From 9c6d5b2a4797cf6843c0a4069373fffd2a3a821e Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Tue, 13 Dec 2022 13:31:04 -0500 Subject: [PATCH] updates --- .../hello-aad-join-cloud-only-deploy.md | 6 +- .../hello-cert-trust-validate-deploy-mfa.md | 2 - .../hello-deployment-rdp-certs.md | 11 +--- .../hello-hybrid-cloud-kerberos-trust.md | 8 +-- .../hello-identity-verification.md | 56 +++++++------------ .../hello-key-trust-validate-deploy-mfa.md | 2 - 6 files changed, 29 insertions(+), 56 deletions(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-aad-join-cloud-only-deploy.md b/windows/security/identity-protection/hello-for-business/hello-aad-join-cloud-only-deploy.md index 814f5855d9..004083bb85 100644 --- a/windows/security/identity-protection/hello-for-business/hello-aad-join-cloud-only-deploy.md +++ b/windows/security/identity-protection/hello-for-business/hello-aad-join-cloud-only-deploy.md @@ -1,12 +1,12 @@ --- -title: Azure Active Directory join cloud only deployment -description: Use this deployment guide to successfully use Azure Active Directory to join a Windows 10 or Windows 11 device. +title: Windows Hello for Business cloud-only deployment +description: Learn how to configure Windows Hello for Business in a cloud-only deployment scenario. ms.date: 06/23/2021 appliesto: - ✅ Windows 10 and later ms.topic: article --- -# Azure Active Directory join cloud only deployment +# Cloud-only deployment [!INCLUDE [hello-hybrid-key-trust](../../includes/hello-cloud.md)] diff --git a/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-deploy-mfa.md b/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-deploy-mfa.md index 15bdeb6a4e..2ef0bef451 100644 --- a/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-deploy-mfa.md +++ b/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-deploy-mfa.md @@ -24,7 +24,5 @@ For information on available third-party authentication methods see [Configure A Follow the integration and deployment guide for the authentication provider you select to integrate and deploy it to AD FS. Make sure that the authentication provider is selected as a multi-factor authentication option in the AD FS authentication policy. For information on configuring AD FS authentication policies see [Configure Authentication Policies](/windows-server/identity/ad-fs/operations/configure-authentication-policies). -## Follow the Windows Hello for Business on premises certificate trust deployment guide - > [!div class="nextstepaction"] > [Next: configure Windows Hello for Business Policy settings](hello-cert-trust-policy-settings.md) \ No newline at end of file diff --git a/windows/security/identity-protection/hello-for-business/hello-deployment-rdp-certs.md b/windows/security/identity-protection/hello-for-business/hello-deployment-rdp-certs.md index af71e186d2..0a75e5ee3e 100644 --- a/windows/security/identity-protection/hello-for-business/hello-deployment-rdp-certs.md +++ b/windows/security/identity-protection/hello-for-business/hello-deployment-rdp-certs.md @@ -4,22 +4,17 @@ description: Learn how to deploy certificates to cloud Kerberos trust and key tr ms.collection: - ContentEngagementFY23 ms.topic: article -localizationpriority: medium ms.date: 11/15/2022 appliesto: - ✅ Windows 10 and later -ms.technology: itpro-security --- # Deploy certificates for remote desktop (RDP) sign-in This document describes Windows Hello for Business functionalities or scenarios that apply to:\ -✅ **Deployment type:** [hybrid](hello-how-it-works-technology.md#hybrid-deployment)\ -✅ **Trust type:** [cloud Kerberos trust](hello-hybrid-cloud-kerberos-trust.md), [ key trust](hello-how-it-works-technology.md#key-trust)\ -✅ **Device registration type:** [Azure AD join](hello-how-it-works-technology.md#azure-active-directory-join), [Hybrid Azure AD join](hello-how-it-works-technology.md#hybrid-azure-ad-join) - -
- +- **Deployment type:** [!INCLUDE [hybrid](../../includes/hello-deployment-hybrid.md)] +- **Trust type:** [!INCLUDE [cloud-kerberos](../../includes/hello-trust-cloud-kerberos.md)],[!INCLUDE [key](../../includes/hello-trust-key.md)] +- **Join type:** [!INCLUDE [hello-join-aadj](hello-join-aad.md)], [!INCLUDE [hello-join-hybrid](hello-join-hybrid.md)] --- Windows Hello for Business supports using a certificate as the supplied credential, when establishing a remote desktop connection to another Windows device. This document discusses three approaches for *cloud Kerberos trust* and *key trust* deployments, where authentication certificates can be deployed to an existing Windows Hello for Business user: diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cloud-kerberos-trust.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cloud-kerberos-trust.md index d8063e6127..ebcff732f3 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cloud-kerberos-trust.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cloud-kerberos-trust.md @@ -1,16 +1,16 @@ --- -title: Hybrid cloud Kerberos trust deployment (Windows Hello for Business) -description: Learn the information you need to successfully deploy Windows Hello for Business in a hybrid cloud Kerberos trust scenario. +title: Windows Hello for Business Cloud Kerberos trust deployment +description: Learn how to deploy Windows Hello for Business in a cloud Kerberos trust scenario. ms.date: 11/1/2022 appliesto: - ✅ Windows 10, version 21H2 and later ms.topic: article --- -# Hybrid cloud Kerberos trust deployment +# Cloud Kerberos trust deployment [!INCLUDE [hello-hybrid-key-trust](../../includes/hello-hybrid-cloudkerb-trust.md)] -Windows Hello for Business replaces password sign-in with strong authentication, using an asymmetric key pair. This deployment guide provides the information to successfully deploy Windows Hello for Business in a hybrid cloud Kerberos trust scenario. +Windows Hello for Business replaces password sign-in with strong authentication, using an asymmetric key pair. This deployment guide provides the information to successfully deploy Windows Hello for Business in a cloud Kerberos trust scenario. ## Introduction to cloud Kerberos trust diff --git a/windows/security/identity-protection/hello-for-business/hello-identity-verification.md b/windows/security/identity-protection/hello-for-business/hello-identity-verification.md index beb5f40e54..c28daf27a0 100644 --- a/windows/security/identity-protection/hello-for-business/hello-identity-verification.md +++ b/windows/security/identity-protection/hello-for-business/hello-identity-verification.md @@ -2,10 +2,11 @@ title: Windows Hello for Business Deployment Prerequisite Overview description: Overview of all the different infrastructure requirements for Windows Hello for Business deployment models ms.collection: - - highpri -ms.date: 2/15/2022 +- highpri +ms.date: 12/13/2022 appliesto: - - ✅ Windows 10 and later +- ✅ Windows 10 and later +- ✅ Windows Server 2016 and later ms.topic: article --- @@ -15,11 +16,10 @@ This article lists the infrastructure requirements for the different deployment ## Azure AD Cloud Only Deployment -* Microsoft Azure Account -* Azure Active Directory -* Azure AD Multifactor Authentication -* Modern Management (Intune or supported third-party MDM), *optional* -* Azure AD Premium subscription - *optional*, needed for automatic MDM enrollment when the device joins Azure Active Directory +- Azure Active Directory +- Azure AD Multifactor Authentication +- Device management solution (Intune or supported third-party MDM), *optional* +- Azure AD Premium subscription - *optional*, needed for automatic MDM enrollment when the device joins Azure Active Directory ## Hybrid Deployments @@ -27,44 +27,26 @@ The table shows the minimum requirements for each deployment. For key trust in a | Requirement | cloud Kerberos trust
Group Policy or Modern managed | Key trust
Group Policy or Modern managed | Certificate Trust
Mixed managed | Certificate Trust
Modern managed | | --- | --- | --- | --- | --- | -| **Windows Version** | Windows 10, version 21H2 with KB5010415; Windows 11 with KB5010414; or later | Windows 10, version 1511 or later| **Hybrid Azure AD Joined:**
*Minimum:* Windows 10, version 1703
*Best experience:* Windows 10, version 1709 or later (supports synchronous certificate enrollment).
**Azure AD Joined:**
Windows 10, version 1511 or later| Windows 10, version 1511 or later | -| **Schema Version** | No specific Schema requirement | Windows Server 2016 or later Schema | Windows Server 2016 or later Schema | Windows Server 2016 or later Schema | +| **Windows Version** | Any supported Windows client versions| Any supported Windows client versions | Any supported Windows client versions | +| **Schema Version** | No specific Schema requirement | Windows Server 2016 or later schema | Windows Server 2016 or later schema | Windows Server 2016 or later schema | | **Domain and Forest Functional Level** | Windows Server 2008 R2 Domain/Forest functional level | Windows Server 2008 R2 Domain/Forest functional level | Windows Server 2008 R2 Domain/Forest functional level |Windows Server 2008 R2 Domain/Forest functional level | -| **Domain Controller Version** | Windows Server 2016 or later | Windows Server 2016 or later | Windows Server 2008 R2 or later | Windows Server 2008 R2 or later | -| **Certificate Authority**| N/A | Windows Server 2012 or later Certificate Authority | Windows Server 2012 or later Certificate Authority | Windows Server 2012 or later Certificate Authority | -| **AD FS Version** | N/A | N/A | Windows Server 2016 AD FS with [KB4088889 update](https://support.microsoft.com/help/4088889) (hybrid Azure AD joined clients managed by Group Policy),
and
Windows Server 2012 or later Network Device Enrollment Service (hybrid Azure AD joined & Azure AD joined managed by MDM) | Windows Server 2012 or later Network Device Enrollment Service | -| **MFA Requirement** | Azure MFA tenant, or
AD FS w/Azure MFA adapter, or
AD FS w/Azure MFA Server adapter, or
AD FS w/3rd Party MFA Adapter | Azure MFA tenant, or
AD FS w/Azure MFA adapter, or
AD FS w/Azure MFA Server adapter, or
AD FS w/3rd Party MFA Adapter | Azure MFA tenant, or
AD FS w/Azure MFA adapter, or
AD FS w/Azure MFA Server adapter, or
AD FS w/3rd Party MFA Adapter | Azure MFA tenant, or
AD FS w/Azure MFA adapter, or
AD FS w/Azure MFA Server adapter, or
AD FS w/3rd Party MFA Adapter | +| **Domain Controller Version** | Any supported Windows Server versions | Any supported Windows Server versions | Any supported Windows Server versions | Any supported Windows Server versions | +| **Certificate Authority**| N/A |Any supported Windows Server versions | Any supported Windows Server versions | Any supported Windows Server versions | +| **AD FS Version** | N/A | N/A | Any supported Windows Server versions | Any supported Windows Server versions | +| **MFA Requirement** | Azure MFA, or
AD FS w/Azure MFA adapter, or
AD FS w/Azure MFA Server adapter, or
AD FS w/3rd Party MFA Adapter | Azure MFA tenant, or
AD FS w/Azure MFA adapter, or
AD FS w/Azure MFA Server adapter, or
AD FS w/3rd Party MFA Adapter | Azure MFA tenant, or
AD FS w/Azure MFA adapter, or
AD FS w/Azure MFA Server adapter, or
AD FS w/3rd Party MFA Adapter | Azure MFA tenant, or
AD FS w/Azure MFA adapter, or
AD FS w/Azure MFA Server adapter, or
AD FS w/3rd Party MFA Adapter | | **Azure AD Connect** | N/A | Required | Required | Required | | **Azure AD License** | Azure AD Premium, optional | Azure AD Premium, optional | Azure AD Premium, needed for device write-back | Azure AD Premium, optional. Intune license required | -> [!Important] -> - Hybrid deployments support non-destructive PIN reset that works with Certificate Trust, Key Trust and cloud Kerberos trust models. -> -> **Requirements:** -> - Microsoft PIN Reset Service - Windows 10, versions 1709 to 1809, Enterprise Edition. There is no licensing requirement for this service since version 1903 -> - Reset above lock screen (_I forgot my PIN_ link) - Windows 10, version 1903 -> -> - On-premises deployments support destructive PIN reset that works with both the certificate trust and the key trust models. -> -> **Requirements:** -> - Reset from settings - Windows 10, version 1703, Professional -> - Reset above lock screen - Windows 10, version 1709, Professional -> - Reset above lock screen (_I forgot my PIN_ link) - Windows 10, version 1903 - ## On-premises Deployments The table shows the minimum requirements for each deployment. | Key trust
Group Policy managed | Certificate trust
Group Policy managed| | --- | --- | -| Windows 10, version 1703 or later | Windows 10, version 1703 or later | +|Any supported Windows client versions|Any supported Windows client versions| | Windows Server 2016 Schema | Windows Server 2016 Schema| | Windows Server 2008 R2 Domain/Forest functional level | Windows Server 2008 R2 Domain/Forest functional level | -| Windows Server 2016 or later Domain Controllers | Windows Server 2008 R2 or later Domain Controllers | -| Windows Server 2012 or later Certificate Authority | Windows Server 2012 or later Certificate Authority | -| Windows Server 2016 AD FS with [KB4088889 update](https://support.microsoft.com/help/4088889) | Windows Server 2016 AD FS with [KB4088889 update](https://support.microsoft.com/help/4088889) | -| AD FS with 3rd Party MFA Adapter | AD FS with 3rd Party MFA Adapter | -| Azure Account, optional for Azure MFA billing | Azure Account, optional for Azure MFA billing | - -> [!IMPORTANT] -> For Windows Hello for Business key trust deployments, if you have several domains, at least one Windows Server Domain Controller 2016 or newer is required for each domain. For more information, see the [planning guide](./hello-adequate-domain-controllers.md). +| Any supported Windows Server versions | Any supported Windows Server versions | +| Any supported Windows Server versions | Any supported Windows Server versions | +| Any supported Windows Server versions | Any supported Windows Server versions | +| AD FS with 3rd Party MFA Adapter | AD FS with 3rd Party MFA Adapter | \ No newline at end of file diff --git a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-deploy-mfa.md b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-deploy-mfa.md index 6e057a76b8..c3f955897b 100644 --- a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-deploy-mfa.md +++ b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-deploy-mfa.md @@ -25,7 +25,5 @@ For information on available third-party authentication methods see [Configure A Follow the integration and deployment guide for the authentication provider you select to integrate and deploy it to AD FS. Make sure that the authentication provider is selected as a multi-factor authentication option in the AD FS authentication policy. For information on configuring AD FS authentication policies see [Configure Authentication Policies](/windows-server/identity/ad-fs/operations/configure-authentication-policies). -## Follow the Windows Hello for Business on premises certificate trust deployment guide - > [!div class="nextstepaction"] > [Next: configure Windows Hello for Business Policy settings](hello-key-trust-policy-settings.md) \ No newline at end of file