deepblue/windows-itpro-docs
1
0
Fork 0
mirror of https://github.com/MicrosoftDocs/windows-itpro-docs.git synced 2025-05-12 21:37:22 +00:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

web sign-in

Browse Source
This commit is contained in:
Paolo Matarazzo 2023-09-12 09:46:14 -04:00
parent 5dc04c1066
commit 9749ffdb04
4 changed files with 39 additions and 26 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
includes/configure/provisioning-package-1.md Normal file
View File

@ -0,0 +1,9 @@
---
author: paolomatarazzo
ms.author: paoloma
ms.date: 09/12/2023
ms.topic: include
ms.prod: windows-client
---
Use the following settings to [create a provisioning package](../../windows/configuration/provisioning-packages/provisioning-create-package.md):

9
includes/configure/provisioning-package-2.md Normal file
View File

@ -0,0 +1,9 @@
---
author: paolomatarazzo
ms.author: paoloma
ms.date: 09/12/2023
ms.topic: include
ms.prod: windows-client
---
[Apply the provisioning package](../../windows/configuration/provisioning-packages/provisioning-apply-package.md) to the devices that you want to configure.

6
windows/security/identity-protection/hello-for-business/passwordless.md
View File

@ -13,7 +13,7 @@ ms.topic: how-to
## Overview ## Overview
Starting in Windows 11, version 22H2 with [KB5030310][KB-1], *Windows Hello for Business passwordless* is a security policy that promotes a user experience without passwords on Microsoft Entra joined devices.\ Starting in Windows 11, version 22H2 with [KB5030310][KB-1], *Windows Hello for Business passwordless* is a security policy that promotes a user experience without passwords on Microsoft Entra joined devices.\
When the policy is enabled, certain Windows authentication scenarios don't offer the users the option to use a password, helping organizations and preparing users to gradually move away from passwords. When the policy is enabled, certain Windows authentication scenarios don't offer users the option to use a password, helping organizations and preparing users to gradually move away from passwords.
With Windows Hello for Business passwordless, users who sign in with Windows Hello or a FIDO2 security key: With Windows Hello for Business passwordless, users who sign in with Windows Hello or a FIDO2 security key:
@ -30,7 +30,7 @@ The password credential provider is hidden only for the last signed in user who
This article explains how to enable Windows Hello for Business passwordless and describes the user experiences. This article explains how to enable Windows Hello for Business passwordless and describes the user experiences.
>[!TIP] >[!TIP]
> Windows Hello for Business users can achieve passwordless sign-in from the first sign-in using the Web sign-in feature. For more information about Web sign-in, see [Article to complete](https://learn.microsoft.com). > Windows Hello for Business users can achieve passwordless sign-in from the first sign-in using the Web sign-in feature. For more information about Web sign-in, see [Web sign-in for Windows devices](../web-sign-in/index.md).
## System requirements ## System requirements
@ -92,7 +92,7 @@ When Windows Hello for Business passwordless is enabled, users can't use the pas
- User Account Control (UAC) elevation, except if a local user account is used for elevation - User Account Control (UAC) elevation, except if a local user account is used for elevation
>[!NOTE] >[!NOTE]
> RDP sign in defaults to the credential provider used during sign-in. However, a suers can select the option *Use a different account* to sign in with a password. > RDP sign in defaults to the credential provider used during sign-in. However, a user can select the option *Use a different account* to sign in with a password.
> >
> *Run as different user* is not impacted by Windows Hello for Business passwordless. > *Run as different user* is not impacted by Windows Hello for Business passwordless.

41
windows/security/identity-protection/web-sign-in/index.md
View File

@ -1,5 +1,5 @@
--- ---
title: Configure Web sign-in for Windows devices title: Web sign-in for Windows devices
description: Learn how Web sign-in in Windows works and how to configure it. description: Learn how Web sign-in in Windows works and how to configure it.
ms.date: 09/11/2023 ms.date: 09/11/2023
ms.topic: how-to ms.topic: how-to
@ -9,15 +9,15 @@ ms.collection:
- tier1 - tier1
--- ---
# Configure Web sign-in for Windows devices # Web sign-in for Windows devices
Starting in Windows 11, version 22H2 with [KB5030310][KB-1], you can enable your users to sign-in using a web experience on Microsoft Entra joined devices. Starting in Windows 11, version 22H2 with [KB5030310][KB-1], you can enable your users to sign-in using a web experience on Microsoft Entra joined devices.
This feature is called *Web sign-in*.\ This feature is called *Web sign-in*.\
Web sign in is a new sign-in experience that allows users to sign in to their Windows devices using a web browser experience, opening new sign in scenarios. Web sign-in is a Windows credential provider that allows users to sign in to their Windows devices using a web interface, opening new sign in scenarios.
>[!Note:] >[!Note:]
>Web sign-in was initially realeased in windows 10 for TAP-only scenarios. Windows 11 is the first version where Web sign-in capabilities are extended. >Web sign-in was initially realeased in Windows 10, supporting Temporary Access Pass only. Windows 11 is the first version where Web sign-in capabilities are expanded.
## Benefits of web sign-in ## Benefits of web sign-in
@ -33,11 +33,6 @@ To use web sign-in, the following prerequisites must be met:
## Configure web sign-in ## Configure web sign-in
You can configure federated sign-in for student assigned (1:1) devices or student shared devices:
- When federated sign-in is configured for **student assigned (1:1) devices**, the first user who signs in to the device with a federated identity becomes the *primary user*. The primary user is always displayed in the bottom left corner of the sign-in screen
- When federated sign-in is configured for **student shared devices**, there's no primary user. The sign-in screen displays, by default, the last user who signed in to the device
To use web sign-in, your devices must be configured with different policies. Review the following instructions to configure your devices using either Microsoft Intune or a provisioning package (PPKG). To use web sign-in, your devices must be configured with different policies. Review the following instructions to configure your devices using either Microsoft Intune or a provisioning package (PPKG).
#### [:::image type="icon" source="../../images/icons/intune.svg"::: **Intune**](#tab/intune) #### [:::image type="icon" source="../../images/icons/intune.svg"::: **Intune**](#tab/intune)
@ -47,30 +42,30 @@ To use web sign-in, your devices must be configured with different policies. Rev
| Category | Setting name | Value | | Category | Setting name | Value |
|--|--|--| |--|--|--|
| Authentication | Enable Web Sign In | Enabled | | Authentication | Enable Web Sign In | Enabled |
| Authentication | Configure Web Sign In Allowed Urls | This setting is optional, and it contains a semicolon-separated list of domains, for example: `samlidp.clever.com;clever.com;mobile-redirector.clever.com` | | Authentication | Configure Web Sign In Allowed Urls | This setting is optional, and it contains a semicolon-separated list of domains, for example: `idp.example.com;example.com` |
| Authentication | Configure Webcam Access Domain Names | This setting is optional, and it should be configured if you need to use the webcam during the sign-in process. Specify the list of domains that are allowed to use the webcam during the sign-in process, separated by a semicolon. For example: `clever.com` | | Authentication | Configure Webcam Access Domain Names | This setting is optional, and it should be configured if you need to use the webcam during the sign-in process. Specify the list of domains that are allowed to use the webcam during the sign-in process, separated by a semicolon. For example: `example.com` |
[!INCLUDE [intune-settings-catalog-2](../../../../includes/configure/intune-settings-catalog-2.md)] [!INCLUDE [intune-settings-catalog-2](../../../../includes/configure/intune-settings-catalog-2.md)]
Alternatively, you can configure devices using a [custom policy][INT-1] with the following settings: Alternatively, you can configure devices using a [custom policy][INT-1] with the following settings:
| Setting | | OMA-URI | More information |
|--------| |-|-|
| **OMA-URI**: `./Vendor/MSFT/Policy/Config/Authentication/EnableWebSignIn`<br>**Data type**: Integer<br>**Value**: `1`| | `./Vendor/MSFT/Policy/Config/Authentication/EnableWebSignIn`| [EnableWebSignIn](../../../client-management/mdm/policy-csp-authentication.md#enablewebsignin) |
| **OMA-URI**: `./Vendor/MSFT/Policy/Config/Authentication/ConfigureWebSignInAllowedUrls`<br>**Data type**: String <br>**Value**: Semicolon separated list of domains, for example: `samlidp.clever.com;clever.com;mobile-redirector.clever.com`| | `./Vendor/MSFT/Policy/Config/Authentication/ConfigureWebSignInAllowedUrls`|[ConfigureWebSignInAllowedUrls](../../../client-management/mdm/policy-csp-authentication.md#configurewebsigninallowedurls)|
| **OMA-URI**: `./Vendor/MSFT/Policy/Config/Authentication/ConfigureWebCamAccessDomainNames`<br>**Data type**: String <br>**Value**: This setting is optional, and it should be configured if you need to use the webcam during the sign-in process. Specify the list of domains that are allowed to use the webcam during the sign-in process, separated by a semicolon. For example: `clever.com`| | `./Vendor/MSFT/Policy/Config/Authentication/ConfigureWebCamAccessDomainNames`|[ConfigureWebcamAccessDomainNames](../../../client-management/mdm/policy-csp-authentication.md#configurewebcamaccessdomainnames)|
#### [:::image type="icon" source="../../images/icons/provisioning-package.svg"::: **PPKG**](#tab/ppkg) #### [:::image type="icon" source="../../images/icons/provisioning-package.svg"::: **PPKG**](#tab/ppkg)
To configure web sign-in using a provisioning package, use the following settings: [!INCLUDE [provisioning-package-1](../../../../includes/configure/provisioning-package-1.md)]
| Setting | | Path | Setting name | Value |
|--------| |--|--|--|
| <li> Path: **`Policies/Authentication/EnableWebSignIn`**<br>Value: **Enabled**| | `Policies/Authentication` | `EnableWebSignIn` | Enabled |
| <li> Path: **`Policies/Authentication/ConfigureWebSignInAllowedUrls`**<br>Value: Semicolon separated list of domains, for example: **`samlidp.clever.com;clever.com;mobile-redirector.clever.com`**| | `Policies/Authentication` | `ConfigureWebSignInAllowedUrls` | This setting is optional, and it contains a semicolon-separated list of domains, for example: `idp.example.com;example.com` |
| <li> Path: **`Policies/Authentication/ConfigureWebCamAccessDomainNames`**<br>Value: This setting is optional, and it should be configured if you need to use the webcam during the sign-in process. Specify the list of domains that are allowed to use the webcam during the sign-in process, separated by a semicolon. For example: **`clever.com`**| | `Policies/Authentication` | `ConfigureWebCamAccessDomainNames` | This setting is optional, and it should be configured if you need to use the webcam during the sign-in process. Specify the list of domains that are allowed to use the webcam during the sign-in process, separated by a semicolon. For example: `example.com` |
Apply the provisioning package to the shared devices that require web sign-in. [!INCLUDE [provisioning-package-2](../../../../includes/configure/provisioning-package-2.md)]
--- ---