mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-12 21:37:22 +00:00
web sign-in
This commit is contained in:
Paolo Matarazzo
parent
5dc04c1066
commit
9749ffdb04
9
includes/configure/provisioning-package-1.md
Normal file
9
includes/configure/provisioning-package-1.md
Normal file
@ -0,0 +1,9 @@
|
||||
---
|
||||
author: paolomatarazzo
|
||||
ms.author: paoloma
|
||||
ms.date: 09/12/2023
|
||||
ms.topic: include
|
||||
ms.prod: windows-client
|
||||
---
|
||||
|
||||
Use the following settings to [create a provisioning package](../../windows/configuration/provisioning-packages/provisioning-create-package.md):
|
||||
9
includes/configure/provisioning-package-2.md
Normal file
9
includes/configure/provisioning-package-2.md
Normal file
@ -0,0 +1,9 @@
|
||||
---
|
||||
author: paolomatarazzo
|
||||
ms.author: paoloma
|
||||
ms.date: 09/12/2023
|
||||
ms.topic: include
|
||||
ms.prod: windows-client
|
||||
---
|
||||
|
||||
[Apply the provisioning package](../../windows/configuration/provisioning-packages/provisioning-apply-package.md) to the devices that you want to configure.
|
||||
@ -13,7 +13,7 @@ ms.topic: how-to
|
||||
## Overview
|
||||
|
||||
Starting in Windows 11, version 22H2 with [KB5030310][KB-1], *Windows Hello for Business passwordless* is a security policy that promotes a user experience without passwords on Microsoft Entra joined devices.\
|
||||
When the policy is enabled, certain Windows authentication scenarios don't offer the users the option to use a password, helping organizations and preparing users to gradually move away from passwords.
|
||||
When the policy is enabled, certain Windows authentication scenarios don't offer users the option to use a password, helping organizations and preparing users to gradually move away from passwords.
|
||||
|
||||
With Windows Hello for Business passwordless, users who sign in with Windows Hello or a FIDO2 security key:
|
||||
|
||||
@ -30,7 +30,7 @@ The password credential provider is hidden only for the last signed in user who
|
||||
This article explains how to enable Windows Hello for Business passwordless and describes the user experiences.
|
||||
|
||||
>[!TIP]
|
||||
> Windows Hello for Business users can achieve passwordless sign-in from the first sign-in using the Web sign-in feature. For more information about Web sign-in, see [Article to complete](https://learn.microsoft.com).
|
||||
> Windows Hello for Business users can achieve passwordless sign-in from the first sign-in using the Web sign-in feature. For more information about Web sign-in, see [Web sign-in for Windows devices](../web-sign-in/index.md).
|
||||
|
||||
## System requirements
|
||||
|
||||
@ -92,7 +92,7 @@ When Windows Hello for Business passwordless is enabled, users can't use the pas
|
||||
- User Account Control (UAC) elevation, except if a local user account is used for elevation
|
||||
|
||||
>[!NOTE]
|
||||
> RDP sign in defaults to the credential provider used during sign-in. However, a suers can select the option *Use a different account* to sign in with a password.
|
||||
> RDP sign in defaults to the credential provider used during sign-in. However, a user can select the option *Use a different account* to sign in with a password.
|
||||
>
|
||||
> *Run as different user* is not impacted by Windows Hello for Business passwordless.
|
||||
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Configure Web sign-in for Windows devices
|
||||
title: Web sign-in for Windows devices
|
||||
description: Learn how Web sign-in in Windows works and how to configure it.
|
||||
ms.date: 09/11/2023
|
||||
ms.topic: how-to
|
||||
@ -9,15 +9,15 @@ ms.collection:
|
||||
- tier1
|
||||
---
|
||||
|
||||
# Configure Web sign-in for Windows devices
|
||||
# Web sign-in for Windows devices
|
||||
|
||||
Starting in Windows 11, version 22H2 with [KB5030310][KB-1], you can enable your users to sign-in using a web experience on Microsoft Entra joined devices.
|
||||
This feature is called *Web sign-in*.\
|
||||
|
||||
Web sign in is a new sign-in experience that allows users to sign in to their Windows devices using a web browser experience, opening new sign in scenarios.
|
||||
Web sign-in is a Windows credential provider that allows users to sign in to their Windows devices using a web interface, opening new sign in scenarios.
|
||||
|
||||
>[!Note:]
|
||||
>Web sign-in was initially realeased in windows 10 for TAP-only scenarios. Windows 11 is the first version where Web sign-in capabilities are extended.
|
||||
>Web sign-in was initially realeased in Windows 10, supporting Temporary Access Pass only. Windows 11 is the first version where Web sign-in capabilities are expanded.
|
||||
|
||||
## Benefits of web sign-in
|
||||
|
||||
@ -33,11 +33,6 @@ To use web sign-in, the following prerequisites must be met:
|
||||
|
||||
## Configure web sign-in
|
||||
|
||||
You can configure federated sign-in for student assigned (1:1) devices or student shared devices:
|
||||
|
||||
- When federated sign-in is configured for **student assigned (1:1) devices**, the first user who signs in to the device with a federated identity becomes the *primary user*. The primary user is always displayed in the bottom left corner of the sign-in screen
|
||||
- When federated sign-in is configured for **student shared devices**, there's no primary user. The sign-in screen displays, by default, the last user who signed in to the device
|
||||
|
||||
To use web sign-in, your devices must be configured with different policies. Review the following instructions to configure your devices using either Microsoft Intune or a provisioning package (PPKG).
|
||||
|
||||
#### [:::image type="icon" source="../../images/icons/intune.svg"::: **Intune**](#tab/intune)
|
||||
@ -47,30 +42,30 @@ To use web sign-in, your devices must be configured with different policies. Rev
|
||||
| Category | Setting name | Value |
|
||||
|--|--|--|
|
||||
| Authentication | Enable Web Sign In | Enabled |
|
||||
| Authentication | Configure Web Sign In Allowed Urls | This setting is optional, and it contains a semicolon-separated list of domains, for example: `samlidp.clever.com;clever.com;mobile-redirector.clever.com` |
|
||||
| Authentication | Configure Webcam Access Domain Names | This setting is optional, and it should be configured if you need to use the webcam during the sign-in process. Specify the list of domains that are allowed to use the webcam during the sign-in process, separated by a semicolon. For example: `clever.com` |
|
||||
| Authentication | Configure Web Sign In Allowed Urls | This setting is optional, and it contains a semicolon-separated list of domains, for example: `idp.example.com;example.com` |
|
||||
| Authentication | Configure Webcam Access Domain Names | This setting is optional, and it should be configured if you need to use the webcam during the sign-in process. Specify the list of domains that are allowed to use the webcam during the sign-in process, separated by a semicolon. For example: `example.com` |
|
||||
|
||||
[!INCLUDE [intune-settings-catalog-2](../../../../includes/configure/intune-settings-catalog-2.md)]
|
||||
|
||||
Alternatively, you can configure devices using a [custom policy][INT-1] with the following settings:
|
||||
|
||||
| Setting |
|
||||
|--------|
|
||||
| **OMA-URI**: `./Vendor/MSFT/Policy/Config/Authentication/EnableWebSignIn`<br>**Data type**: Integer<br>**Value**: `1`|
|
||||
| **OMA-URI**: `./Vendor/MSFT/Policy/Config/Authentication/ConfigureWebSignInAllowedUrls`<br>**Data type**: String <br>**Value**: Semicolon separated list of domains, for example: `samlidp.clever.com;clever.com;mobile-redirector.clever.com`|
|
||||
| **OMA-URI**: `./Vendor/MSFT/Policy/Config/Authentication/ConfigureWebCamAccessDomainNames`<br>**Data type**: String <br>**Value**: This setting is optional, and it should be configured if you need to use the webcam during the sign-in process. Specify the list of domains that are allowed to use the webcam during the sign-in process, separated by a semicolon. For example: `clever.com`|
|
||||
| OMA-URI | More information |
|
||||
|-|-|
|
||||
| `./Vendor/MSFT/Policy/Config/Authentication/EnableWebSignIn`| [EnableWebSignIn](../../../client-management/mdm/policy-csp-authentication.md#enablewebsignin) |
|
||||
| `./Vendor/MSFT/Policy/Config/Authentication/ConfigureWebSignInAllowedUrls`|[ConfigureWebSignInAllowedUrls](../../../client-management/mdm/policy-csp-authentication.md#configurewebsigninallowedurls)|
|
||||
| `./Vendor/MSFT/Policy/Config/Authentication/ConfigureWebCamAccessDomainNames`|[ConfigureWebcamAccessDomainNames](../../../client-management/mdm/policy-csp-authentication.md#configurewebcamaccessdomainnames)|
|
||||
|
||||
#### [:::image type="icon" source="../../images/icons/provisioning-package.svg"::: **PPKG**](#tab/ppkg)
|
||||
|
||||
To configure web sign-in using a provisioning package, use the following settings:
|
||||
[!INCLUDE [provisioning-package-1](../../../../includes/configure/provisioning-package-1.md)]
|
||||
|
||||
| Setting |
|
||||
|--------|
|
||||
| <li> Path: **`Policies/Authentication/EnableWebSignIn`**<br>Value: **Enabled**|
|
||||
| <li> Path: **`Policies/Authentication/ConfigureWebSignInAllowedUrls`**<br>Value: Semicolon separated list of domains, for example: **`samlidp.clever.com;clever.com;mobile-redirector.clever.com`**|
|
||||
| <li> Path: **`Policies/Authentication/ConfigureWebCamAccessDomainNames`**<br>Value: This setting is optional, and it should be configured if you need to use the webcam during the sign-in process. Specify the list of domains that are allowed to use the webcam during the sign-in process, separated by a semicolon. For example: **`clever.com`**|
|
||||
| Path | Setting name | Value |
|
||||
|--|--|--|
|
||||
| `Policies/Authentication` | `EnableWebSignIn` | Enabled |
|
||||
| `Policies/Authentication` | `ConfigureWebSignInAllowedUrls` | This setting is optional, and it contains a semicolon-separated list of domains, for example: `idp.example.com;example.com` |
|
||||
| `Policies/Authentication` | `ConfigureWebCamAccessDomainNames` | This setting is optional, and it should be configured if you need to use the webcam during the sign-in process. Specify the list of domains that are allowed to use the webcam during the sign-in process, separated by a semicolon. For example: `example.com` |
|
||||
|
||||
Apply the provisioning package to the shared devices that require web sign-in.
|
||||
[!INCLUDE [provisioning-package-2](../../../../includes/configure/provisioning-package-2.md)]
|
||||
|
||||
---
|
||||
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user