mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-16 10:53:43 +00:00
updates
This commit is contained in:
Paolo Matarazzo
@ -8,7 +8,7 @@ ms.topic: article
|
||||
---
|
||||
# Cloud-only deployment
|
||||
|
||||
[!INCLUDE [hello-hybrid-key-trust](../../includes/hello-cloud.md)]
|
||||
[!INCLUDE [hello-hybrid-key-trust](./includes/hello-cloud.md)]
|
||||
|
||||
## Introduction
|
||||
|
||||
|
||||
@ -9,7 +9,7 @@ ms.topic: tutorial
|
||||
---
|
||||
# Prepare and deploy Active Directory Federation Services - on-premises certificate trust
|
||||
|
||||
[!INCLUDE [hello-on-premises-cert-trust](../../includes/hello-on-premises-cert-trust.md)]
|
||||
[!INCLUDE [hello-on-premises-cert-trust](./includes/hello-on-premises-cert-trust.md)]
|
||||
|
||||
Windows Hello for Business works exclusively with the Active Directory Federation Service (AD FS) role included with Windows Server. The on-premises certificate trust deployment model uses AD FS for *certificate enrollment* and *device registration*.
|
||||
|
||||
|
||||
@ -11,7 +11,7 @@ ms.topic: tutorial
|
||||
---
|
||||
# Configure Windows Hello for Business group policy settings - on-premises certificate Trust
|
||||
|
||||
[!INCLUDE [hello-on-premises-cert-trust](../../includes/hello-on-premises-cert-trust.md)]
|
||||
[!INCLUDE [hello-on-premises-cert-trust](./includes/hello-on-premises-cert-trust.md)]
|
||||
|
||||
On-premises certificate-based deployments of Windows Hello for Business need three Group Policy settings:
|
||||
- Enable Windows Hello for Business
|
||||
|
||||
@ -9,7 +9,7 @@ ms.topic: tutorial
|
||||
---
|
||||
# Validate Active Directory prerequisites - on-premises certificate trust
|
||||
|
||||
[!INCLUDE [hello-on-premises-cert-trust](../../includes/hello-on-premises-cert-trust.md)]
|
||||
[!INCLUDE [hello-on-premises-cert-trust](./includes/hello-on-premises-cert-trust.md)]
|
||||
|
||||
The key registration process for the on-premises deployment of Windows Hello for Business requires the Windows Server 2016 Active Directory or later schema.
|
||||
|
||||
|
||||
@ -10,7 +10,7 @@ ms.topic: tutorial
|
||||
|
||||
# Validate and deploy multi-factor authentication - on-premises certificate trust
|
||||
|
||||
[!INCLUDE [hello-on-premises-cert-trust](../../includes/hello-on-premises-cert-trust.md)]
|
||||
[!INCLUDE [hello-on-premises-cert-trust](./includes/hello-on-premises-cert-trust.md)]
|
||||
|
||||
Windows Hello for Business requires users perform multi-factor authentication (MFA) prior to enroll in the service. On-premises deployments can use, as MFA option:
|
||||
|
||||
|
||||
@ -9,7 +9,7 @@ ms.topic: tutorial
|
||||
---
|
||||
# Configure and validate the Public Key Infrastructure - on-premises certificate trust
|
||||
|
||||
[!INCLUDE [hello-on-premises-cert-trust](../../includes/hello-on-premises-cert-trust.md)]
|
||||
[!INCLUDE [hello-on-premises-cert-trust](./includes/hello-on-premises-cert-trust.md)]
|
||||
|
||||
Windows Hello for Business must have a Public Key Infrastructure (PKI) when using the *key trust* or *certificate trust* models. The domain controllers must have a certificate, which serves as a root of trust for clients. The certificate ensures that clients don't communicate with rogue domain controllers. The certificate trust model extends certificate issuance to client computers. During Windows Hello for Business provisioning, the user receives a sign-in certificate.
|
||||
|
||||
|
||||
@ -9,7 +9,7 @@ ms.topic: tutorial
|
||||
---
|
||||
# Deployment guide overview - on-premises certificate trust
|
||||
|
||||
[!INCLUDE [hello-on-premises-cert-trust](../../includes/hello-on-premises-cert-trust.md)]
|
||||
[!INCLUDE [hello-on-premises-cert-trust](./includes/hello-on-premises-cert-trust.md)]
|
||||
|
||||
Windows Hello for Business replaces username and password authentication to Windows with an asymmetric key pair. This deployment guide provides the information to deploy Windows Hello for Business in an on-premises environment:
|
||||
|
||||
|
||||
@ -9,7 +9,7 @@ ms.topic: tutorial
|
||||
---
|
||||
# Deployment guide overview - on-premises key trust
|
||||
|
||||
[!INCLUDE [hello-on-premises-key-trust](../../includes/hello-on-premises-key-trust.md)]
|
||||
[!INCLUDE [hello-on-premises-key-trust](./includes/hello-on-premises-key-trust.md)]
|
||||
|
||||
Windows Hello for Business replaces username and password authentication to Windows with an asymmetric key pair. This deployment guide provides the information to deploy Windows Hello for Business in an on-premises environment::
|
||||
|
||||
|
||||
@ -12,9 +12,9 @@ appliesto:
|
||||
# Deploy certificates for remote desktop (RDP) sign-in
|
||||
|
||||
This document describes Windows Hello for Business functionalities or scenarios that apply to:
|
||||
- **Deployment type:** [!INCLUDE [hybrid](../../includes/hello-deployment-hybrid.md)]
|
||||
- **Trust type:** [!INCLUDE [cloud-kerberos](../../includes/hello-trust-cloud-kerberos.md)], [!INCLUDE [key](../../includes/hello-trust-key.md)]
|
||||
- **Join type:** [!INCLUDE [hello-join-aadj](../../includes/hello-join-aad.md)], [!INCLUDE [hello-join-hybrid](../../includes/hello-join-hybrid.md)]
|
||||
- **Deployment type:** [!INCLUDE [hybrid](./includes/hello-deployment-hybrid.md)]
|
||||
- **Trust type:** [!INCLUDE [cloud-kerberos](./includes/hello-trust-cloud-kerberos.md)], [!INCLUDE [key](./includes/hello-trust-key.md)]
|
||||
- **Join type:** [!INCLUDE [hello-join-aadj](./includes/hello-join-aad.md)], [!INCLUDE [hello-join-hybrid](./includes/hello-join-hybrid.md)]
|
||||
---
|
||||
|
||||
Windows Hello for Business supports using a certificate as the supplied credential, when establishing a remote desktop connection to another Windows device. This document discusses three approaches for *cloud Kerberos trust* and *key trust* deployments, where authentication certificates can be deployed to an existing Windows Hello for Business user:
|
||||
|
||||
@ -8,7 +8,7 @@ ms.topic: how-to
|
||||
---
|
||||
# Configure Azure AD-joined devices for On-premises Single-Sign On using Windows Hello for Business
|
||||
|
||||
[!INCLUDE [hello-hybrid-key-trust](../../includes/hello-hybrid-keycert-trust-aad.md)]
|
||||
[!INCLUDE [hello-hybrid-key-trust](./includes/hello-hybrid-keycert-trust-aad.md)]
|
||||
|
||||
## Prerequisites
|
||||
|
||||
|
||||
@ -9,7 +9,7 @@ ms.topic: how-to
|
||||
|
||||
# Using Certificates for AADJ On-premises Single-sign On
|
||||
|
||||
[!INCLUDE [hello-hybrid-key-trust](../../includes/hello-hybrid-cert-trust-aad.md)]
|
||||
[!INCLUDE [hello-hybrid-key-trust](./includes/hello-hybrid-cert-trust-aad.md)]
|
||||
|
||||
If you plan to use certificates for on-premises single-sign on, then follow these **additional** steps to configure the environment to enroll Windows Hello for Business certificates for Azure AD-joined devices.
|
||||
|
||||
|
||||
@ -8,7 +8,7 @@ ms.topic: article
|
||||
---
|
||||
# Azure AD Join Single Sign-on Deployment
|
||||
|
||||
[!INCLUDE [hello-hybrid-key-trust](../../includes/hello-hybrid-keycert-trust-aad.md)]
|
||||
[!INCLUDE [hello-hybrid-key-trust](./includes/hello-hybrid-keycert-trust-aad.md)]
|
||||
|
||||
Windows Hello for Business combined with Azure Active Directory-joined devices makes it easy for users to securely access cloud-based resources using a strong, two-factor credential. Some resources may remain on-premises as enterprises transition resources to the cloud and Azure AD-joined devices may need to access these resources. With additional configurations to your current hybrid deployment, you can provide single sign-on to your on-premises resources for Azure Active Directory-joined devices using Windows Hello for Business, using a key or a certificate.
|
||||
|
||||
|
||||
@ -8,7 +8,7 @@ ms.topic: article
|
||||
---
|
||||
# Hybrid Azure AD joined Windows Hello for Business Certificate Trust New Installation
|
||||
|
||||
[!INCLUDE [hello-hybrid-key-trust](../../includes/hello-hybrid-cert-trust.md)]
|
||||
[!INCLUDE [hello-hybrid-key-trust](./includes/hello-hybrid-cert-trust.md)]
|
||||
|
||||
Windows Hello for Business involves configuring distributed technologies that may or may not exist in your current infrastructure. Hybrid certificate trust deployments of Windows Hello for Business rely on these technologies
|
||||
|
||||
|
||||
@ -8,7 +8,7 @@ ms.topic: article
|
||||
---
|
||||
# Configure Device Registration for Hybrid Azure AD joined Windows Hello for Business
|
||||
|
||||
[!INCLUDE [hello-hybrid-key-trust](../../includes/hello-hybrid-cert-trust-ad.md)]
|
||||
[!INCLUDE [hello-hybrid-key-trust](./includes/hello-hybrid-cert-trust-ad.md)]
|
||||
|
||||
Your environment is federated and you're ready to configure device registration for your hybrid environment. Hybrid Windows Hello for Business deployment needs device registration and device write-back to enable proper device authentication.
|
||||
|
||||
|
||||
@ -8,7 +8,7 @@ ms.topic: article
|
||||
---
|
||||
# Hybrid Azure AD joined Windows Hello for Business Prerequisites
|
||||
|
||||
[!INCLUDE [hello-hybrid-key-trust](../../includes/hello-hybrid-cert-trust.md)]
|
||||
[!INCLUDE [hello-hybrid-key-trust](./includes/hello-hybrid-cert-trust.md)]
|
||||
|
||||
Hybrid environments are distributed systems that enable organizations to use on-premises and Azure-based identities and resources. Windows Hello for Business uses the existing distributed system as a foundation on which organizations can provide two-factor authentication that provides a single sign-in like experience to modern resources.
|
||||
|
||||
|
||||
@ -8,7 +8,7 @@ ms.topic: article
|
||||
---
|
||||
# Hybrid Azure AD joined Certificate Trust Deployment
|
||||
|
||||
[!INCLUDE [hello-hybrid-key-trust](../../includes/hello-hybrid-cert-trust.md)]
|
||||
[!INCLUDE [hello-hybrid-key-trust](./includes/hello-hybrid-cert-trust.md)]
|
||||
|
||||
Windows Hello for Business replaces username and password sign-in to Windows with strong user authentication based on asymmetric key pair. The following deployment guide provides the information needed to successfully deploy Windows Hello for Business in a hybrid certificate trust scenario.
|
||||
|
||||
|
||||
@ -8,7 +8,7 @@ ms.topic: article
|
||||
---
|
||||
# Hybrid Azure AD joined Windows Hello for Business Certificate Trust Provisioning
|
||||
|
||||
[!INCLUDE [hello-hybrid-key-trust](../../includes/hello-hybrid-cert-trust.md)]
|
||||
[!INCLUDE [hello-hybrid-key-trust](./includes/hello-hybrid-cert-trust.md)]
|
||||
|
||||
## Provisioning
|
||||
|
||||
|
||||
@ -8,7 +8,7 @@ ms.topic: article
|
||||
---
|
||||
# Configure Hybrid Azure AD joined Windows Hello for Business: Active Directory
|
||||
|
||||
[!INCLUDE [hello-hybrid-key-trust](../../includes/hello-hybrid-cert-trust.md)]
|
||||
[!INCLUDE [hello-hybrid-key-trust](./includes/hello-hybrid-cert-trust.md)]
|
||||
|
||||
The key synchronization process for the hybrid deployment of Windows Hello for Business needs the Windows Server 2016 Active Directory schema.
|
||||
|
||||
|
||||
@ -8,7 +8,7 @@ ms.topic: article
|
||||
---
|
||||
# Configure Hybrid Azure AD joined Windows Hello for Business: Active Directory Federation Services
|
||||
|
||||
[!INCLUDE [hello-hybrid-key-trust](../../includes/hello-hybrid-cert-trust.md)]
|
||||
[!INCLUDE [hello-hybrid-key-trust](./includes/hello-hybrid-cert-trust.md)]
|
||||
|
||||
## Federation Services
|
||||
|
||||
|
||||
@ -9,7 +9,7 @@ ms.topic: article
|
||||
|
||||
# Configure Hybrid Azure AD joined Windows Hello for Business- Directory Synchronization
|
||||
|
||||
[!INCLUDE [hello-hybrid-key-trust](../../includes/hello-hybrid-cert-trust.md)]
|
||||
[!INCLUDE [hello-hybrid-key-trust](./includes/hello-hybrid-cert-trust.md)]
|
||||
|
||||
## Directory Synchronization
|
||||
|
||||
|
||||
@ -9,7 +9,7 @@ ms.topic: article
|
||||
|
||||
# Configure Hybrid Azure AD joined Windows Hello for Business - Public Key Infrastructure
|
||||
|
||||
[!INCLUDE [hello-hybrid-key-trust](../../includes/hello-hybrid-cert-trust.md)]
|
||||
[!INCLUDE [hello-hybrid-key-trust](./includes/hello-hybrid-cert-trust.md)]
|
||||
|
||||
Windows Hello for Business deployments rely on certificates. Hybrid deployments use publicly-issued server authentication certificates to validate the name of the server to which they are connecting and to encrypt the data that flows between them and the client computer.
|
||||
|
||||
|
||||
@ -8,7 +8,7 @@ ms.topic: article
|
||||
---
|
||||
# Configure Hybrid Azure AD joined Windows Hello for Business - Group Policy
|
||||
|
||||
[!INCLUDE [hello-hybrid-key-trust](../../includes/hello-hybrid-cert-trust-ad.md)]
|
||||
[!INCLUDE [hello-hybrid-key-trust](./includes/hello-hybrid-cert-trust-ad.md)]
|
||||
|
||||
## Policy Configuration
|
||||
|
||||
|
||||
@ -8,7 +8,7 @@ ms.topic: article
|
||||
---
|
||||
# Configure Hybrid Azure AD joined Windows Hello for Business
|
||||
|
||||
[!INCLUDE [hello-hybrid-key-trust](../../includes/hello-hybrid-cert-trust.md)]
|
||||
[!INCLUDE [hello-hybrid-key-trust](./includes/hello-hybrid-cert-trust.md)]
|
||||
|
||||
Your environment is federated and you are ready to configure your hybrid environment for Windows Hello for business using the certificate trust model.
|
||||
> [!IMPORTANT]
|
||||
|
||||
@ -8,7 +8,7 @@ ms.topic: article
|
||||
---
|
||||
# Cloud Kerberos trust deployment
|
||||
|
||||
[!INCLUDE [hello-hybrid-key-trust](../../includes/hello-hybrid-cloudkerb-trust.md)]
|
||||
[!INCLUDE [hello-hybrid-key-trust](./includes/hello-hybrid-cloudkerb-trust.md)]
|
||||
|
||||
Windows Hello for Business replaces password sign-in with strong authentication, using an asymmetric key pair. This deployment guide provides the information to successfully deploy Windows Hello for Business in a cloud Kerberos trust scenario.
|
||||
|
||||
|
||||
@ -9,7 +9,7 @@ ms.topic: tutorial
|
||||
---
|
||||
# Configure and validate the Public Key Infrastructure - hybrid key trust
|
||||
|
||||
[!INCLUDE [hello-hybrid-key-trust](../../includes/hello-hybrid-key-trust.md)]
|
||||
[!INCLUDE [hello-hybrid-key-trust](./includes/hello-hybrid-key-trust.md)]
|
||||
|
||||
Windows Hello for Business must have a Public Key Infrastructure (PKI) when using the *key trust* or *certificate trust* models. The domain controllers must have a certificate, which serves as a *root of trust* for clients. The certificate ensures that clients don't communicate with rogue domain controllers.
|
||||
|
||||
|
||||
@ -9,7 +9,7 @@ ms.topic: how-to
|
||||
---
|
||||
# Hybrid key trust deployment
|
||||
|
||||
[!INCLUDE [hello-hybrid-key-trust](../../includes/hello-hybrid-key-trust.md)]
|
||||
[!INCLUDE [hello-hybrid-key-trust](./includes/hello-hybrid-key-trust.md)]
|
||||
|
||||
Windows Hello for Business replaces password sign-in with strong authentication, using an asymmetric key pair. This deployment guide provides the information to deploy Windows Hello for Business in a hybrid key trust trust scenario.
|
||||
|
||||
|
||||
@ -9,7 +9,7 @@ ms.topic: tutorial
|
||||
---
|
||||
# Prepare and deploy Active Directory Federation Services - on-premises key trust
|
||||
|
||||
[!INCLUDE [hello-on-premises-key-trust](../../includes/hello-on-premises-key-trust.md)]
|
||||
[!INCLUDE [hello-on-premises-key-trust](./includes/hello-on-premises-key-trust.md)]
|
||||
|
||||
Windows Hello for Business works exclusively with the Active Directory Federation Service (AD FS) role included with Windows Server. The on-premises key trust deployment model uses AD FS for *key registration* and *device registration*.
|
||||
|
||||
|
||||
@ -9,7 +9,7 @@ ms.topic: tutorial
|
||||
---
|
||||
# Configure Windows Hello for Business group policy settings - on-premises key trust
|
||||
|
||||
[!INCLUDE [hello-on-premises-key-trust](../../includes/hello-on-premises-key-trust.md)]
|
||||
[!INCLUDE [hello-on-premises-key-trust](./includes/hello-on-premises-key-trust.md)]
|
||||
|
||||
On-premises key trust deployments of Windows Hello for Business need one Group Policy setting: *Enable Windows Hello for Business*.
|
||||
The Group Policy setting determines whether users are allowed, and prompted, to enroll for Windows Hello for Business. It can be configured for computers or users.
|
||||
|
||||
@ -9,7 +9,7 @@ ms.topic: tutorial
|
||||
---
|
||||
# Validate Active Directory prerequisites - on-premises key trust
|
||||
|
||||
[!INCLUDE [hello-on-premises-key-trust](../../includes/hello-on-premises-key-trust.md)]
|
||||
[!INCLUDE [hello-on-premises-key-trust](./includes/hello-on-premises-key-trust.md)]
|
||||
|
||||
Key trust deployments need an adequate number of domain controllers to ensure successful user authentication with Windows Hello for Business. To learn more about domain controller planning for key trust deployments, read the [Windows Hello for Business planning guide](hello-planning-guide.md) and the [Planning an adequate number of Domain Controllers for Windows Hello for Business deployments](hello-adequate-domain-controllers.md) section.
|
||||
|
||||
|
||||
@ -10,7 +10,7 @@ ms.topic: tutorial
|
||||
|
||||
# Validate and deploy multi-factor authentication - on-premises key trust
|
||||
|
||||
[!INCLUDE [hello-on-premises-key-trust](../../includes/hello-on-premises-key-trust.md)]
|
||||
[!INCLUDE [hello-on-premises-key-trust](./includes/hello-on-premises-key-trust.md)]
|
||||
|
||||
Windows Hello for Business requires users perform multi-factor authentication (MFA) prior to enroll in the service. On-premises deployments can use, as MFA option:
|
||||
|
||||
|
||||
@ -9,7 +9,7 @@ ms.topic: tutorial
|
||||
---
|
||||
# Configure and validate the Public Key Infrastructure - on-premises key trust
|
||||
|
||||
[!INCLUDE [hello-on-premises-key-trust](../../includes/hello-on-premises-key-trust.md)]
|
||||
[!INCLUDE [hello-on-premises-key-trust](./includes/hello-on-premises-key-trust.md)]
|
||||
|
||||
Windows Hello for Business must have a Public Key Infrastructure (PKI) when using the *key trust* or *certificate trust* models. The domain controllers must have a certificate, which serves as a root of trust for clients. The certificate ensures that clients don't communicate with rogue domain controllers.
|
||||
|
||||
|
||||
@ -30,7 +30,7 @@ Domain controllers automatically request a certificate from the *Domain controll
|
||||
<br>
|
||||
|
||||
<details>
|
||||
<summary><b>Deploy the domain controller auto certificate enrollment GPO</summary>
|
||||
<summary><b>Deploy the domain controller auto certificate enrollment GPO</b></summary>
|
||||
|
||||
Sign in to domain controller or management workstations with *Domain Administrator* equivalent credentials.
|
||||
|
||||
|
||||
@ -0,0 +1,8 @@
|
||||
---
|
||||
author: paolomatarazzo
|
||||
ms.author: paoloma
|
||||
ms.date: 12/08/2022
|
||||
ms.topic: include
|
||||
---
|
||||
|
||||
[cloud :::image type="icon" source="../../../images/icons/information.svg" border="false":::](../hello-how-it-works-technology.md#cloud-deployment "For organizations using Azure AD-only identities. Device management is usually done via Intune/MDM")
|
||||
@ -0,0 +1,8 @@
|
||||
---
|
||||
author: paolomatarazzo
|
||||
ms.author: paoloma
|
||||
ms.date: 12/08/2022
|
||||
ms.topic: include
|
||||
---
|
||||
|
||||
[hybrid :::image type="icon" source="../../../images/icons/information.svg" border="false":::](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-deployment "For organizations using Active Directory identities synchronized to Azure AD. Device management is usually done via Group Policy or Intune/MDM")
|
||||
@ -0,0 +1,8 @@
|
||||
---
|
||||
author: paolomatarazzo
|
||||
ms.author: paoloma
|
||||
ms.date: 12/08/2022
|
||||
ms.topic: include
|
||||
---
|
||||
|
||||
[on-premises :::image type="icon" source="../../../images/icons/information.svg" border="false":::](../identity-protection/hello-for-business/hello-how-it-works-technology.md#on-premises-deployment "For organizations using Active Directory identities, not synchronized to Azure AD. Device management is usually done via Group Policy")
|
||||
@ -0,0 +1,8 @@
|
||||
---
|
||||
author: paolomatarazzo
|
||||
ms.author: paoloma
|
||||
ms.date: 12/08/2022
|
||||
ms.topic: include
|
||||
---
|
||||
|
||||
[Azure AD join :::image type="icon" source="../../../images/icons/information.svg" border="false":::](../hello-how-it-works-technology.md#azure-active-directory-join "Devices that are Azure AD joined do not have any dependencies on Active Directory. Only local users accounts and Azure AD users can sign in to these devices")
|
||||
@ -0,0 +1,8 @@
|
||||
---
|
||||
author: paolomatarazzo
|
||||
ms.author: paoloma
|
||||
ms.date: 12/08/2022
|
||||
ms.topic: include
|
||||
---
|
||||
|
||||
[domain join :::image type="icon" source="../../../images/icons/information.svg" border="false":::](../identity-protection/hello-for-business/hello-how-it-works-technology.md "Devices that are domain joined do not have any dependencies on Azure AD. Only local users accounts and Active Directory users can sign in to these devices")
|
||||
@ -0,0 +1,8 @@
|
||||
---
|
||||
author: paolomatarazzo
|
||||
ms.author: paoloma
|
||||
ms.date: 12/08/2022
|
||||
ms.topic: include
|
||||
---
|
||||
|
||||
[hybrid Azure AD join :::image type="icon" source="../../../images/icons/information.svg" border="false":::](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-azure-ad-join "Devices that are hybrid Azure AD joined don't have any dependencies on Azure AD. Only local users accounts and Active Directory users can sign in to these devices. Active Directory users that are synchronized to Azure AD will have single-sign on to both Active Directory and Azure AD-protected resources")
|
||||
@ -0,0 +1,8 @@
|
||||
---
|
||||
author: paolomatarazzo
|
||||
ms.author: paoloma
|
||||
ms.date: 12/08/2022
|
||||
ms.topic: include
|
||||
---
|
||||
|
||||
[certificate trust :::image type="icon" source="../../../images/icons/information.svg" border="false":::](../identity-protection/hello-for-business/hello-how-it-works-technology.md#certificate-trust "This trust type uses a certificate to authenticate the users to Active Directory. It's required to issue certificates to the users and to the domain controllers")
|
||||
@ -0,0 +1,8 @@
|
||||
---
|
||||
author: paolomatarazzo
|
||||
ms.author: paoloma
|
||||
ms.date: 12/08/2022
|
||||
ms.topic: include
|
||||
---
|
||||
|
||||
[cloud Kerberos trust :::image type="icon" source="../../../images/icons/information.svg" border="false":::](../identity-protection/hello-for-business/hello-how-it-works-technology.md#cloud-kerberos-trust "This trust type uses security keys to authenticate the users to Active Directory. It's not required to issue any certificates, making it the recommended choice for environments that do not need certificate authentication")
|
||||
@ -0,0 +1,8 @@
|
||||
---
|
||||
author: paolomatarazzo
|
||||
ms.author: paoloma
|
||||
ms.date: 12/08/2022
|
||||
ms.topic: include
|
||||
---
|
||||
|
||||
[key trust :::image type="icon" source="../../../images/icons/information.svg" border="false":::](../identity-protection/hello-for-business/hello-how-it-works-technology.md#key-trust "This trust type uses a raw key to authenticate the users to Active Directory. It's not required to issue certificates to users, but it's required to deploy certificates to domain controllers")
|
||||
@ -1,8 +0,0 @@
|
||||
---
|
||||
author: paolomatarazzo
|
||||
ms.author: paoloma
|
||||
ms.date: 12/08/2022
|
||||
ms.topic: include
|
||||
---
|
||||
|
||||
[cloud :::image type="icon" source="../images/icons/information.svg" border="false":::](../identity-protection/hello-for-business/hello-how-it-works-technology.md#cloud-deployment "For organizations using Azure AD-only identities. Device management is usually done via Intune/MDM")
|
||||
@ -1,8 +0,0 @@
|
||||
---
|
||||
author: paolomatarazzo
|
||||
ms.author: paoloma
|
||||
ms.date: 12/08/2022
|
||||
ms.topic: include
|
||||
---
|
||||
|
||||
[hybrid :::image type="icon" source="../images/icons/information.svg" border="false":::](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-deployment "For organizations using Active Directory identities synchronized to Azure AD. Device management is usually done via Group Policy or Intune/MDM")
|
||||
@ -1,8 +0,0 @@
|
||||
---
|
||||
author: paolomatarazzo
|
||||
ms.author: paoloma
|
||||
ms.date: 12/08/2022
|
||||
ms.topic: include
|
||||
---
|
||||
|
||||
[on-premises :::image type="icon" source="../images/icons/information.svg" border="false":::](../identity-protection/hello-for-business/hello-how-it-works-technology.md#on-premises-deployment "For organizations using Active Directory identities, not synchronized to Azure AD. Device management is usually done via Group Policy")
|
||||
@ -1,8 +0,0 @@
|
||||
---
|
||||
author: paolomatarazzo
|
||||
ms.author: paoloma
|
||||
ms.date: 12/08/2022
|
||||
ms.topic: include
|
||||
---
|
||||
|
||||
[Azure AD join :::image type="icon" source="../images/icons/information.svg" border="false":::](../identity-protection/hello-for-business/hello-how-it-works-technology.md#azure-active-directory-join "Devices that are Azure AD joined do not have any dependencies on Active Directory. Only local users accounts and Azure AD users can sign in to these devices")
|
||||
@ -1,8 +0,0 @@
|
||||
---
|
||||
author: paolomatarazzo
|
||||
ms.author: paoloma
|
||||
ms.date: 12/08/2022
|
||||
ms.topic: include
|
||||
---
|
||||
|
||||
[domain join :::image type="icon" source="../images/icons/information.svg" border="false":::](../identity-protection/hello-for-business/hello-how-it-works-technology.md "Devices that are domain joined do not have any dependencies on Azure AD. Only local users accounts and Active Directory users can sign in to these devices")
|
||||
@ -1,8 +0,0 @@
|
||||
---
|
||||
author: paolomatarazzo
|
||||
ms.author: paoloma
|
||||
ms.date: 12/08/2022
|
||||
ms.topic: include
|
||||
---
|
||||
|
||||
[hybrid Azure AD join :::image type="icon" source="../images/icons/information.svg" border="false":::](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-azure-ad-join "Devices that are hybrid Azure AD joined don't have any dependencies on Azure AD. Only local users accounts and Active Directory users can sign in to these devices. Active Directory users that are synchronized to Azure AD will have single-sign on to both Active Directory and Azure AD-protected resources")
|
||||
@ -1,8 +0,0 @@
|
||||
---
|
||||
author: paolomatarazzo
|
||||
ms.author: paoloma
|
||||
ms.date: 12/08/2022
|
||||
ms.topic: include
|
||||
---
|
||||
|
||||
[certificate trust :::image type="icon" source="../images/icons/information.svg" border="false":::](../identity-protection/hello-for-business/hello-how-it-works-technology.md#certificate-trust "This trust type uses a certificate to authenticate the users to Active Directory. It's required to issue certificates to the users and to the domain controllers")
|
||||
@ -1,8 +0,0 @@
|
||||
---
|
||||
author: paolomatarazzo
|
||||
ms.author: paoloma
|
||||
ms.date: 12/08/2022
|
||||
ms.topic: include
|
||||
---
|
||||
|
||||
[cloud Kerberos trust :::image type="icon" source="../images/icons/information.svg" border="false":::](../identity-protection/hello-for-business/hello-how-it-works-technology.md#cloud-kerberos-trust "This trust type uses security keys to authenticate the users to Active Directory. It's not required to issue any certificates, making it the recommended choice for environments that do not need certificate authentication")
|
||||
@ -1,8 +0,0 @@
|
||||
---
|
||||
author: paolomatarazzo
|
||||
ms.author: paoloma
|
||||
ms.date: 12/08/2022
|
||||
ms.topic: include
|
||||
---
|
||||
|
||||
[key trust :::image type="icon" source="../images/icons/information.svg" border="false":::](../identity-protection/hello-for-business/hello-how-it-works-technology.md#key-trust "This trust type uses a raw key to authenticate the users to Active Directory. It's not required to issue certificates to users, but it's required to deploy certificates to domain controllers")
|
||||
Reference in New Issue
Block a user