diff --git a/windows/security/identity-protection/hello-for-business/WebAuthnAPIs.md b/windows/security/identity-protection/hello-for-business/WebAuthnAPIs.md index 92e56d01b5..d71ef1fd5a 100644 --- a/windows/security/identity-protection/hello-for-business/WebAuthnAPIs.md +++ b/windows/security/identity-protection/hello-for-business/WebAuthnAPIs.md @@ -6,8 +6,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: GitPrakhar13 manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -15,17 +15,17 @@ localizationpriority: medium ms.date: 02/15/2019 ms.reviewer: --- -# WebAuthn APIs for password-less authentication on Windows - +# WebAuthn APIs for password-less authentication on Windows ### Passwords leave your customers vulnerable. With the new WebAuthn APIs, your sites and apps can use password-less authentication. Microsoft has long been a proponent to do away with passwords. While working towards that goal, we'd like to introduce you to the latest Windows 10 (version 1903) W3C/FIDO2 Win32 WebAuthn platform APIs! These APIs allow Microsoft developer partners and the developer community to use Windows Hello and FIDO2 security keys -as a password-less authentication mechanism for their applications on Windows devices. +as a password-less authentication mechanism for their applications on Windows devices. #### What does this mean? + This opens opportunities for developers or relying parties (RPs') to enable password-less authentication. They can now use [Windows Hello](./index.yml) or [FIDO2 Security Keys](./microsoft-compatible-security-key.md) as a password-less multi-factor credential for authentication. @@ -39,7 +39,8 @@ The native Windows 10 WebAuthn APIs are currently supported by Microsoft Edge on Developers of FIDO2 authentication keys should use the new Windows 10 APIs, to enable these scenarios in a consistent way for users. Moreover, this enables the use of all the transports available per FIDO2 specifications - USB, NFC, and BLE without having to deal with the interaction and management overhead. -This also implies browsers or apps on Windows 10 will no longer have direct access to above transports for FIDO-related messaging. +This also implies browsers or apps on Windows 10 will no longer have direct access to above transports for FIDO-related messaging. #### Where can developers learn more? -The new Windows 10 APIs are documented on [GitHub](https://github.com/Microsoft/webauthn) \ No newline at end of file + +The new Windows 10 APIs are documented on [GitHub](https://github.com/Microsoft/webauthn) diff --git a/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md b/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md index f208a8b623..f0e6aca970 100644 --- a/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md +++ b/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: GitPrakhar13 manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/hello-aad-join-cloud-only-deploy.md b/windows/security/identity-protection/hello-for-business/hello-aad-join-cloud-only-deploy.md index a645f56f3b..dbcde35a83 100644 --- a/windows/security/identity-protection/hello-for-business/hello-aad-join-cloud-only-deploy.md +++ b/windows/security/identity-protection/hello-for-business/hello-aad-join-cloud-only-deploy.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: GitPrakhar13 manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/hello-adequate-domain-controllers.md b/windows/security/identity-protection/hello-for-business/hello-adequate-domain-controllers.md index a7761bfd94..2bc957ad18 100644 --- a/windows/security/identity-protection/hello-for-business/hello-adequate-domain-controllers.md +++ b/windows/security/identity-protection/hello-for-business/hello-adequate-domain-controllers.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: GitPrakhar13 manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/hello-and-password-changes.md b/windows/security/identity-protection/hello-for-business/hello-and-password-changes.md index 44dc96c2b7..ad4155307d 100644 --- a/windows/security/identity-protection/hello-for-business/hello-and-password-changes.md +++ b/windows/security/identity-protection/hello-for-business/hello-and-password-changes.md @@ -8,8 +8,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: GitPrakhar13 manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/hello-biometrics-in-enterprise.md b/windows/security/identity-protection/hello-for-business/hello-biometrics-in-enterprise.md index e6b66a231d..b78321c716 100644 --- a/windows/security/identity-protection/hello-for-business/hello-biometrics-in-enterprise.md +++ b/windows/security/identity-protection/hello-for-business/hello-biometrics-in-enterprise.md @@ -8,8 +8,8 @@ ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: GitPrakhar13 manager: dansimp ms.collection: - M365-identity-device-management diff --git a/windows/security/identity-protection/hello-for-business/hello-cert-trust-adfs.md b/windows/security/identity-protection/hello-for-business/hello-cert-trust-adfs.md index 78a031e4af..15327a70a2 100644 --- a/windows/security/identity-protection/hello-for-business/hello-cert-trust-adfs.md +++ b/windows/security/identity-protection/hello-for-business/hello-cert-trust-adfs.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: GitPrakhar13 manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/hello-cert-trust-policy-settings.md b/windows/security/identity-protection/hello-for-business/hello-cert-trust-policy-settings.md index 8fecc4d5ee..3185a23a0d 100644 --- a/windows/security/identity-protection/hello-for-business/hello-cert-trust-policy-settings.md +++ b/windows/security/identity-protection/hello-for-business/hello-cert-trust-policy-settings.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: GitPrakhar13 manager: dansimp ms.collection: - M365-identity-device-management diff --git a/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-ad-prereq.md b/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-ad-prereq.md index e89eef978c..0641e2b351 100644 --- a/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-ad-prereq.md +++ b/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-ad-prereq.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: GitPrakhar13 manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-deploy-mfa.md b/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-deploy-mfa.md index 2cd3770d1b..5db3d2ab93 100644 --- a/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-deploy-mfa.md +++ b/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-deploy-mfa.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: GitPrakhar13 manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-pki.md b/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-pki.md index 366ce9b8bb..4f2c2c7bb1 100644 --- a/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-pki.md +++ b/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-pki.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: GitPrakhar13 manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/hello-deployment-cert-trust.md b/windows/security/identity-protection/hello-for-business/hello-deployment-cert-trust.md index f802872ce7..58b48a30c5 100644 --- a/windows/security/identity-protection/hello-for-business/hello-deployment-cert-trust.md +++ b/windows/security/identity-protection/hello-for-business/hello-deployment-cert-trust.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: GitPrakhar13 manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/hello-deployment-guide.md b/windows/security/identity-protection/hello-for-business/hello-deployment-guide.md index c04d24c0e6..2f607d99e9 100644 --- a/windows/security/identity-protection/hello-for-business/hello-deployment-guide.md +++ b/windows/security/identity-protection/hello-for-business/hello-deployment-guide.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: GitPrakhar13 manager: dansimp ms.collection: - M365-identity-device-management diff --git a/windows/security/identity-protection/hello-for-business/hello-deployment-issues.md b/windows/security/identity-protection/hello-for-business/hello-deployment-issues.md index 41f1a39158..b967f71d50 100644 --- a/windows/security/identity-protection/hello-for-business/hello-deployment-issues.md +++ b/windows/security/identity-protection/hello-for-business/hello-deployment-issues.md @@ -8,8 +8,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: GitPrakhar13 manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/hello-deployment-key-trust.md b/windows/security/identity-protection/hello-for-business/hello-deployment-key-trust.md index 5a525a6f6a..217e151cb2 100644 --- a/windows/security/identity-protection/hello-for-business/hello-deployment-key-trust.md +++ b/windows/security/identity-protection/hello-for-business/hello-deployment-key-trust.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: GitPrakhar13 manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -19,29 +19,18 @@ ms.reviewer: # On Premises Key Trust Deployment **Applies to** -- Windows 10, version 1703 or later -- Windows 11 -- On-premises deployment -- Key trust +- Windows 10, version 1703 or later +- Windows 11 +- On-premises deployment +- Key trust Windows Hello for Business replaces username and password sign-in to Windows with strong user authentication based on asymmetric key pair. The following deployment guide provides the information needed to successfully deploy Windows Hello for Business in an existing environment. Below, you can find all the information you need to deploy Windows Hello for Business in a key trust model in your on-premises environment: + 1. [Validate Active Directory prerequisites](hello-key-trust-validate-ad-prereq.md) 2. [Validate and Configure Public Key Infrastructure](hello-key-trust-validate-pki.md) 3. [Prepare and Deploy Windows Server 2016 Active Directory Federation Services](hello-key-trust-adfs.md) 4. [Validate and Deploy Multifactor Authentication Services (MFA)](hello-key-trust-validate-deploy-mfa.md) 5. [Configure Windows Hello for Business Policy settings](hello-key-trust-policy-settings.md) - - - - - - - - - - - - diff --git a/windows/security/identity-protection/hello-for-business/hello-deployment-rdp-certs.md b/windows/security/identity-protection/hello-for-business/hello-deployment-rdp-certs.md index ec0411f5bd..6174bf55f1 100644 --- a/windows/security/identity-protection/hello-for-business/hello-deployment-rdp-certs.md +++ b/windows/security/identity-protection/hello-for-business/hello-deployment-rdp-certs.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: GitPrakhar13 manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation.md b/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation.md index e5e4fe1324..10321d22a4 100644 --- a/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation.md +++ b/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation.md @@ -8,8 +8,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: GitPrakhar13 manager: dansimp ms.collection: - M365-identity-device-management diff --git a/windows/security/identity-protection/hello-for-business/hello-event-300.md b/windows/security/identity-protection/hello-for-business/hello-event-300.md index 5eecb9ecac..be7eb5e14a 100644 --- a/windows/security/identity-protection/hello-for-business/hello-event-300.md +++ b/windows/security/identity-protection/hello-for-business/hello-event-300.md @@ -9,8 +9,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: GitPrakhar13 manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/hello-faq.yml b/windows/security/identity-protection/hello-for-business/hello-faq.yml index 66e88ee1a6..75863201f5 100644 --- a/windows/security/identity-protection/hello-for-business/hello-faq.yml +++ b/windows/security/identity-protection/hello-for-business/hello-faq.yml @@ -8,8 +8,8 @@ metadata: ms.sitesec: library ms.pagetype: security, mobile audience: ITPro - author: mapalko - ms.author: mapalko + author: GitPrakhar13 + ms.author: GitPrakhar13 manager: dansimp ms.collection: - M365-identity-device-management diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-conditional-access.md b/windows/security/identity-protection/hello-for-business/hello-feature-conditional-access.md index ebd49da74d..59dc0697ba 100644 --- a/windows/security/identity-protection/hello-for-business/hello-feature-conditional-access.md +++ b/windows/security/identity-protection/hello-for-business/hello-feature-conditional-access.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: GitPrakhar13 manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-dual-enrollment.md b/windows/security/identity-protection/hello-for-business/hello-feature-dual-enrollment.md index c1051280eb..2ff9c6e78b 100644 --- a/windows/security/identity-protection/hello-for-business/hello-feature-dual-enrollment.md +++ b/windows/security/identity-protection/hello-for-business/hello-feature-dual-enrollment.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: GitPrakhar13 manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-dynamic-lock.md b/windows/security/identity-protection/hello-for-business/hello-feature-dynamic-lock.md index b7a04269f4..9721fe35b0 100644 --- a/windows/security/identity-protection/hello-for-business/hello-feature-dynamic-lock.md +++ b/windows/security/identity-protection/hello-for-business/hello-feature-dynamic-lock.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: GitPrakhar13 manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md index 49ebf32dd9..987a36d824 100644 --- a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md +++ b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: GitPrakhar13 manager: dansimp ms.collection: - M365-identity-device-management diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-remote-desktop.md b/windows/security/identity-protection/hello-for-business/hello-feature-remote-desktop.md index 3b8be4415e..ef7d1721ad 100644 --- a/windows/security/identity-protection/hello-for-business/hello-feature-remote-desktop.md +++ b/windows/security/identity-protection/hello-for-business/hello-feature-remote-desktop.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: GitPrakhar13 manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/hello-how-it-works-authentication.md b/windows/security/identity-protection/hello-for-business/hello-how-it-works-authentication.md index a0afa94e49..b82afe3c1d 100644 --- a/windows/security/identity-protection/hello-for-business/hello-how-it-works-authentication.md +++ b/windows/security/identity-protection/hello-for-business/hello-how-it-works-authentication.md @@ -6,8 +6,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: GitPrakhar13 manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/hello-how-it-works-provisioning.md b/windows/security/identity-protection/hello-for-business/hello-how-it-works-provisioning.md index 521b4364a4..219e93788f 100644 --- a/windows/security/identity-protection/hello-for-business/hello-how-it-works-provisioning.md +++ b/windows/security/identity-protection/hello-for-business/hello-how-it-works-provisioning.md @@ -6,8 +6,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: GitPrakhar13 manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/hello-how-it-works-technology.md b/windows/security/identity-protection/hello-for-business/hello-how-it-works-technology.md index 4bdde9ea88..bbfb502c02 100644 --- a/windows/security/identity-protection/hello-for-business/hello-how-it-works-technology.md +++ b/windows/security/identity-protection/hello-for-business/hello-how-it-works-technology.md @@ -6,8 +6,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: GitPrakhar13 manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/hello-how-it-works.md b/windows/security/identity-protection/hello-for-business/hello-how-it-works.md index 90514e334a..dd6b26cb7e 100644 --- a/windows/security/identity-protection/hello-for-business/hello-how-it-works.md +++ b/windows/security/identity-protection/hello-for-business/hello-how-it-works.md @@ -6,8 +6,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: GitPrakhar13 manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-base.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-base.md index 4176bd6721..19dc6646a1 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-base.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-base.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: GitPrakhar13 manager: dansimp ms.collection: - M365-identity-device-management diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md index b7b190c49c..070df10d93 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: GitPrakhar13 manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso.md index c74516519b..8a7e0fa4c3 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: GitPrakhar13 manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -19,13 +19,14 @@ ms.reviewer: # Azure AD Join Single Sign-on Deployment **Applies to** -- Windows 10 -- Windows 11 -- Azure Active Directory joined -- Hybrid deployment + +- Windows 10 +- Windows 11 +- Azure Active Directory joined +- Hybrid deployment Windows Hello for Business combined with Azure Active Directory joined devices makes it easy for users to securely access cloud-based resources using a strong, two-factor credential. Some resources may remain on-premises as enterprises transition resources to the cloud and Azure AD joined devices may need to access these resources. With additional configurations to your current hybrid deployment, you can provide single sign-on to your on-premises resources for Azure Active Directory joined devices using Windows Hello for Business, using a key or a certificate. - + ## Key vs. Certificate Enterprises can use either a key or a certificate to provide single-sign on for on-premises resources. Both types of authentication provide the same security; one is not more secure than the other. diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-new-install.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-new-install.md index 05d4a7b317..34007dd8f6 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-new-install.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-new-install.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: GitPrakhar13 manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -19,25 +19,25 @@ ms.reviewer: # Hybrid Azure AD joined Windows Hello for Business Certificate Trust New Installation **Applies to** -- Windows 10, version 1703 or later -- Windows 11 -- Hybrid deployment -- Certificate trust +- Windows 10, version 1703 or later +- Windows 11 +- Hybrid deployment +- Certificate trust Windows Hello for Business involves configuring distributed technologies that may or may not exist in your current infrastructure. Hybrid certificate trust deployments of Windows Hello for Business rely on these technologies -* [Active Directory](#active-directory) -* [Public Key Infrastructure](#public-key-infrastructure) -* [Azure Active Directory](#azure-active-directory) -* [Multifactor Authentication Services](#multifactor-authentication-services) - +- [Active Directory](#active-directory) +- [Public Key Infrastructure](#public-key-infrastructure) +- [Azure Active Directory](#azure-active-directory) +- [Multifactor Authentication Services](#multifactor-authentication-services) New installations are considerably more involved than existing implementations because you are building the entire infrastructure. Microsoft recommends you review the new installation baseline to validate your existing environment has all the needed configurations to support your hybrid certificate trust Windows Hello for Business deployment. If your environment meets these needs, you can read the [Configure Azure Device Registration](hello-hybrid-cert-trust-devreg.md) section to prepare your Windows Hello for Business deployment by configuring Azure device registration. The new installation baseline begins with a basic Active Directory deployment and enterprise PKI. This document expects you have Active Directory deployed using Windows Server 2008 R2 or later domain controllers. ## Active Directory ## + Production environments should follow Active Directory best practices regarding the number and placement of domain controllers to ensure adequate authentication throughout the organization. Lab environments and isolated proof of concepts may want to limit the number of domain controllers. The purpose of these environments is to experiment and learn. Reducing the number of domain controllers can prevent troubleshooting issue, such as Active Directory replication, which is unrelated to activity's goal. diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-devreg.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-devreg.md index 2bae50c063..24ace5b26a 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-devreg.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-devreg.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: GitPrakhar13 manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -19,10 +19,11 @@ ms.reviewer: # Configure Device Registration for Hybrid Azure AD joined Windows Hello for Business **Applies to** -- Windows 10, version 1703 or later -- Windows 11 -- Hybrid deployment -- Certificate trust + +- Windows 10, version 1703 or later +- Windows 11 +- Hybrid deployment +- Certificate trust Your environment is federated and you are ready to configure device registration for your hybrid environment. Hybrid Windows Hello for Business deployment needs device registration and device write-back to enable proper device authentication. diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-prereqs.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-prereqs.md index edf8fab283..e5006ebcaa 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-prereqs.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-prereqs.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: GitPrakhar13 manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust.md index b9a5fcd43e..14ba0196f1 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: GitPrakhar13 manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -19,24 +19,26 @@ ms.reviewer: # Hybrid Azure AD joined Certificate Trust Deployment **Applies to** -- Windows 10, version 1703 or later -- Windows 11 -- Hybrid deployment -- Certificate trust - +- Windows 10, version 1703 or later +- Windows 11 +- Hybrid deployment +- Certificate trust + Windows Hello for Business replaces username and password sign-in to Windows with strong user authentication based on asymmetric key pair. The following deployment guide provides the information needed to successfully deploy Windows Hello for Business in a hybrid certificate trust scenario. It is recommended that you review the Windows Hello for Business planning guide prior to using the deployment guide. The planning guide helps you make decisions by explaining the available options with each aspect of the deployment and explains the potential outcomes based on each of these decisions. You can review the [planning guide](/windows/access-protection/hello-for-business/hello-planning-guide) and download the [planning worksheet](https://go.microsoft.com/fwlink/?linkid=852514). This deployment guide provides guidance for new deployments and customers who are already federated with Office 365. These two scenarios provide a baseline from which you can begin your deployment. -## New Deployment Baseline ## +## New Deployment Baseline + The new deployment baseline helps organizations who are moving to Azure and Office 365 to include Windows Hello for Business as part of their deployments. This baseline is good for organizations who are looking to deploy proof of concepts as well as IT professionals who want to familiarize themselves Windows Hello for Business by deploying a lab environment. - + This baseline provides detailed procedures to move your environment from an on-premises only environment to a hybrid environment using Windows Hello for Business to authenticate to Azure Active Directory and to your on-premises Active Directory using a single Windows sign-in. - -## Federated Baseline ## + +## Federated Baseline + The federated baseline helps organizations that have completed their federation with Azure Active Directory and Office 365 and enables them to introduce Windows Hello for Business into their hybrid environment. This baseline exclusively focuses on the procedures needed to add Azure Device Registration and Windows Hello for Business to an existing hybrid deployment. Regardless of the baseline you choose, your next step is to familiarize yourself with the prerequisites needed for the deployment. Many of the prerequisites will be new for organizations and individuals pursuing the new deployment baseline. Organizations and individuals starting from the federated baseline will likely be familiar with most of the prerequisites, but should validate they are using the proper versions that include the latest updates. @@ -49,6 +51,7 @@ Regardless of the baseline you choose, your next step is to familiarize yourself
## Follow the Windows Hello for Business hybrid certificate trust deployment guide + 1. Overview (*You are here*) 2. [Prerequisites](hello-hybrid-cert-trust-prereqs.md) 3. [New Installation Baseline](hello-hybrid-cert-new-install.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-provision.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-provision.md index ed3ad19d9d..067d7c0cad 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-provision.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-provision.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: GitPrakhar13 manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -60,7 +60,7 @@ The remainder of the provisioning includes Windows Hello for Business requesting > The minimum time needed to synchronize the user's public key from Azure Active Directory to the on-premises Active Directory is 30 minutes. The Azure AD Connect scheduler controls the synchronization interval. > **This synchronization latency delays the user's ability to authenticate and use on-premises resources until the user's public key has synchronized to Active Directory.** Once synchronized, the user can authenticate and use on-premises resources. > Read [Azure AD Connect sync: Scheduler](/azure/active-directory/connect/active-directory-aadconnectsync-feature-scheduler) to view and adjust the **synchronization cycle** for your organization. -> +> > [!NOTE] > Windows Server 2016 update [KB4088889 (14393.2155)](https://support.microsoft.com/help/4088889) provides synchronous certificate enrollment during hybrid certificate trust provisioning. With this update, users no longer need to wait for Azure AD Connect to sync their public key on-premises. Users enroll their certificate during provisioning and can use the certificate for sign-in immediately after completing the provisioning. The update needs to be installed on the federation servers. diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-adfs.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-adfs.md index 2a5517fe70..8c0059c5c7 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-adfs.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-adfs.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: GitPrakhar13 manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-dir-sync.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-dir-sync.md index 681c874730..13d9858051 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-dir-sync.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-dir-sync.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: GitPrakhar13 manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -20,12 +20,12 @@ ms.reviewer: # Configure Hybrid Azure AD joined Windows Hello for Business- Directory Synchronization **Applies to** + - Windows 10, version 1703 or later - Windows 11 - Hybrid deployment - Certificate Trust - ## Directory Synchronization In hybrid deployments, users register the public portion of their Windows Hello for Business credential with Azure. Azure AD Connect synchronizes the Windows Hello for Business public key to Active Directory. diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-pki.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-pki.md index fc322a0194..1e26c79def 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-pki.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-pki.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: GitPrakhar13 manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-policy.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-policy.md index 632f6ebf3c..38c435c790 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-policy.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-policy.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: GitPrakhar13 manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -19,11 +19,11 @@ ms.reviewer: # Configure Hybrid Azure AD joined Windows Hello for Business - Group Policy **Applies to** -- Windows 10, version 1703 or later -- Windows 11 -- Hybrid deployment -- Certificate trust +- Windows 10, version 1703 or later +- Windows 11 +- Hybrid deployment +- Certificate trust ## Policy Configuration @@ -35,9 +35,10 @@ Alternatively, you can create copy the .ADMX and .ADML files from a Windows 10 C Domain controllers of Windows Hello for Business deployments need one Group Policy setting, which enables automatic certificate enrollment for the newly create domain controller authentication certificate. This policy setting ensures domain controllers (new and existing) automatically request and renew the correct domain controller certificate. Domain joined clients of hybrid certificate-based deployments of Windows Hello for Business needs three Group Policy settings: -* Enable Windows Hello for Business -* Use certificate for on-premises authentication -* Enable automatic enrollment of certificates + +- Enable Windows Hello for Business +- Use certificate for on-premises authentication +- Enable automatic enrollment of certificates ### Configure Domain Controllers for Automatic Certificate Enrollment diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings.md index 498f54f10a..5cf1466b7e 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: GitPrakhar13 manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -19,21 +19,22 @@ ms.reviewer: # Configure Hybrid Azure AD joined Windows Hello for Business **Applies to** -- Windows 10, version 1703 or later -- Windows 11 -- Hybrid deployment -- Certificate trust - +- Windows 10, version 1703 or later +- Windows 11 +- Hybrid deployment +- Certificate trust + Your environment is federated and you are ready to configure your hybrid environment for Windows Hello for business using the certificate trust model. > [!IMPORTANT] > If your environment is not federated, review the [New Installation baseline](hello-hybrid-cert-new-install.md) section of this deployment document to learn how to federate your environment for your Windows Hello for Business deployment. The configuration for Windows Hello for Business is grouped in four categories. These categories are: -* [Active Directory](hello-hybrid-cert-whfb-settings-ad.md) -* [Public Key Infrastructure](hello-hybrid-cert-whfb-settings-pki.md) -* [Active Directory Federation Services](hello-hybrid-cert-whfb-settings-adfs.md) -* [Group Policy](hello-hybrid-cert-whfb-settings-policy.md) + +- [Active Directory](hello-hybrid-cert-whfb-settings-ad.md) +- [Public Key Infrastructure](hello-hybrid-cert-whfb-settings-pki.md) +- [Active Directory Federation Services](hello-hybrid-cert-whfb-settings-adfs.md) +- [Group Policy](hello-hybrid-cert-whfb-settings-policy.md) For the most efficient deployment, configure these technologies in order beginning with the Active Directory configuration diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-new-install.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-new-install.md index 00829103e4..195a7a41cb 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-new-install.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-new-install.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: GitPrakhar13 manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -19,19 +19,19 @@ ms.reviewer: # Windows Hello for Business Hybrid Azure AD joined Key Trust New Installation **Applies to** -- Windows 10, version 1703 or later -- Windows 11 -- Hybrid deployment -- Key trust + +- Windows 10, version 1703 or later +- Windows 11 +- Hybrid deployment +- Key trust Windows Hello for Business involves configuring distributed technologies that may or may not exist in your current infrastructure. Hybrid key trust deployments of Windows Hello for Business rely on these technologies -* [Active Directory](#active-directory) -* [Public Key Infrastructure](#public-key-infrastructure) -* [Azure Active Directory](#azure-active-directory) -* [Multifactor Authentication Services](#multifactor-authentication-services) - +- [Active Directory](#active-directory) +- [Public Key Infrastructure](#public-key-infrastructure) +- [Azure Active Directory](#azure-active-directory) +- [Multifactor Authentication Services](#multifactor-authentication-services) New installations are considerably more involved than existing implementations because you are building the entire infrastructure. Microsoft recommends you review the new installation baseline to validate your existing environment has all the needed configurations to support your hybrid certificate trust Windows Hello for Business deployment. If your environment meets these needs, you can read the [Configure Directory Synchronization](hello-hybrid-key-trust-dirsync.md) section to prepare your Windows Hello for Business deployment by configuring directory synchronization. diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-devreg.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-devreg.md index 3a30549629..243a75c718 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-devreg.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-devreg.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: GitPrakhar13 manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -19,13 +19,13 @@ ms.reviewer: # Configure Device Registration for Hybrid Azure AD joined key trust Windows Hello for Business **Applies to** -- Windows 10, version 1703 or later -- Windows 11 -- Hybrid deployment -- Key trust - -You are ready to configure device registration for your hybrid environment. Hybrid Windows Hello for Business deployment needs device registration to enable proper device authentication. +- Windows 10, version 1703 or later +- Windows 11 +- Hybrid deployment +- Key trust + +You are ready to configure device registration for your hybrid environment. Hybrid Windows Hello for Business deployment needs device registration to enable proper device authentication. > [!NOTE] > Before proceeding, you should familiarize yourself with device registration concepts such as: @@ -36,6 +36,7 @@ You are ready to configure device registration for your hybrid environment. Hybr > You can learn about this and more by reading [Introduction to Device Management in Azure Active Directory.](/azure/active-directory/device-management-introduction) ## Configure Azure for Device Registration + Begin configuring device registration to support Hybrid Windows Hello for Business by configuring device registration capabilities in Azure AD. To do this, follow the **Configure device settings** steps under [Setting up Azure AD Join in your organization](/azure/active-directory/devices/device-management-azure-portal). @@ -48,6 +49,7 @@ Next, follow the guidance on the [How to configure hybrid Azure Active Directory
## Follow the Windows Hello for Business hybrid key trust deployment guide + 1. [Overview](hello-hybrid-cert-trust.md) 2. [Prerequisites](hello-hybrid-cert-trust-prereqs.md) 3. [New Installation Baseline](hello-hybrid-key-new-install.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md index 29d57a36c6..641fe32c0c 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md @@ -19,21 +19,22 @@ ms.reviewer: # Hybrid Azure AD joined Key trust Windows Hello for Business Prerequisites **Applies to** -- Windows 10, version 1703 or later -- Windows 11 -- Hybrid deployment -- Key trust +- Windows 10, version 1703 or later +- Windows 11 +- Hybrid deployment +- Key trust Hybrid environments are distributed systems that enable organizations to use on-premises and Azure-based identities and resources. Windows Hello for Business uses the existing distributed system as a foundation on which organizations can provide two-factor authentication that provides a single sign-in like experience to modern resources. The distributed systems on which these technologies were built involved several pieces of on-premises and cloud infrastructure. High-level pieces of the infrastructure include: -* [Directories](#directories) -* [Public Key Infrastructure](#public-key-infrastructure) -* [Directory Synchronization](#directory-synchronization) -* [Federation](#federation-with-azure) -* [Multifactor authentication](#multifactor-authentication) -* [Device Registration](#device-registration) + +- [Directories](#directories) +- [Public Key Infrastructure](#public-key-infrastructure) +- [Directory Synchronization](#directory-synchronization) +- [Federation](#federation-with-azure) +- [Multifactor authentication](#multifactor-authentication) +- [Device Registration](#device-registration) ## Directories @@ -62,20 +63,21 @@ Review these requirements and those from the Windows Hello for Business planning
## Public Key Infrastructure + The Windows Hello for Business deployment depends on an enterprise public key infrastructure as trust anchor for authentication. Domain controllers for hybrid deployments need a certificate in order for Windows devices to trust the domain controller. Key trust deployments do not need client issued certificates for on-premises authentication. Active Directory user accounts are automatically configured for public key mapping by Azure AD Connect synchronizing the public key of the registered Windows Hello for Business credential to an attribute on the user's Active Directory object. The minimum required Enterprise certificate authority that can be used with Windows Hello for Business is Windows Server 2012, but you can also use a third-party Enterprise certification authority. The requirements for the domain controller certificate are shown below. For more details, see [Requirements for domain controller certificates from a third-party CA](/troubleshoot/windows-server/windows-security/requirements-domain-controller). -* The certificate must have a Certificate Revocation List (CRL) distribution point extension that points to a valid CRL, or an Authority Information Access (AIA) extension that points to an Online Certificate Status Protocol (OCSP) responder. -* Optionally, the certificate Subject section could contain the directory path of the server object (the distinguished name). -* The certificate Key Usage section must contain Digital Signature and Key Encipherment. -* Optionally, the certificate Basic Constraints section should contain: [Subject Type=End Entity, Path Length Constraint=None]. -* The certificate Enhanced Key Usage section must contain Client Authentication (1.3.6.1.5.5.7.3.2), Server Authentication (1.3.6.1.5.5.7.3.1), and KDC Authentication (1.3.6.1.5.2.3.5). -* The certificate Subject Alternative Name section must contain the Domain Name System (DNS) name. -* The certificate template must have an extension that has the value "DomainController", encoded as a [BMPstring](/windows/win32/seccertenroll/about-bmpstring). If you are using Windows Server Enterprise Certificate Authority, this extension is already included in the domain controller certificate template. -* The domain controller certificate must be installed in the local computer's certificate store. See [Configure Hybrid Windows Hello for Business: Public Key Infrastructure](./hello-hybrid-key-whfb-settings-pki.md) for details. +- The certificate must have a Certificate Revocation List (CRL) distribution point extension that points to a valid CRL, or an Authority Information Access (AIA) extension that points to an Online Certificate Status Protocol (OCSP) responder. +- Optionally, the certificate Subject section could contain the directory path of the server object (the distinguished name). +- The certificate Key Usage section must contain Digital Signature and Key Encipherment. +- Optionally, the certificate Basic Constraints section should contain: [Subject Type=End Entity, Path Length Constraint=None]. +- The certificate Enhanced Key Usage section must contain Client Authentication (1.3.6.1.5.5.7.3.2), Server Authentication (1.3.6.1.5.5.7.3.1), and KDC Authentication (1.3.6.1.5.2.3.5). +- The certificate Subject Alternative Name section must contain the Domain Name System (DNS) name. +- The certificate template must have an extension that has the value "DomainController", encoded as a [BMPstring](/windows/win32/seccertenroll/about-bmpstring). If you are using Windows Server Enterprise Certificate Authority, this extension is already included in the domain controller certificate template. +- The domain controller certificate must be installed in the local computer's certificate store. See [Configure Hybrid Windows Hello for Business: Public Key Infrastructure](./hello-hybrid-key-whfb-settings-pki.md) for details. > [!IMPORTANT] @@ -95,7 +97,8 @@ The two directories used in hybrid deployments must be synchronized. You need A Organizations using older directory synchronization technology, such as DirSync or Azure AD sync need to upgrade to Azure AD Connect. -### Section Review +### Section Review + > [!div class="checklist"] > * Azure Active Directory Connect directory synchronization > * [Upgrade from DirSync](/azure/active-directory/connect/active-directory-aadconnect-dirsync-upgrade-get-started) @@ -103,8 +106,8 @@ Organizations using older directory synchronization technology, such as DirSync
- ## Federation with Azure + You can deploy Windows Hello for Business key trust in non-federated and federated environments. For non-federated environments, key trust deployments work in environments that have deployed [Password Synchronization with Azure AD Connect](/azure/active-directory/hybrid/whatis-phs) or [Azure Active Directory Pass-through-Authentication](/azure/active-directory/connect/active-directory-aadconnect-pass-through-authentication). For federated environments, you can deploy Windows Hello for Business key trust using Active Directory Federation Services (AD FS) 2012 R2 or later. > [!div class="checklist"] @@ -119,7 +122,8 @@ Windows Hello for Business is a strong, two-factor credential the helps organiza Hybrid Windows Hello for Business deployments can use Azure's Multifactor Authentication (MFA) service or they can use multifactor authentication provided by AD FS beginning with Windows Server 2012 R2, which includes an adapter model that enables third parties to integrate their MFA into AD FS. The MFA enabled by an Office 365 license is sufficient for Azure AD. -### Section Review +### Section Review + > [!div class="checklist"] > * Azure MFA Service > * Windows Server 2016 AD FS and Azure (optional, if federated) @@ -129,13 +133,12 @@ Hybrid Windows Hello for Business deployments can use Azure's Multifactor Authen ## Device Registration -Organizations wanting to deploy hybrid key trust need their domain joined devices to register to Azure Active Directory. Just as a computer has an identity in Active Directory, that same computer has an identity in the cloud. This ensures that only approved computers are used with that Azure Active Directory. Each computer registers its identity in Azure Active Directory. +Organizations wanting to deploy hybrid key trust need their domain joined devices to register to Azure Active Directory. Just as a computer has an identity in Active Directory, that same computer has an identity in the cloud. This ensures that only approved computers are used with that Azure Active Directory. Each computer registers its identity in Azure Active Directory. ## Provisioning You need to allow access to the URL account.microsoft.com to initiate Windows Hello for Business provisioning. This URL launches the subsequent steps in the provisioning process and is required to successfully complete Windows Hello for Business provisioning. This URL does not require any authentication and as such, does not collect any user data. - ### Section Checklist > [!div class="checklist"] @@ -161,6 +164,7 @@ For federated and non-federated environments, start with **Configure Windows Hel
## Follow the Windows Hello for Business hybrid key trust deployment guide + 1. [Overview](hello-hybrid-key-trust.md) 2. Prerequisites (*You are here*) 3. [New Installation Baseline](hello-hybrid-key-new-install.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-ad.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-ad.md index c8db509239..4a3d72f393 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-ad.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-ad.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: GitPrakhar13 manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -19,15 +19,14 @@ ms.reviewer: # Configuring Hybrid Azure AD joined key trust Windows Hello for Business: Active Directory **Applies to** -- Windows 10, version 1703 or later -- Windows 11 -- Hybrid deployment -- Key trust +- Windows 10, version 1703 or later +- Windows 11 +- Hybrid deployment +- Key trust Configure the appropriate security groups to efficiently deploy Windows Hello for Business to users. - ### Creating Security Groups Windows Hello for Business uses a security group to simplify the deployment and management. @@ -59,6 +58,7 @@ Sign-in a domain controller or management workstation with *Domain Admin* equiva
## Follow the Windows Hello for Business hybrid key trust deployment guide + 1. [Overview](hello-hybrid-cert-trust.md) 2. [Prerequisites](hello-hybrid-key-trust-prereqs.md) 3. [New Installation Baseline](hello-hybrid-key-new-install.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-dir-sync.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-dir-sync.md index 8e58707531..ec68777427 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-dir-sync.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-dir-sync.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: GitPrakhar13 manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -19,10 +19,11 @@ ms.reviewer: # Configure Hybrid Azure AD joined Windows Hello for Business: Directory Synchronization **Applies to** -- Windows 10, version 1703 or later -- Windows 11 -- Hybrid deployment -- Key trust + +- Windows 10, version 1703 or later +- Windows 11 +- Hybrid deployment +- Key trust ## Directory Synchronization @@ -55,6 +56,7 @@ Sign-in a domain controller or management workstation with _Domain Admin_ equiva
## Follow the Windows Hello for Business hybrid key trust deployment guide + 1. [Overview](hello-hybrid-cert-trust.md) 2. [Prerequisites](hello-hybrid-key-trust-prereqs.md) 3. [New Installation Baseline](hello-hybrid-key-new-install.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-identity-verification.md b/windows/security/identity-protection/hello-for-business/hello-identity-verification.md index 1bbb178788..352cf1f3bb 100644 --- a/windows/security/identity-protection/hello-for-business/hello-identity-verification.md +++ b/windows/security/identity-protection/hello-for-business/hello-identity-verification.md @@ -8,8 +8,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: GitPrakhar13 manager: dansimp ms.collection: - M365-identity-device-management @@ -78,4 +78,4 @@ The table shows the minimum requirements for each deployment. | Azure Account, optional for Azure MFA billing | Azure Account, optional for Azure MFA billing | > [!IMPORTANT] -> For Windows Hello for Business key trust deployments, if you have several domains, at least one Windows Server Domain Controller 2016 or newer is required for each domain. For more information, see the [planning guide](./hello-adequate-domain-controllers.md). \ No newline at end of file +> For Windows Hello for Business key trust deployments, if you have several domains, at least one Windows Server Domain Controller 2016 or newer is required for each domain. For more information, see the [planning guide](./hello-adequate-domain-controllers.md). diff --git a/windows/security/identity-protection/hello-for-business/hello-key-trust-adfs.md b/windows/security/identity-protection/hello-for-business/hello-key-trust-adfs.md index 0dfae840a6..ced71bc7c8 100644 --- a/windows/security/identity-protection/hello-for-business/hello-key-trust-adfs.md +++ b/windows/security/identity-protection/hello-for-business/hello-key-trust-adfs.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: GitPrakhar13 manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -19,11 +19,11 @@ ms.reviewer: # Prepare and Deploy Windows Server 2016 Active Directory Federation Services with Key Trust **Applies to** -- Windows 10, version 1703 or later -- Windows 11 -- On-premises deployment -- Key trust +- Windows 10, version 1703 or later +- Windows 11 +- On-premises deployment +- Key trust Windows Hello for Business works exclusively with the Active Directory Federation Service role included with Windows Server 2016 and requires an additional server update. The on-premises key trust deployment uses Active Directory Federation Services roles for key registration and device registration. @@ -344,6 +344,7 @@ Before you continue with the deployment, validate your deployment progress by re ## Follow the Windows Hello for Business on premises certificate trust deployment guide + 1. [Validate Active Directory prerequisites](hello-key-trust-validate-ad-prereq.md) 2. [Validate and Configure Public Key Infrastructure](hello-key-trust-validate-pki.md) 3. Prepare and Deploy Windows Server 2016 Active Directory Federation Services (*You are here*) diff --git a/windows/security/identity-protection/hello-for-business/hello-key-trust-policy-settings.md b/windows/security/identity-protection/hello-for-business/hello-key-trust-policy-settings.md index 0933808ce7..240e3b4a9b 100644 --- a/windows/security/identity-protection/hello-for-business/hello-key-trust-policy-settings.md +++ b/windows/security/identity-protection/hello-for-business/hello-key-trust-policy-settings.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: GitPrakhar13 manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -19,10 +19,11 @@ ms.reviewer: # Configure Windows Hello for Business Policy settings - Key Trust **Applies to** -- Windows 10, version 1703 or later -- Windows 11 -- On-premises deployment -- Key trust + +- Windows 10, version 1703 or later +- Windows 11 +- On-premises deployment +- Key trust You need at least a Windows 10, version 1703 workstation to run the Group Policy Management Console, which provides the latest Windows Hello for Business and PIN Complexity Group Policy settings. To run the Group Policy Management Console, you need to install the Remote Server Administration Tools for Windows. You can download these tools from [Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=45520). diff --git a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-ad-prereq.md b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-ad-prereq.md index 85a36fa384..8c3849151b 100644 --- a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-ad-prereq.md +++ b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-ad-prereq.md @@ -8,8 +8,8 @@ ms.sitesec: library ms.pagetype: security, mobile author: dansimp audience: ITPro -ms.author: dansimp -manager: dansimp +ms.author: GitPrakhar13 +manager: GitPrakhar13 ms.collection: M365-identity-device-management ms.topic: article localizationpriority: medium @@ -19,10 +19,10 @@ ms.reviewer: # Validate Active Directory prerequisites - Key Trust **Applies to** -- Windows 10, version 1703 or later -- Windows 11 -- On-premises deployment -- Key trust +- Windows 10, version 1703 or later +- Windows 11 +- On-premises deployment +- Key trust Key trust deployments need an adequate number of 2016 or later domain controllers to ensure successful user authentication with Windows Hello for Business. To learn more about domain controller planning for key trust deployments, read the [Windows Hello for Business planning guide](hello-planning-guide.md), the [Planning an adequate number of Windows Server 2016 or later Domain Controllers for Windows Hello for Business deployments](hello-adequate-domain-controllers.md) section. diff --git a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-deploy-mfa.md b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-deploy-mfa.md index 549c4ffd5d..35b1e59252 100644 --- a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-deploy-mfa.md +++ b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-deploy-mfa.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: GitPrakhar13 manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/hello-manage-in-organization.md b/windows/security/identity-protection/hello-for-business/hello-manage-in-organization.md index d6d92affa4..d98f82336d 100644 --- a/windows/security/identity-protection/hello-for-business/hello-manage-in-organization.md +++ b/windows/security/identity-protection/hello-for-business/hello-manage-in-organization.md @@ -8,20 +8,21 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: GitPrakhar13 manager: dansimp ms.collection: - M365-identity-device-management - highpri ms.topic: article ms.localizationpriority: medium -ms.date: 1/20/2021 +ms.date: 2/15/2022 --- # Manage Windows Hello for Business in your organization **Applies to** + - Windows 10 - Windows 11 diff --git a/windows/security/identity-protection/hello-for-business/hello-planning-guide.md b/windows/security/identity-protection/hello-for-business/hello-planning-guide.md index b5c42012a1..d1bc260624 100644 --- a/windows/security/identity-protection/hello-for-business/hello-planning-guide.md +++ b/windows/security/identity-protection/hello-for-business/hello-planning-guide.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: GitPrakhar13 manager: dansimp ms.collection: - M365-identity-device-management diff --git a/windows/security/identity-protection/hello-for-business/hello-prepare-people-to-use.md b/windows/security/identity-protection/hello-for-business/hello-prepare-people-to-use.md index 966f0adef8..0ffe5c3a7b 100644 --- a/windows/security/identity-protection/hello-for-business/hello-prepare-people-to-use.md +++ b/windows/security/identity-protection/hello-for-business/hello-prepare-people-to-use.md @@ -9,8 +9,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: GitPrakhar13 manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -21,8 +21,9 @@ ms.date: 08/19/2018 # Prepare people to use Windows Hello **Applies to** -- Windows 10 -- Windows 11 + +- Windows 10 +- Windows 11 When you set a policy to require Windows Hello for Business in the workplace, you will want to prepare people in your organization by explaining how to use Hello. diff --git a/windows/security/identity-protection/hello-for-business/hello-videos.md b/windows/security/identity-protection/hello-for-business/hello-videos.md index 61a06b945e..c150a526a2 100644 --- a/windows/security/identity-protection/hello-for-business/hello-videos.md +++ b/windows/security/identity-protection/hello-for-business/hello-videos.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: GitPrakhar13 manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -19,8 +19,9 @@ ms.reviewer: # Windows Hello for Business Videos **Applies to** -- Windows 10 -- Windows 11 + +- Windows 10 +- Windows 11 ## Overview of Windows Hello for Business and Features diff --git a/windows/security/identity-protection/hello-for-business/hello-why-pin-is-better-than-password.md b/windows/security/identity-protection/hello-for-business/hello-why-pin-is-better-than-password.md index 88adebf4e7..1290d2dba6 100644 --- a/windows/security/identity-protection/hello-for-business/hello-why-pin-is-better-than-password.md +++ b/windows/security/identity-protection/hello-for-business/hello-why-pin-is-better-than-password.md @@ -8,8 +8,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: GitPrakhar13 manager: dansimp ms.collection: - M365-identity-device-management @@ -23,8 +23,8 @@ ms.date: 10/23/2017 **Applies to** -- Windows 10 -- Windows 11 +- Windows 10 +- Windows 11 Windows Hello in Windows 10 enables users to sign in to their device using a PIN. How is a PIN different from (and better than) a password? On the surface, a PIN looks much like a password. A PIN can be a set of numbers, but enterprise policy might allow complex PINs that include special characters and letters, both upper-case and lower-case. Something like **t758A!** could be an account password or a complex Hello PIN. It isn't the structure of a PIN (length, complexity) that makes it better than a password, it's how it works. diff --git a/windows/security/identity-protection/hello-for-business/index.yml b/windows/security/identity-protection/hello-for-business/index.yml index 4cb62fb1ce..972f6343ab 100644 --- a/windows/security/identity-protection/hello-for-business/index.yml +++ b/windows/security/identity-protection/hello-for-business/index.yml @@ -8,9 +8,9 @@ metadata: description: Learn how to manage and deploy Windows Hello for Business. ms.prod: m365-security ms.topic: landing-page - author: mapalko + author: GitPrakhar13 manager: dansimp - ms.author: mapalko + ms.author: GitPrakhar13 ms.date: 01/22/2021 ms.collection: - M365-identity-device-management diff --git a/windows/security/identity-protection/hello-for-business/microsoft-compatible-security-key.md b/windows/security/identity-protection/hello-for-business/microsoft-compatible-security-key.md index 308554bde8..e106bb2c8a 100644 --- a/windows/security/identity-protection/hello-for-business/microsoft-compatible-security-key.md +++ b/windows/security/identity-protection/hello-for-business/microsoft-compatible-security-key.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: GitPrakhar13 manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/passwordless-strategy.md b/windows/security/identity-protection/hello-for-business/passwordless-strategy.md index 56a0e61012..6c3d7dc1b8 100644 --- a/windows/security/identity-protection/hello-for-business/passwordless-strategy.md +++ b/windows/security/identity-protection/hello-for-business/passwordless-strategy.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: GitPrakhar13 manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/reset-security-key.md b/windows/security/identity-protection/hello-for-business/reset-security-key.md index d9743650a3..91592e2183 100644 --- a/windows/security/identity-protection/hello-for-business/reset-security-key.md +++ b/windows/security/identity-protection/hello-for-business/reset-security-key.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: GitPrakhar13 manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -18,7 +18,7 @@ ms.reviewer: --- # How to reset a Microsoft-compatible security key? > [!Warning] -> Some information relates to pre-released product that may change before it is commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. +> Some information relates to pre-released product that may change before it is commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. >[!IMPORTANT] >This operation will wipe everything from your security key and reset it to factory defaults.
**All data and credentials will be cleared.** @@ -37,4 +37,4 @@ Follow the instructions in the Settings app and look for specific instructions b >[!NOTE] >The steps to reset your security key may vary based on the security key manufacturer.
->If your security key is not listed here, please reach out to your security key manufacturer for reset instructions. \ No newline at end of file +>If your security key is not listed here, please reach out to your security key manufacturer for reset instructions.