-management - M365-identity-device-management

View File

@ -8,7 +8,7 @@ ms.sitesec: library
ms.pagetype: security, mobile ms.pagetype: security, mobile
audience: ITPro audience: ITPro
author: GitPrakhar13 author: GitPrakhar13
ms.author: GitPrakhar13 ms.author: prsriva
manager: dansimp manager: dansimp
ms.collection: M365-identity-device-management ms.collection: M365-identity-device-management
ms.topic: article ms.topic: article
@ -17,6 +17,7 @@ ms.date: 11/14/2018
ms.reviewer: ms.reviewer:
--- ---
# What is a Microsoft-compatible security key? # What is a Microsoft-compatible security key?
> [!Warning] > [!Warning]
> Some information relates to pre-released product that may change before it is commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. > Some information relates to pre-released product that may change before it is commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.

View File

@ -8,7 +8,7 @@ ms.sitesec: library
ms.pagetype: security, mobile ms.pagetype: security, mobile
audience: ITPro audience: ITPro
author: GitPrakhar13 author: GitPrakhar13
ms.author: GitPrakhar13 ms.author: prsriva
manager: dansimp manager: dansimp
ms.collection: M365-identity-device-management ms.collection: M365-identity-device-management
ms.topic: article ms.topic: article

View File

@ -8,7 +8,7 @@ ms.sitesec: library
ms.pagetype: security, mobile ms.pagetype: security, mobile
audience: ITPro audience: ITPro
author: GitPrakhar13 author: GitPrakhar13
ms.author: GitPrakhar13 ms.author: prsriva
manager: dansimp manager: dansimp
ms.collection: M365-identity-device-management ms.collection: M365-identity-device-management
ms.topic: article ms.topic: article