diff --git a/windows/security/identity-protection/hello-for-business/WebAuthnAPIs.md b/windows/security/identity-protection/hello-for-business/WebAuthnAPIs.md index 92e56d01b5..9b8365686e 100644 --- a/windows/security/identity-protection/hello-for-business/WebAuthnAPIs.md +++ b/windows/security/identity-protection/hello-for-business/WebAuthnAPIs.md @@ -6,8 +6,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: prsriva manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -15,17 +15,17 @@ localizationpriority: medium ms.date: 02/15/2019 ms.reviewer: --- -# WebAuthn APIs for password-less authentication on Windows - +# WebAuthn APIs for password-less authentication on Windows ### Passwords leave your customers vulnerable. With the new WebAuthn APIs, your sites and apps can use password-less authentication. Microsoft has long been a proponent to do away with passwords. While working towards that goal, we'd like to introduce you to the latest Windows 10 (version 1903) W3C/FIDO2 Win32 WebAuthn platform APIs! These APIs allow Microsoft developer partners and the developer community to use Windows Hello and FIDO2 security keys -as a password-less authentication mechanism for their applications on Windows devices. +as a password-less authentication mechanism for their applications on Windows devices. #### What does this mean? + This opens opportunities for developers or relying parties (RPs') to enable password-less authentication. They can now use [Windows Hello](./index.yml) or [FIDO2 Security Keys](./microsoft-compatible-security-key.md) as a password-less multi-factor credential for authentication. @@ -39,7 +39,8 @@ The native Windows 10 WebAuthn APIs are currently supported by Microsoft Edge on Developers of FIDO2 authentication keys should use the new Windows 10 APIs, to enable these scenarios in a consistent way for users. Moreover, this enables the use of all the transports available per FIDO2 specifications - USB, NFC, and BLE without having to deal with the interaction and management overhead. -This also implies browsers or apps on Windows 10 will no longer have direct access to above transports for FIDO-related messaging. +This also implies browsers or apps on Windows 10 will no longer have direct access to above transports for FIDO-related messaging. #### Where can developers learn more? -The new Windows 10 APIs are documented on [GitHub](https://github.com/Microsoft/webauthn) \ No newline at end of file + +The new Windows 10 APIs are documented on [GitHub](https://github.com/Microsoft/webauthn) diff --git a/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md b/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md index f208a8b623..1cc41effde 100644 --- a/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md +++ b/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: prsriva manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/hello-aad-join-cloud-only-deploy.md b/windows/security/identity-protection/hello-for-business/hello-aad-join-cloud-only-deploy.md index a645f56f3b..9afeccfdbd 100644 --- a/windows/security/identity-protection/hello-for-business/hello-aad-join-cloud-only-deploy.md +++ b/windows/security/identity-protection/hello-for-business/hello-aad-join-cloud-only-deploy.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: prsriva manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/hello-adequate-domain-controllers.md b/windows/security/identity-protection/hello-for-business/hello-adequate-domain-controllers.md index a7761bfd94..fae8060193 100644 --- a/windows/security/identity-protection/hello-for-business/hello-adequate-domain-controllers.md +++ b/windows/security/identity-protection/hello-for-business/hello-adequate-domain-controllers.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: prsriva manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/hello-and-password-changes.md b/windows/security/identity-protection/hello-for-business/hello-and-password-changes.md index 44dc96c2b7..ce4fee62d1 100644 --- a/windows/security/identity-protection/hello-for-business/hello-and-password-changes.md +++ b/windows/security/identity-protection/hello-for-business/hello-and-password-changes.md @@ -8,8 +8,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: prsriva manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/hello-biometrics-in-enterprise.md b/windows/security/identity-protection/hello-for-business/hello-biometrics-in-enterprise.md index e6b66a231d..fb5244ee95 100644 --- a/windows/security/identity-protection/hello-for-business/hello-biometrics-in-enterprise.md +++ b/windows/security/identity-protection/hello-for-business/hello-biometrics-in-enterprise.md @@ -8,8 +8,8 @@ ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: prsriva manager: dansimp ms.collection: - M365-identity-device-management diff --git a/windows/security/identity-protection/hello-for-business/hello-cert-trust-adfs.md b/windows/security/identity-protection/hello-for-business/hello-cert-trust-adfs.md index 78a031e4af..c9023f3eab 100644 --- a/windows/security/identity-protection/hello-for-business/hello-cert-trust-adfs.md +++ b/windows/security/identity-protection/hello-for-business/hello-cert-trust-adfs.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: prsriva manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/hello-cert-trust-policy-settings.md b/windows/security/identity-protection/hello-for-business/hello-cert-trust-policy-settings.md index 8fecc4d5ee..18e5489911 100644 --- a/windows/security/identity-protection/hello-for-business/hello-cert-trust-policy-settings.md +++ b/windows/security/identity-protection/hello-for-business/hello-cert-trust-policy-settings.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: prsriva manager: dansimp ms.collection: - M365-identity-device-management diff --git a/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-ad-prereq.md b/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-ad-prereq.md index e89eef978c..53a69d9ca8 100644 --- a/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-ad-prereq.md +++ b/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-ad-prereq.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: prsriva manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-deploy-mfa.md b/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-deploy-mfa.md index 2cd3770d1b..baa09b6712 100644 --- a/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-deploy-mfa.md +++ b/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-deploy-mfa.md @@ -1,14 +1,14 @@ --- title: Validate and Deploy MFA for Windows Hello for Business with certificate trust -description: How to Validate and Deploy Multifactor Authentication (MFA) Services for Windows Hello for Business with certificate trust +description: How to Validate and Deploy Multi-factor Authentication (MFA) Services for Windows Hello for Business with certificate trust keywords: identity, PIN, biometric, Hello, passport ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: prsriva manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -16,7 +16,7 @@ localizationpriority: medium ms.date: 08/19/2018 ms.reviewer: --- -# Validate and Deploy Multifactor Authentication feature +# Validate and Deploy Multi-Factor Authentication feature **Applies to** @@ -25,15 +25,15 @@ ms.reviewer: - On-premises deployment - Certificate trust -Windows Hello for Business requires all users perform multifactor authentication prior to creating and registering a Windows Hello for Business credential. On-premises deployments can use certificates, third-party authentication providers for AD FS, or a custom authentication provider for AD FS as an on-premises MFA option. +Windows Hello for Business requires all users perform multi-factor authentication prior to creating and registering a Windows Hello for Business credential. On-premises deployments can use certificates, third-party authentication providers for AD FS, or a custom authentication provider for AD FS as an on-premises MFA option. -For information on available third-party authentication methods see [Configure Additional Authentication Methods for AD FS](/windows-server/identity/ad-fs/operations/configure-additional-authentication-methods-for-ad-fs). For creating a custom authentication method see [Build a Custom Authentication Method for AD FS in Windows Server](/windows-server/identity/ad-fs/development/ad-fs-build-custom-auth-method) +For information on available third-party authentication methods, see [Configure Additional Authentication Methods for AD FS](/windows-server/identity/ad-fs/operations/configure-additional-authentication-methods-for-ad-fs). For creating a custom authentication method, see [Build a Custom Authentication Method for AD FS in Windows Server](/windows-server/identity/ad-fs/development/ad-fs-build-custom-auth-method) -Follow the integration and deployment guide for the authentication provider you select to integrate and deploy it to AD FS. Make sure that the authentication provider is selected as a multifactor authentication option in the AD FS authentication policy. For information on configuring AD FS authentication policies see [Configure Authentication Policies](/windows-server/identity/ad-fs/operations/configure-authentication-policies). +Follow the integration and deployment guide for the authentication provider you select to integrate and deploy it to AD FS. Make sure that the authentication provider is selected as a multi-factor authentication option in the AD FS authentication policy. For information on configuring AD FS authentication policies, see [Configure Authentication Policies](/windows-server/identity/ad-fs/operations/configure-authentication-policies). ## Follow the Windows Hello for Business on premises certificate trust deployment guide 1. [Validate Active Directory prerequisites](hello-cert-trust-validate-ad-prereq.md) 2. [Validate and Configure Public Key Infrastructure](hello-cert-trust-validate-pki.md) 3. [Prepare and Deploy Windows Server 2016 Active Directory Federation Services](hello-cert-trust-adfs.md) -4. Validate and Deploy Multifactor Authentication Services (MFA) (*You are here*) +4. Validate and Deploy Multi-factor Authentication Services (MFA) (*You're here*) 5. [Configure Windows Hello for Business Policy settings](hello-cert-trust-policy-settings.md) \ No newline at end of file diff --git a/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-pki.md b/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-pki.md index 366ce9b8bb..1972c3d210 100644 --- a/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-pki.md +++ b/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-pki.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: prsriva manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/hello-deployment-cert-trust.md b/windows/security/identity-protection/hello-for-business/hello-deployment-cert-trust.md index f802872ce7..ca84dfc5d4 100644 --- a/windows/security/identity-protection/hello-for-business/hello-deployment-cert-trust.md +++ b/windows/security/identity-protection/hello-for-business/hello-deployment-cert-trust.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: prsriva manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -19,17 +19,18 @@ ms.reviewer: # On Premises Certificate Trust Deployment **Applies to** -- Windows 10, version 1703 or later -- Windows 11 -- On-premises deployment -- Certificate trust +- Windows 10, version 1703 or later +- Windows 11 +- On-premises deployment +- Certificate trust -Windows Hello for Business replaces username and password sign-in to Windows with strong user authentication based on asymmetric key pair. The following deployment guide provides the information needed to successfully deploy Windows Hello for Business in an existing environment. +Windows Hello for Business replaces username and password sign-in to Windows with authentication using an asymmetric key pair. This deployment guide provides the information you'll need to successfully deploy Windows Hello for Business in an existing environment. + +Below, you can find all the information needed to deploy Windows Hello for Business in a Certificate Trust Model in your on-premises environment: -Below, you can find all the information you will need to deploy Windows Hello for Business in a Certificate Trust Model in your on-premises environment: 1. [Validate Active Directory prerequisites](hello-cert-trust-validate-ad-prereq.md) 2. [Validate and Configure Public Key Infrastructure](hello-cert-trust-validate-pki.md) 3. [Prepare and Deploy Windows Server 2016 Active Directory Federation Services](hello-cert-trust-adfs.md) -4. [Validate and Deploy Multifactor Authentication Services (MFA)](hello-cert-trust-validate-deploy-mfa.md) +4. [Validate and Deploy Multi-factor Authentication Services (MFA)](hello-cert-trust-validate-deploy-mfa.md) 5. [Configure Windows Hello for Business Policy settings](hello-cert-trust-policy-settings.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-deployment-guide.md b/windows/security/identity-protection/hello-for-business/hello-deployment-guide.md index c04d24c0e6..1a167b69c6 100644 --- a/windows/security/identity-protection/hello-for-business/hello-deployment-guide.md +++ b/windows/security/identity-protection/hello-for-business/hello-deployment-guide.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: prsriva manager: dansimp ms.collection: - M365-identity-device-management diff --git a/windows/security/identity-protection/hello-for-business/hello-deployment-issues.md b/windows/security/identity-protection/hello-for-business/hello-deployment-issues.md index 41f1a39158..16f8e33766 100644 --- a/windows/security/identity-protection/hello-for-business/hello-deployment-issues.md +++ b/windows/security/identity-protection/hello-for-business/hello-deployment-issues.md @@ -8,8 +8,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: prsriva manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/hello-deployment-key-trust.md b/windows/security/identity-protection/hello-for-business/hello-deployment-key-trust.md index 5a525a6f6a..0798dee5a2 100644 --- a/windows/security/identity-protection/hello-for-business/hello-deployment-key-trust.md +++ b/windows/security/identity-protection/hello-for-business/hello-deployment-key-trust.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: prsriva manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -19,29 +19,18 @@ ms.reviewer: # On Premises Key Trust Deployment **Applies to** -- Windows 10, version 1703 or later -- Windows 11 -- On-premises deployment -- Key trust +- Windows 10, version 1703 or later +- Windows 11 +- On-premises deployment +- Key trust Windows Hello for Business replaces username and password sign-in to Windows with strong user authentication based on asymmetric key pair. The following deployment guide provides the information needed to successfully deploy Windows Hello for Business in an existing environment. Below, you can find all the information you need to deploy Windows Hello for Business in a key trust model in your on-premises environment: + 1. [Validate Active Directory prerequisites](hello-key-trust-validate-ad-prereq.md) 2. [Validate and Configure Public Key Infrastructure](hello-key-trust-validate-pki.md) 3. [Prepare and Deploy Windows Server 2016 Active Directory Federation Services](hello-key-trust-adfs.md) 4. [Validate and Deploy Multifactor Authentication Services (MFA)](hello-key-trust-validate-deploy-mfa.md) 5. [Configure Windows Hello for Business Policy settings](hello-key-trust-policy-settings.md) - - - - - - - - - - - - diff --git a/windows/security/identity-protection/hello-for-business/hello-deployment-rdp-certs.md b/windows/security/identity-protection/hello-for-business/hello-deployment-rdp-certs.md index ec0411f5bd..741371c28d 100644 --- a/windows/security/identity-protection/hello-for-business/hello-deployment-rdp-certs.md +++ b/windows/security/identity-protection/hello-for-business/hello-deployment-rdp-certs.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: prsriva manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation.md b/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation.md index e5e4fe1324..72148e773a 100644 --- a/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation.md +++ b/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation.md @@ -8,8 +8,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: prsriva manager: dansimp ms.collection: - M365-identity-device-management diff --git a/windows/security/identity-protection/hello-for-business/hello-event-300.md b/windows/security/identity-protection/hello-for-business/hello-event-300.md index 5eecb9ecac..c5e10be931 100644 --- a/windows/security/identity-protection/hello-for-business/hello-event-300.md +++ b/windows/security/identity-protection/hello-for-business/hello-event-300.md @@ -9,8 +9,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: prsriva manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -25,7 +25,6 @@ ms.date: 07/27/2017 - Windows 10 - Windows 11 - This event is created when Windows Hello for Business is successfully created and registered with Azure Active Directory (Azure AD). Applications or services can trigger actions on this event. For example, a certificate provisioning service can listen to this event and trigger a certificate request. ## Event details diff --git a/windows/security/identity-protection/hello-for-business/hello-faq.yml b/windows/security/identity-protection/hello-for-business/hello-faq.yml index 88951c747a..9f55046b76 100644 --- a/windows/security/identity-protection/hello-for-business/hello-faq.yml +++ b/windows/security/identity-protection/hello-for-business/hello-faq.yml @@ -8,8 +8,8 @@ metadata: ms.sitesec: library ms.pagetype: security, mobile audience: ITPro - author: mapalko - ms.author: mapalko + author: GitPrakhar13 + ms.author: prsriva manager: dansimp ms.collection: - M365-identity-device-management @@ -26,13 +26,14 @@ summary: | sections: - name: Ignored questions: + - question: What is Windows Hello for Business cloud trust? answer: | Windows Hello for Business cloud trust is a new trust model that is currently in preview. This trust model will enable Windows Hello for Business deployment using the infrastructure introduced for supporting [security key sign-in on Hybrid Azure AD joined devices and on-premises resource access on Azure AD Joined devices](/azure/active-directory/authentication/howto-authentication-passwordless-security-key-on-premises). Cloud trust is the preferred deployment model if you do not need to support certificate authentication scenarios. For more information, see [Hybrid Cloud Trust Deployment (Preview)](/windows/security/identity-protection/hello-for-business/hello-hybrid-cloud-trust). - + - question: What about virtual smart cards? answer: | - Windows Hello for Business is the modern, two-factor credential for Windows 10. Microsoft will be deprecating virtual smart cards in the future, but no date is set at this time. Customers using Windows 10 and virtual smart cards should move to Windows Hello for Business. Microsoft will publish the date early to ensure customers have adequate lead time to move to Windows Hello for Business. Microsoft recommends that new Windows 10 deployments use Windows Hello for Business. Virtual smart card remain supported for Windows 7 and Windows 8. + Windows Hello for Business is the modern, two-factor credential for Windows 10. Microsoft will be deprecating virtual smart cards in the future, but no date is set at this time. Customers using Windows 10 and virtual smart cards should move to Windows Hello for Business. Microsoft will publish the date early to ensure customers have adequate lead time to move to Windows Hello for Business. Microsoft recommends that new Windows 10 deployments use Windows Hello for Business. Virtual smart cards remain supported for Windows 7 and Windows 8. - question: What about convenience PIN? answer: | @@ -40,43 +41,43 @@ sections: - question: Can I use Windows Hello for Business key trust and RDP? answer: | - Remote Desktop Protocol (RDP) does not currently support using key-based authentication and self-signed certificates as supplied credentials. RDP with supplied credentials is currently only supported with certificate-based deployments. Windows Hello for Business key trust can be used with [Windows Defender Remote Credential Guard](../remote-credential-guard.md). + Remote Desktop Protocol (RDP) doesn't currently support using key-based authentication and self-signed certificates as supplied credentials. RDP with supplied credentials is currently only supported with certificate-based deployments. Windows Hello for Business key trust can be used with [Windows Defender Remote Credential Guard](../remote-credential-guard.md). - question: Can I deploy Windows Hello for Business by using Microsoft Endpoint Configuration Manager? answer: | - Windows Hello for Business deployments using Configuration Manager should follow the hybrid deployment model that uses Active Directory Federation Services. Starting in Configuration Manager version 1910, certificate-based authentication with Windows Hello for Business settings isn't supported. Key-based authentication is still valid with Configuration Manager. For more information, see [Windows Hello for Business settings in Configuration Manager](/configmgr/protect/deploy-use/windows-hello-for-business-settings). + Windows Hello for Business deployments using Configuration Manager should follow the hybrid deployment model that uses Active Directory Federation Services. In Configuration Manager version 1910 and later, certificate-based authentication with Windows Hello for Business settings isn't supported. Key-based authentication is still valid with Configuration Manager. For more information, see [Windows Hello for Business settings in Configuration Manager](/configmgr/protect/deploy-use/windows-hello-for-business-settings). - question: How many users can enroll for Windows Hello for Business on a single Windows 10 computer? answer: | - The maximum number of supported enrollments on a single Windows 10 computer is 10. This lets 10 users each enroll their face and up to 10 fingerprints. While we support 10 enrollments, we will strongly encourage the use of Windows Hello security keys for the shared computer scenario when they become available. + The maximum number of supported enrollments on a single Windows 10 computer is 10. This limit lets 10 users each enroll their face and up to 10 fingerprints. While we support 10 enrollments, we'll strongly encourage the use of Windows Hello security keys for the shared computer scenario when they become available. - question: How can a PIN be more secure than a password? answer: | - When using Windows Hello for Business, the PIN is not a symmetric key, whereas the password is a symmetric key. With passwords, there's a server that has some representation of the password. With Windows Hello for Business, the PIN is user-provided entropy used to load the private key in the Trusted Platform Module (TPM). The server does not have a copy of the PIN. For that matter, the Windows client does not have a copy of the current PIN either. The user must provide the entropy, the TPM-protected key, and the TPM that generated that key in order to successfully access the private key. + The Windows Hello for Business PIN isn't a symmetric key, whereas a password is a symmetric key. With passwords, there's a server that has some representation of the password. With Windows Hello for Business, the PIN is user-provided entropy used to load the private key in the Trusted Platform Module (TPM). The server doesn't have a copy of the PIN. For that matter, the Windows client doesn't have a copy of the current PIN either. The user must provide the entropy, the TPM-protected key, and the TPM that generated that key in order to successfully access the private key. - The statement "PIN is stronger than Password" is not directed at the strength of the entropy used by the PIN. It's about the difference between providing entropy versus continuing the use of a symmetric key (the password). The TPM has anti-hammering features that thwart brute-force PIN attacks (an attacker's continuous attempt to try all combination of PINs). Some organizations may worry about shoulder surfing. For those organizations, rather than increase the complexity of the PIN, implement the [Multifactor Unlock](feature-multifactor-unlock.md) feature. + The statement "PIN is stronger than Password" isn't directed at the strength of the entropy used by the PIN. It's about the difference between providing entropy versus continuing the use of a symmetric key (the password). The TPM has anti-hammering features that thwart brute-force PIN attacks (an attacker's continuous attempt to try all combination of PINs). Some organizations may worry about shoulder surfing. For those organizations, rather than increase the complexity of the PIN, implement the [Multi-factor Unlock](feature-multifactor-unlock.md) feature. - question: How does Windows Hello for Business work with Azure AD registered devices? answer: | - On Azure AD registered devices, a user will be asked to provision a Windows Hello for Business key if the feature is enabled by mobile device management policy. If the user has an existing Windows Hello container for use with their local or Microsoft connected account, the Windows Hello for Business key will be enrolled in their existing container and will be protected using their exiting gestures. + A user will be prompted to set-up a Windows Hello for Business key on an Azure AD registered devices if the feature is enabled by policy. If the user has an existing Windows Hello container, the Windows Hello for Business key will be enrolled in that container and will be protected using their exiting gestures. If a user has signed into their Azure AD registered device with Windows Hello, their Windows Hello for Business key will be used to authenticate the user's work identity when they try to use Azure AD resources. The Windows Hello for Business key meets Azure AD multi-factor authentication (MFA) requirements and reduces the number of MFA prompts users will see when accessing resources. - It is possible to Azure AD register a domain joined device. If the domain joined device has a convenience PIN, login with the convenience PIN will no longer work. This configuration is not supported by Windows Hello for Business. + It's possible to Azure AD register a domain joined device. If the domain joined device has a convenience PIN, sign in with the convenience PIN will no longer work. This configuration isn't supported by Windows Hello for Business. - For more information please read [Azure AD registered devices](/azure/active-directory/devices/concept-azure-ad-register). + For more information, please read [Azure AD registered devices](/azure/active-directory/devices/concept-azure-ad-register). - question: I have Windows Server 2016 domain controller(s), so why is the Key Admins group missing? answer: | - The **Key Admins** and **Enterprise Key Admins** groups are created when you install the first Windows Server 2016 domain controller into a domain. Domain controllers running previous versions of Windows Server cannot translate the security identifier (SID) to a name. To resolve this, transfer the PDC emulator domain role to a domain controller running Windows Server 2016. + The **Key Admins** and **Enterprise Key Admins** groups are created when you install the first Windows Server 2016 domain controller into a domain. Domain controllers running previous versions of Windows Server can't translate the security identifier (SID) to a name. To resolve this issue, transfer the PDC emulator domain role to a domain controller running Windows Server 2016. - question: Can I use a convenience PIN with Azure Active Directory? answer: | - It's currently possible to set a convenience PIN on Azure Active Directory Joined or Hybrid Active Directory Joined devices. Convenience PIN is not supported for Azure Active Directory user accounts (synchronized identities included). It's only supported for on-premises Domain Joined users and local account users. + It's currently possible to set a convenience PIN on Azure Active Directory Joined or Hybrid Active Directory Joined devices. Convenience PIN isn't supported for Azure Active Directory user accounts (synchronized identities included). It's only supported for on-premises Domain Joined users and local account users. - question: Can I use an external Windows Hello compatible camera when my laptop is closed or docked? answer: | - Yes. Starting with Windows 10, version 21H1 an external Windows Hello compatible camera can be used if a device already supports an internal Windows Hello camera. When both cameras are present, the external camera will be be used for face authentication. For more information see [IT tools to support Windows 10, version 21H1](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/it-tools-to-support-windows-10-version-21h1/ba-p/2365103). + Yes. Starting with Windows 10, version 21H1 an external Windows Hello compatible camera can be used if a device already supports an internal Windows Hello camera. When both cameras are present, the external camera is used for face authentication. For more information, see [IT tools to support Windows 10, version 21H1](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/it-tools-to-support-windows-10-version-21h1/ba-p/2365103). - question: Why does authentication fail immediately after provisioning hybrid key trust? answer: | @@ -90,13 +91,13 @@ sections: - question: What is the user experience for Windows Hello for Business? answer: | - The user experience for Windows Hello for Business occurs after user sign-in, after you deploy Windows Hello for Business policy settings to your environment. + The user experience for Windows Hello for Business occurs after the user signs in, after you deploy Windows Hello for Business policy settings to your environment. [Windows Hello for Business user enrollment experience](hello-videos.md#windows-hello-for-business-user-enrollment-experience) - question: What happens when a user forgets their PIN? answer: | - If the user can sign-in with a password, they can reset their PIN by selecting the "I forgot my PIN" link in Settings. Beginning with Windows 10 1709, users can reset their PIN above the lock screen by selecting the "I forgot my PIN" link on the PIN credential provider. + If the user can sign in with a password, they can reset their PIN by selecting the "I forgot my PIN" link in Settings. Beginning with Windows 10 1709, users can reset their PIN above the lock screen by selecting the "I forgot my PIN" link on the PIN credential provider. [Windows Hello for Business forgotten PIN user experience](hello-videos.md#windows-hello-for-business-forgotten-pin-user-experience) @@ -112,24 +113,24 @@ sections: - accountalt.azureedge.net - secure.aadcdn.microsoftonline-p.com - If your environment uses Microsoft Intune, you need these additional URLs: + If your environment uses Microsoft Intune, you will also need these other URLs: - enrollment.manage.microsoft.com - portal.manage.microsoft.com - question: What's the difference between non-destructive and destructive PIN reset? answer: | - Windows Hello for Business has two types of PIN reset: non-destructive and destructive. Organizations running Windows 10 Enterprise and Azure Active Directory can take advantage of the Microsoft PIN Reset service. Once onboarded to a tenant and deployed to computers, users who have forgotten their PINs can authenticate to Azure, provide a second factor of authentication, and reset their PIN without re-provisioning a new Windows Hello for Business enrollment. This is a non-destructive PIN reset because the user doesn't delete the current credential and obtain a new one. For more information, see [PIN Reset](hello-feature-pin-reset.md). + Windows Hello for Business has two types of PIN reset: non-destructive and destructive. Organizations running Windows 10 Enterprise and Azure Active Directory can take advantage of the Microsoft PIN Reset service. Once on-boarded to a tenant and deployed to computers, users who have forgotten their PINs can authenticate to Azure, provide a second factor of authentication, and reset their PIN without reprovisioning a new Windows Hello for Business enrollment. This flow is a non-destructive PIN reset because the user doesn't delete the current credential and obtain a new one. For more information, see [PIN Reset](hello-feature-pin-reset.md). - Organizations that have the on-premises deployment of Windows Hello for Business, or those not using Windows 10 Enterprise can use destructive PIN reset. With destructive PIN reset, users that have forgotten their PIN can authenticate by using their password and then performing a second factor of authentication to re-provision their Windows Hello for Business credential. Re-provisioning deletes the old credential and requests a new credential and certificate. On-premises deployments need network connectivity to their domain controllers, Active Directory Federation Services, and their issuing certificate authority to perform a destructive PIN reset. Also, for hybrid deployments, destructive PIN reset is only supported with the certificate trust model and the latest updates to Active Directory Federation Services. + Organizations that have the on-premises deployment of Windows Hello for Business, or those not using Windows 10 Enterprise can use destructive PIN reset. With destructive PIN reset, users that have forgotten their PIN can authenticate by using their password and then performing a second factor of authentication to reprovision their Windows Hello for Business credential. Reprovisioning deletes the old credential and requests a new credential and certificate. On-premises deployments need network connectivity to their domain controllers, Active Directory Federation Services, and their issuing certificate authority to perform a destructive PIN reset. For hybrid deployments, destructive PIN reset is only supported with the certificate trust model and the latest updates to Active Directory Federation Services. - question: | Which is better or more secure, key trust or certificate trust? answer: | - The trust models of your deployment determine how you authenticate to Active Directory (on-premises). Both key trust and certificate trust use the same hardware-backed, two-factor credential. The difference between the two trust types are: + The trust models of your deployment determine how you authenticate to Active Directory (on-premises). Both key trust and certificate trust use the same hardware-backed, two-factor credential. The differences between the two trust types are: - Required domain controllers - Issuing end entity certificates - The **key trust** model authenticates to Active Directory by using a raw key. Windows Server 2016 domain controllers enable this authentication. Key trust authenticate does not require an enterprise issued certificate, therefore you don't need to issue certificates to users (domain controller certificates are still needed). + The **key trust** model authenticates to Active Directory by using a raw key. Windows Server 2016 domain controllers enable this authentication. Key trust authenticate doesn't require an enterprise issued certificate, therefore you don't need to issue certificates to users (domain controller certificates are still needed). The **certificate trust** model authenticates to Active Directory by using a certificate. Because this authentication uses a certificate, domain controllers running previous versions of Windows Server can authenticate the user. Therefore, you need to issue certificates to users, but you don't need Windows Server 2016 domain controllers. The certificate used in certificate trust uses the TPM-protected private key to request a certificate from your enterprise's issuing certificate authority. @@ -139,7 +140,7 @@ sections: - question: What attributes are synchronized by Azure AD Connect with Windows Hello for Business? answer: | - Review [Azure AD Connect sync: Attributes synchronized to Azure Active Directory](/azure/active-directory/connect/active-directory-aadconnectsync-attributes-synchronized) for a list of attributes that sync based on scenarios. The base scenarios that include Windows Hello for Business are the [Windows 10](/azure/active-directory/connect/active-directory-aadconnectsync-attributes-synchronized#windows-10) scenario and the [Device writeback](/azure/active-directory/connect/active-directory-aadconnectsync-attributes-synchronized#device-writeback) scenario. Your environment may include additional attributes. + Review [Azure AD Connect sync: Attributes synchronized to Azure Active Directory](/azure/active-directory/connect/active-directory-aadconnectsync-attributes-synchronized) for a list of attributes that sync based on scenarios. The base scenarios that include Windows Hello for Business are the [Windows 10](/azure/active-directory/connect/active-directory-aadconnectsync-attributes-synchronized#windows-10) scenario and the [Device writeback](/azure/active-directory/connect/active-directory-aadconnectsync-attributes-synchronized#device-writeback) scenario. Your environment may include other attributes. - question: Is Windows Hello for Business multi-factor authentication? answer: | @@ -151,11 +152,11 @@ sections: - question: Can I use both a PIN and biometrics to unlock my device? answer: | - Starting in Windows 10, version 1709, you can use multi-factor unlock to require users to provide an additional factor to unlock their device. Authentication remains two-factor, but another factor is required before Windows allows the user to reach the desktop. To learn more, see [Multifactor Unlock](feature-multifactor-unlock.md). + Starting in Windows 10, version 1709, you can use multi-factor unlock to require users to provide an extra factor to unlock their device. Authentication remains two-factor, but another factor is required before Windows allows the user to reach the desktop. To learn more, see [Multifactor Unlock](feature-multifactor-unlock.md). - question: Can I wear a mask to enroll or unlock using Windows Hello face authentication? answer: | - Wearing a mask to enroll is a security concern because other users wearing a similar mask may be able to unlock you device. The product group is aware of this behavior and is investigating this topic further. Please remove a mask if you are wearing one when you enroll or unlock with Windows Hello face authentication. If your working environment doesn’t allow you to remove a mask temporarily, please consider unenrolling from face authentication and only using PIN or fingerprint. + Wearing a mask to enroll is a security concern because other users wearing a similar mask may be able to unlock your device. The product group is aware of this behavior and is investigating this topic further. Remove a mask if you're wearing one when you enroll or unlock with Windows Hello face authentication. If your working environment doesn’t allow you to remove a mask temporarily, consider unenrolling from face authentication and only using PIN or fingerprint. - question: What's the difference between Windows Hello and Windows Hello for Business? answer: | @@ -163,7 +164,7 @@ sections: - question: Why can't I enroll biometrics for my local, built-in administrator? answer: | - Windows 10 does not allow the local administrator to enroll biometric gestures (face or fingerprint). + Windows 10 doesn't allow the local administrator to enroll biometric gestures (face or fingerprint). - question: I have extended Active Directory to Azure Active Directory. Can I use the on-premises deployment model? answer: | @@ -171,41 +172,41 @@ sections: - question: Does Windows Hello for Business prevent the use of simple PINs? answer: | - Yes. Our simple PIN algorithm looks for and disallows any PIN that has a constant delta from one digit to the next. The algorithm counts the number of steps required to reach the next digit, overflowing at ten ('zero'). + Yes. Our simple PIN algorithm looks for and disallows any PIN that has a constant delta from one digit to the next. The algorithm counts the number of steps required to reach the next digit, overflowing at 10 ('zero'). So, for example: - - The PIN 1111 has a constant delta of (0,0,0), so it is not allowed - - The PIN 1234 has a constant delta of (1,1,1), so it is not allowed - - The PIN 1357 has a constant delta of (2,2,2), so it is not allowed - - The PIN 9630 has a constant delta of (7,7,7), so it is not allowed - - The PIN 1593 has a constant delta of (4,4,4), so it is not allowed - - The PIN 7036 has a constant delta of (3,3,3), so it is not allowed - - The PIN 1231 does not have a constant delta (1,1,8), so it is allowed - - The PIN 1872 does not have a constant delta (7,9,5), so it is allowed + - The PIN 1111 has a constant delta of (0,0,0), so it isn't allowed + - The PIN 1234 has a constant delta of (1,1,1), so it isn't allowed + - The PIN 1357 has a constant delta of (2,2,2), so it isn't allowed + - The PIN 9630 has a constant delta of (7,7,7), so it isn't allowed + - The PIN 1593 has a constant delta of (4,4,4), so it isn't allowed + - The PIN 7036 has a constant delta of (3,3,3), so it isn't allowed + - The PIN 1231 doesn't have a constant delta (1,1,8), so it's allowed + - The PIN 1872 doesn't have a constant delta (7,9,5), so it's allowed - This prevents repeating numbers, sequential numbers, and simple patterns. It always results in a list of 100 disallowed PINs (independent of the PIN length). This algorithm does not apply to alphanumeric PINs. + This check prevents repeating numbers, sequential numbers, and simple patterns. It always results in a list of 100 disallowed PINs (independent of the PIN length). This algorithm doesn't apply to alphanumeric PINs. - question: How does PIN caching work with Windows Hello for Business? answer: | - Windows Hello for Business provides a PIN caching user experience by using a ticketing system. Rather than caching a PIN, processes cache a ticket they can use to request private key operations. Azure AD and Active Directory sign-in keys are cached under lock. This means the keys remain available for use without prompting, as long as the user is interactively signed-in. Microsoft Account sign-in keys are considered transactional keys, which means the user is always prompted when accessing the key. + Windows Hello for Business provides a PIN caching user experience by using a ticketing system. Rather than caching a PIN, processes cache a ticket they can use to request private key operations. Azure AD and Active Directory sign-in keys are cached under lock. This means the keys remain available for use without prompting, as long as the user is interactively signed-in. Microsoft Account sign-in keys are transactional keys, which means the user is always prompted when accessing the key. - Beginning with Windows 10, version 1709, Windows Hello for Business used as a smart card (smart card emulation that is enabled by default) provides the same user experience of default smart card PIN caching. Each process requesting a private key operation will prompt the user for the PIN on first use. Subsequent private key operations will not prompt the user for the PIN. + Beginning with Windows 10, version 1709, Windows Hello for Business used as a smart card (smart card emulation that is enabled by default) provides the same user experience of default smart card PIN caching. Each process requesting a private key operation will prompt the user for the PIN on first use. Subsequent private key operations won't prompt the user for the PIN. - The smart card emulation feature of Windows Hello for Business verifies the PIN and then discards the PIN in exchange for a ticket. The process does not receive the PIN, but rather the ticket that grants them private key operations. Windows 10 does not provide any Group Policy settings to adjust this caching. + The smart card emulation feature of Windows Hello for Business verifies the PIN and then discards the PIN in exchange for a ticket. The process doesn't receive the PIN, but rather the ticket that grants them private key operations. Windows 10 doesn't provide any Group Policy settings to adjust this caching. - question: Can I disable the PIN while using Windows Hello for Business? answer: | - No. The movement away from passwords is accomplished by gradually reducing the use of the password. In situations where you can't authenticate by using biometrics, you need a fallback mechanism that is not a password. The PIN is the fallback mechanism. Disabling or hiding the PIN credential provider will disable the use of biometrics. + No. The movement away from passwords is accomplished by gradually reducing the use of the password. In situations where you can't authenticate by using biometrics, you need a fallback mechanism that isn't a password. The PIN is the fallback mechanism. Disabling or hiding the PIN credential provider will disable the use of biometrics. - question: How are keys protected? answer: | - Wherever possible, Windows Hello for Business takes advantage of Trusted Platform Module (TPM) 2.0 hardware to generate and protect keys. However, Windows Hello and Windows Hello for Business do not require a TPM. Administrators can choose to allow key operations in software. + Wherever possible, Windows Hello for Business takes advantage of Trusted Platform Module (TPM) 2.0 hardware to generate and protect keys. However, Windows Hello and Windows Hello for Business don't require a TPM. Administrators can choose to allow key operations in software. Whenever possible, Microsoft strongly recommends the use of TPM hardware. The TPM protects against a variety of known and potential attacks, including PIN brute-force attacks. The TPM provides an additional layer of protection after an account lockout, too. When the TPM has locked the key material, the user will need to reset the PIN (which means they'll need to use MFA to re-authenticate to the IDP before the IDP allows them to re-register). - question: Can Windows Hello for Business work in air-gapped environments? answer: | - Yes. You can use the on-premises Windows Hello for Business deployment and combine it with a third-party MFA provider that does not require internet connectivity to achieve an air-gapped Windows Hello for Business deployment. + Yes. You can use the on-premises Windows Hello for Business deployment and combine it with a third-party MFA provider that doesn't require internet connectivity to achieve an air-gapped Windows Hello for Business deployment. - question: Can I use third-party authentication providers with Windows Hello for Business? answer: | @@ -224,10 +225,9 @@ sections: - question: Does Windows Hello for Business work with Mac and Linux clients? answer: | - Windows Hello for Business is a feature of Windows 10. At this time, Microsoft is not developing clients for other platforms. However, Microsoft is open to third-parties who are interested in moving these platforms away from passwords. Interested third-parties can get more information by emailing [whfbfeedback@microsoft.com](mailto:whfbfeedback@microsoft.com?subject=collaboration). - Windows Hello for Business is a feature of the Windows platform. At this time, Microsoft is not developing clients for other platforms. + Windows Hello for Business is a feature of Windows 10. At this time, Microsoft isn't developing clients for other platforms. However, Microsoft is open to third-parties who are interested in moving these platforms away from passwords. Interested third-parties can get more information by emailing [whfbfeedback@microsoft.com](mailto:whfbfeedback@microsoft.com?subject=collaboration). + Windows Hello for Business is a feature of the Windows platform. At this time, Microsoft isn't developing clients for other platforms. - question: Does Windows Hello for Business work with Azure Active Directory Domain Services (Azure AD DS) clients? answer: | - No, Azure AD DS is a separately managed environment in Azure, and hybrid device registration with cloud Azure AD is not available for it via Azure AD Connect. Hence, Windows Hello for Business does not work with Azure AD. - + No, Azure AD DS is a separately managed environment in Azure, and hybrid device registration with cloud Azure AD isn't available for it via Azure AD Connect. Hence, Windows Hello for Business doesn't work with Azure AD. diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-conditional-access.md b/windows/security/identity-protection/hello-for-business/hello-feature-conditional-access.md index ebd49da74d..ac9768add5 100644 --- a/windows/security/identity-protection/hello-for-business/hello-feature-conditional-access.md +++ b/windows/security/identity-protection/hello-for-business/hello-feature-conditional-access.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: prsriva manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -45,4 +45,4 @@ Read [Conditional access in Azure Active Directory](/azure/active-directory/acti * [Windows Hello and password changes](hello-and-password-changes.md) * [Windows Hello errors during PIN creation](hello-errors-during-pin-creation.md) * [Event ID 300 - Windows Hello successfully created](hello-event-300.md) -* [Windows Hello biometrics in the enterprise](hello-biometrics-in-enterprise.md) \ No newline at end of file +* [Windows Hello biometrics in the enterprise](hello-biometrics-in-enterprise.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-dual-enrollment.md b/windows/security/identity-protection/hello-for-business/hello-feature-dual-enrollment.md index c1051280eb..066da6e651 100644 --- a/windows/security/identity-protection/hello-for-business/hello-feature-dual-enrollment.md +++ b/windows/security/identity-protection/hello-for-business/hello-feature-dual-enrollment.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: prsriva manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -88,4 +88,4 @@ The computer is ready for dual enrollment. Sign in as the privileged user first * [Windows Hello and password changes](hello-and-password-changes.md) * [Windows Hello errors during PIN creation](hello-errors-during-pin-creation.md) * [Event ID 300 - Windows Hello successfully created](hello-event-300.md) -* [Windows Hello biometrics in the enterprise](hello-biometrics-in-enterprise.md) \ No newline at end of file +* [Windows Hello biometrics in the enterprise](hello-biometrics-in-enterprise.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-dynamic-lock.md b/windows/security/identity-protection/hello-for-business/hello-feature-dynamic-lock.md index b7a04269f4..7d4e7d36ed 100644 --- a/windows/security/identity-protection/hello-for-business/hello-feature-dynamic-lock.md +++ b/windows/security/identity-protection/hello-for-business/hello-feature-dynamic-lock.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: prsriva manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md index 49ebf32dd9..3ab6494347 100644 --- a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md +++ b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: prsriva manager: dansimp ms.collection: - M365-identity-device-management diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-remote-desktop.md b/windows/security/identity-protection/hello-for-business/hello-feature-remote-desktop.md index 3b8be4415e..fc797a8b6e 100644 --- a/windows/security/identity-protection/hello-for-business/hello-feature-remote-desktop.md +++ b/windows/security/identity-protection/hello-for-business/hello-feature-remote-desktop.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: prsriva manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/hello-how-it-works-authentication.md b/windows/security/identity-protection/hello-for-business/hello-how-it-works-authentication.md index a0afa94e49..69d3ba639e 100644 --- a/windows/security/identity-protection/hello-for-business/hello-how-it-works-authentication.md +++ b/windows/security/identity-protection/hello-for-business/hello-how-it-works-authentication.md @@ -6,8 +6,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: prsriva manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/hello-how-it-works-provisioning.md b/windows/security/identity-protection/hello-for-business/hello-how-it-works-provisioning.md index 521b4364a4..91e6db25cf 100644 --- a/windows/security/identity-protection/hello-for-business/hello-how-it-works-provisioning.md +++ b/windows/security/identity-protection/hello-for-business/hello-how-it-works-provisioning.md @@ -6,8 +6,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: prsriva manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/hello-how-it-works-technology.md b/windows/security/identity-protection/hello-for-business/hello-how-it-works-technology.md index 4bdde9ea88..a4e61a2244 100644 --- a/windows/security/identity-protection/hello-for-business/hello-how-it-works-technology.md +++ b/windows/security/identity-protection/hello-for-business/hello-how-it-works-technology.md @@ -6,8 +6,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: prsriva manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -18,6 +18,7 @@ ms.reviewer: # Technology and Terms **Applies to:** + - Windows 10 - Windows 11 diff --git a/windows/security/identity-protection/hello-for-business/hello-how-it-works.md b/windows/security/identity-protection/hello-for-business/hello-how-it-works.md index 90514e334a..0b25b65df8 100644 --- a/windows/security/identity-protection/hello-for-business/hello-how-it-works.md +++ b/windows/security/identity-protection/hello-for-business/hello-how-it-works.md @@ -6,8 +6,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: prsriva manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-base.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-base.md index 4176bd6721..c9bbe2c198 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-base.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-base.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: prsriva manager: dansimp ms.collection: - M365-identity-device-management diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md index b7b190c49c..638d001dcf 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: prsriva manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso.md index c74516519b..ddff708e26 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: prsriva manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -19,13 +19,14 @@ ms.reviewer: # Azure AD Join Single Sign-on Deployment **Applies to** -- Windows 10 -- Windows 11 -- Azure Active Directory joined -- Hybrid deployment + +- Windows 10 +- Windows 11 +- Azure Active Directory joined +- Hybrid deployment Windows Hello for Business combined with Azure Active Directory joined devices makes it easy for users to securely access cloud-based resources using a strong, two-factor credential. Some resources may remain on-premises as enterprises transition resources to the cloud and Azure AD joined devices may need to access these resources. With additional configurations to your current hybrid deployment, you can provide single sign-on to your on-premises resources for Azure Active Directory joined devices using Windows Hello for Business, using a key or a certificate. - + ## Key vs. Certificate Enterprises can use either a key or a certificate to provide single-sign on for on-premises resources. Both types of authentication provide the same security; one is not more secure than the other. diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-new-install.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-new-install.md index 05d4a7b317..6de21388aa 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-new-install.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-new-install.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: prsriva manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -19,25 +19,25 @@ ms.reviewer: # Hybrid Azure AD joined Windows Hello for Business Certificate Trust New Installation **Applies to** -- Windows 10, version 1703 or later -- Windows 11 -- Hybrid deployment -- Certificate trust +- Windows 10, version 1703 or later +- Windows 11 +- Hybrid deployment +- Certificate trust Windows Hello for Business involves configuring distributed technologies that may or may not exist in your current infrastructure. Hybrid certificate trust deployments of Windows Hello for Business rely on these technologies -* [Active Directory](#active-directory) -* [Public Key Infrastructure](#public-key-infrastructure) -* [Azure Active Directory](#azure-active-directory) -* [Multifactor Authentication Services](#multifactor-authentication-services) - +- [Active Directory](#active-directory) +- [Public Key Infrastructure](#public-key-infrastructure) +- [Azure Active Directory](#azure-active-directory) +- [Multifactor Authentication Services](#multifactor-authentication-services) New installations are considerably more involved than existing implementations because you are building the entire infrastructure. Microsoft recommends you review the new installation baseline to validate your existing environment has all the needed configurations to support your hybrid certificate trust Windows Hello for Business deployment. If your environment meets these needs, you can read the [Configure Azure Device Registration](hello-hybrid-cert-trust-devreg.md) section to prepare your Windows Hello for Business deployment by configuring Azure device registration. The new installation baseline begins with a basic Active Directory deployment and enterprise PKI. This document expects you have Active Directory deployed using Windows Server 2008 R2 or later domain controllers. ## Active Directory ## + Production environments should follow Active Directory best practices regarding the number and placement of domain controllers to ensure adequate authentication throughout the organization. Lab environments and isolated proof of concepts may want to limit the number of domain controllers. The purpose of these environments is to experiment and learn. Reducing the number of domain controllers can prevent troubleshooting issue, such as Active Directory replication, which is unrelated to activity's goal. diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-devreg.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-devreg.md index 2bae50c063..49ed9f19f0 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-devreg.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-devreg.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: prsriva manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -19,10 +19,11 @@ ms.reviewer: # Configure Device Registration for Hybrid Azure AD joined Windows Hello for Business **Applies to** -- Windows 10, version 1703 or later -- Windows 11 -- Hybrid deployment -- Certificate trust + +- Windows 10, version 1703 or later +- Windows 11 +- Hybrid deployment +- Certificate trust Your environment is federated and you are ready to configure device registration for your hybrid environment. Hybrid Windows Hello for Business deployment needs device registration and device write-back to enable proper device authentication. diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-prereqs.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-prereqs.md index edf8fab283..6432ef517b 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-prereqs.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-prereqs.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: prsriva manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -19,23 +19,25 @@ ms.reviewer: # Hybrid Azure AD joined Windows Hello for Business Prerequisites **Applies to** -- Windows 10, version 1703 or later -- Windows 11 -- Hybrid deployment -- Certificate trust +- Windows 10, version 1703 or later +- Windows 11 +- Hybrid deployment +- Certificate trust Hybrid environments are distributed systems that enable organizations to use on-premises and Azure-based identities and resources. Windows Hello for Business uses the existing distributed system as a foundation on which organizations can provide two-factor authentication that provides a single sign-in like experience to modern resources. The distributed systems on which these technologies were built involved several pieces of on-premises and cloud infrastructure. High-level pieces of the infrastructure include: -* [Directories](#directories) -* [Public Key Infrastructure](#public-key-infrastructure) -* [Directory Synchronization](#directory-synchronization) -* [Federation](#federation) -* [Multifactor Authentication](#multifactor-authentication) -* [Device Registration](#device-registration) + +- [Directories](#directories) +- [Public Key Infrastructure](#public-key-infrastructure) +- [Directory Synchronization](#directory-synchronization) +- [Federation](#federation) +- [Multifactor Authentication](#multifactor-authentication) +- [Device Registration](#device-registration) ## Directories ## + Hybrid Windows Hello for Business needs two directories: on-premises Active Directory and a cloud Azure Active Directory. The minimum required domain controller, domain functional level, and forest functional level for Windows Hello for Business deployment is Windows Server 2008 R2. A hybrid Windows Hello for Business deployment needs an Azure Active Directory subscription. Different deployment configurations are supported by different Azure subscriptions. The hybrid-certificate trust deployment needs an Azure Active Directory premium subscription because it uses the device write-back synchronization feature. Other deployments, such as the hybrid key-trust deployment, may not require Azure Active Directory premium subscription. @@ -57,13 +59,15 @@ Review these requirements and those from the Windows Hello for Business planning
## Public Key Infrastructure ## + The Windows Hello for Business deployment depends on an enterprise public key infrastructure as trust anchor for authentication. Domain controllers for hybrid deployments need a certificate in order for Windows devices to trust the domain controller. - + Certificate trust deployments need an enterprise public key infrastructure and a certificate registration authority to issue authentication certificates to users. When using Group Policy, hybrid certificate trust deployment uses the Windows Server 2016 Active Directory Federation Server (AD FS) as a certificate registration authority. The minimum required enterprise certificate authority that can be used with Windows Hello for Business is Windows Server 2012. ### Section Review + > [!div class="checklist"] > * Windows Server 2012 Issuing Certificate Authority > * Windows Server 2016 Active Directory Federation Services @@ -71,17 +75,19 @@ The minimum required enterprise certificate authority that can be used with Wind
## Directory Synchronization ## + The two directories used in hybrid deployments must be synchronized. You need Azure Active Directory Connect to synchronize user accounts in the on-premises Active Directory with Azure Active Directory. Organizations using older directory synchronization technology, such as DirSync or Azure AD sync, need to upgrade to Azure AD Connect. In case the schema of your local AD DS was changed since the last directory synchronization, you may need to [refresh directory schema](/azure/active-directory/hybrid/how-to-connect-installation-wizard#refresh-directory-schema). - + > [!NOTE] > User accounts enrolling for Windows Hello for Business in a Hybrid Certificate Trust scenario must have a UPN matching a verified domain name in Azure AD. For more details, see [Troubleshoot Post-Join issues](/azure/active-directory/devices/troubleshoot-hybrid-join-windows-current#troubleshoot-post-join-issues). > [!NOTE] > Windows Hello for Business is tied between a user and a device. Both the user and device need to be synchronized between Azure Active Directory and Active Directory. - -### Section Review + +### Section Review + > [!div class="checklist"] > * Azure Active Directory Connect directory synchronization > * [Upgrade from DirSync](/azure/active-directory/connect/active-directory-aadconnect-dirsync-upgrade-get-started) @@ -90,11 +96,13 @@ Organizations using older directory synchronization technology, such as DirSync
## Federation ## + Windows Hello for Business hybrid certificate trust requires Active Directory being federated with Azure Active Directory and needs Windows Server 2016 Active Directory Federation Services or newer. Windows Hello for Business hybrid certificate trust doesn’t support Managed Azure Active Directory using Pass-through authentication or password hash sync. All nodes in the AD FS farm must run the same version of AD FS. Additionally, you need to configure your AD FS farm to support Azure registered devices. The AD FS farm used with Windows Hello for Business must be Windows Server 2016 with minimum update of [KB4088889 (14393.2155)](https://support.microsoft.com/help/4088889). If your AD FS farm is not running the AD FS role with updates from Windows Server 2016, then read [Upgrading to AD FS in Windows Server 2016](/windows-server/identity/ad-fs/deployment/upgrading-to-ad-fs-in-windows-server-2016) ### Section Review ### + > [!div class="checklist"] > * Windows Server 2016 Active Directory Federation Services > * Minimum update of [KB4088889 (14393.2155)](https://support.microsoft.com/help/4088889) @@ -102,11 +110,13 @@ The AD FS farm used with Windows Hello for Business must be Windows Server 2016
## Multifactor Authentication ## + Windows Hello for Business is a strong, two-factor credential the helps organizations reduce their dependency on passwords. The provisioning process lets a user enroll in Windows Hello for Business using their username and password as one factor. but needs a second factor of authentication. Hybrid Windows Hello for Business deployments can use Azure’s Multifactor Authentication service, or they can use multifactor authentication provides by Windows Server 2016 Active Directory Federation Services, which includes an adapter model that enables third parties to integrate their multifactor authentication into AD FS. -### Section Review +### Section Review + > [!div class="checklist"] > * Azure MFA Service > * Windows Server 2016 AD FS and Azure @@ -115,6 +125,7 @@ Hybrid Windows Hello for Business deployments can use Azure’s Multifactor Auth
## Device Registration ## + Organizations wanting to deploy hybrid certificate trust need their domain joined devices to register to Azure Active Directory. Just as a computer has an identity in Active Directory, that same computer has an identity in the cloud. This ensures that only approved computers are used with that Azure Active Directory. Each computer registers its identity in Azure Active Directory. Hybrid certificate trust deployments need the device write back feature. Authentication to the Windows Server 2016 Active Directory Federation Services needs both the user and the computer to authenticate. Typically the users are synchronized, but not devices. This prevents AD FS from authenticating the computer and results in Windows Hello for Business certificate enrollment failures. For this reason, Windows Hello for Business deployments need device writeback, which is an Azure Active Directory premium feature. @@ -128,6 +139,7 @@ You need to allow access to the URL account.microsoft.com to initiate Windows He ### Section Checklist ### + > [!div class="checklist"] > * Azure Active Directory Device writeback > * Azure Active Directory Premium subscription @@ -151,6 +163,7 @@ If your environment is already federated and supports Azure device registration,
## Follow the Windows Hello for Business hybrid certificate trust deployment guide + 1. [Overview](hello-hybrid-cert-trust.md) 2. Prerequisites (*You are here*) 3. [New Installation Baseline](hello-hybrid-cert-new-install.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust.md index b9a5fcd43e..bec180c498 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: prsriva manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -19,24 +19,26 @@ ms.reviewer: # Hybrid Azure AD joined Certificate Trust Deployment **Applies to** -- Windows 10, version 1703 or later -- Windows 11 -- Hybrid deployment -- Certificate trust - +- Windows 10, version 1703 or later +- Windows 11 +- Hybrid deployment +- Certificate trust + Windows Hello for Business replaces username and password sign-in to Windows with strong user authentication based on asymmetric key pair. The following deployment guide provides the information needed to successfully deploy Windows Hello for Business in a hybrid certificate trust scenario. It is recommended that you review the Windows Hello for Business planning guide prior to using the deployment guide. The planning guide helps you make decisions by explaining the available options with each aspect of the deployment and explains the potential outcomes based on each of these decisions. You can review the [planning guide](/windows/access-protection/hello-for-business/hello-planning-guide) and download the [planning worksheet](https://go.microsoft.com/fwlink/?linkid=852514). This deployment guide provides guidance for new deployments and customers who are already federated with Office 365. These two scenarios provide a baseline from which you can begin your deployment. -## New Deployment Baseline ## +## New Deployment Baseline + The new deployment baseline helps organizations who are moving to Azure and Office 365 to include Windows Hello for Business as part of their deployments. This baseline is good for organizations who are looking to deploy proof of concepts as well as IT professionals who want to familiarize themselves Windows Hello for Business by deploying a lab environment. - + This baseline provides detailed procedures to move your environment from an on-premises only environment to a hybrid environment using Windows Hello for Business to authenticate to Azure Active Directory and to your on-premises Active Directory using a single Windows sign-in. - -## Federated Baseline ## + +## Federated Baseline + The federated baseline helps organizations that have completed their federation with Azure Active Directory and Office 365 and enables them to introduce Windows Hello for Business into their hybrid environment. This baseline exclusively focuses on the procedures needed to add Azure Device Registration and Windows Hello for Business to an existing hybrid deployment. Regardless of the baseline you choose, your next step is to familiarize yourself with the prerequisites needed for the deployment. Many of the prerequisites will be new for organizations and individuals pursuing the new deployment baseline. Organizations and individuals starting from the federated baseline will likely be familiar with most of the prerequisites, but should validate they are using the proper versions that include the latest updates. @@ -49,6 +51,7 @@ Regardless of the baseline you choose, your next step is to familiarize yourself
## Follow the Windows Hello for Business hybrid certificate trust deployment guide + 1. Overview (*You are here*) 2. [Prerequisites](hello-hybrid-cert-trust-prereqs.md) 3. [New Installation Baseline](hello-hybrid-cert-new-install.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-provision.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-provision.md index ed3ad19d9d..15ec076a51 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-provision.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-provision.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: prsriva manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -60,7 +60,7 @@ The remainder of the provisioning includes Windows Hello for Business requesting > The minimum time needed to synchronize the user's public key from Azure Active Directory to the on-premises Active Directory is 30 minutes. The Azure AD Connect scheduler controls the synchronization interval. > **This synchronization latency delays the user's ability to authenticate and use on-premises resources until the user's public key has synchronized to Active Directory.** Once synchronized, the user can authenticate and use on-premises resources. > Read [Azure AD Connect sync: Scheduler](/azure/active-directory/connect/active-directory-aadconnectsync-feature-scheduler) to view and adjust the **synchronization cycle** for your organization. -> +> > [!NOTE] > Windows Server 2016 update [KB4088889 (14393.2155)](https://support.microsoft.com/help/4088889) provides synchronous certificate enrollment during hybrid certificate trust provisioning. With this update, users no longer need to wait for Azure AD Connect to sync their public key on-premises. Users enroll their certificate during provisioning and can use the certificate for sign-in immediately after completing the provisioning. The update needs to be installed on the federation servers. diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-ad.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-ad.md index 6d48646f3b..94462ebe1d 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-ad.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-ad.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: prsriva manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -19,11 +19,11 @@ ms.reviewer: # Configure Hybrid Azure AD joined Windows Hello for Business: Active Directory **Applies to** -- Windows 10, version 1703 or later -- Windows 11 -- Hybrid deployment -- Certificate trust +- Windows 10, version 1703 or later +- Windows 11 +- Hybrid deployment +- Certificate trust The key synchronization process for the hybrid deployment of Windows Hello for Business needs the Windows Server 2016 Active Directory schema. diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-adfs.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-adfs.md index 2a5517fe70..dc028844a0 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-adfs.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-adfs.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: prsriva manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -36,7 +36,7 @@ The Windows Hello for Business Authentication certificate template is configured ### Configure the Registration Authority -Sign-in the AD FS server with *Domain Admin* equivalent credentials. +Sign-in the AD FS server with *Domain Admin* equivalent credentials. 1. Open a **Windows PowerShell** prompt. 2. Enter the following command: diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-dir-sync.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-dir-sync.md index 681c874730..7ef3176f22 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-dir-sync.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-dir-sync.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: prsriva manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -20,12 +20,12 @@ ms.reviewer: # Configure Hybrid Azure AD joined Windows Hello for Business- Directory Synchronization **Applies to** + - Windows 10, version 1703 or later - Windows 11 - Hybrid deployment - Certificate Trust - ## Directory Synchronization In hybrid deployments, users register the public portion of their Windows Hello for Business credential with Azure. Azure AD Connect synchronizes the Windows Hello for Business public key to Active Directory. diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-pki.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-pki.md index fc322a0194..bc3b32a38e 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-pki.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-pki.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: prsriva manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-policy.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-policy.md index 632f6ebf3c..a7bc32dc4c 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-policy.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-policy.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: prsriva manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -19,11 +19,11 @@ ms.reviewer: # Configure Hybrid Azure AD joined Windows Hello for Business - Group Policy **Applies to** -- Windows 10, version 1703 or later -- Windows 11 -- Hybrid deployment -- Certificate trust +- Windows 10, version 1703 or later +- Windows 11 +- Hybrid deployment +- Certificate trust ## Policy Configuration @@ -35,9 +35,10 @@ Alternatively, you can create copy the .ADMX and .ADML files from a Windows 10 C Domain controllers of Windows Hello for Business deployments need one Group Policy setting, which enables automatic certificate enrollment for the newly create domain controller authentication certificate. This policy setting ensures domain controllers (new and existing) automatically request and renew the correct domain controller certificate. Domain joined clients of hybrid certificate-based deployments of Windows Hello for Business needs three Group Policy settings: -* Enable Windows Hello for Business -* Use certificate for on-premises authentication -* Enable automatic enrollment of certificates + +- Enable Windows Hello for Business +- Use certificate for on-premises authentication +- Enable automatic enrollment of certificates ### Configure Domain Controllers for Automatic Certificate Enrollment diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings.md index 498f54f10a..dcffcfc154 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: prsriva manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -19,21 +19,22 @@ ms.reviewer: # Configure Hybrid Azure AD joined Windows Hello for Business **Applies to** -- Windows 10, version 1703 or later -- Windows 11 -- Hybrid deployment -- Certificate trust - +- Windows 10, version 1703 or later +- Windows 11 +- Hybrid deployment +- Certificate trust + Your environment is federated and you are ready to configure your hybrid environment for Windows Hello for business using the certificate trust model. > [!IMPORTANT] > If your environment is not federated, review the [New Installation baseline](hello-hybrid-cert-new-install.md) section of this deployment document to learn how to federate your environment for your Windows Hello for Business deployment. The configuration for Windows Hello for Business is grouped in four categories. These categories are: -* [Active Directory](hello-hybrid-cert-whfb-settings-ad.md) -* [Public Key Infrastructure](hello-hybrid-cert-whfb-settings-pki.md) -* [Active Directory Federation Services](hello-hybrid-cert-whfb-settings-adfs.md) -* [Group Policy](hello-hybrid-cert-whfb-settings-policy.md) + +- [Active Directory](hello-hybrid-cert-whfb-settings-ad.md) +- [Public Key Infrastructure](hello-hybrid-cert-whfb-settings-pki.md) +- [Active Directory Federation Services](hello-hybrid-cert-whfb-settings-adfs.md) +- [Group Policy](hello-hybrid-cert-whfb-settings-policy.md) For the most efficient deployment, configure these technologies in order beginning with the Active Directory configuration diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cloud-trust.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cloud-trust.md index 157f25c9bb..71209f0294 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cloud-trust.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cloud-trust.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: prsriva manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-new-install.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-new-install.md index 00829103e4..ea3e5ae8d1 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-new-install.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-new-install.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: prsriva manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -19,19 +19,19 @@ ms.reviewer: # Windows Hello for Business Hybrid Azure AD joined Key Trust New Installation **Applies to** -- Windows 10, version 1703 or later -- Windows 11 -- Hybrid deployment -- Key trust + +- Windows 10, version 1703 or later +- Windows 11 +- Hybrid deployment +- Key trust Windows Hello for Business involves configuring distributed technologies that may or may not exist in your current infrastructure. Hybrid key trust deployments of Windows Hello for Business rely on these technologies -* [Active Directory](#active-directory) -* [Public Key Infrastructure](#public-key-infrastructure) -* [Azure Active Directory](#azure-active-directory) -* [Multifactor Authentication Services](#multifactor-authentication-services) - +- [Active Directory](#active-directory) +- [Public Key Infrastructure](#public-key-infrastructure) +- [Azure Active Directory](#azure-active-directory) +- [Multifactor Authentication Services](#multifactor-authentication-services) New installations are considerably more involved than existing implementations because you are building the entire infrastructure. Microsoft recommends you review the new installation baseline to validate your existing environment has all the needed configurations to support your hybrid certificate trust Windows Hello for Business deployment. If your environment meets these needs, you can read the [Configure Directory Synchronization](hello-hybrid-key-trust-dirsync.md) section to prepare your Windows Hello for Business deployment by configuring directory synchronization. diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-devreg.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-devreg.md index 3a30549629..fdd927d52e 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-devreg.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-devreg.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: prsriva manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -19,13 +19,13 @@ ms.reviewer: # Configure Device Registration for Hybrid Azure AD joined key trust Windows Hello for Business **Applies to** -- Windows 10, version 1703 or later -- Windows 11 -- Hybrid deployment -- Key trust - -You are ready to configure device registration for your hybrid environment. Hybrid Windows Hello for Business deployment needs device registration to enable proper device authentication. +- Windows 10, version 1703 or later +- Windows 11 +- Hybrid deployment +- Key trust + +You are ready to configure device registration for your hybrid environment. Hybrid Windows Hello for Business deployment needs device registration to enable proper device authentication. > [!NOTE] > Before proceeding, you should familiarize yourself with device registration concepts such as: @@ -36,6 +36,7 @@ You are ready to configure device registration for your hybrid environment. Hybr > You can learn about this and more by reading [Introduction to Device Management in Azure Active Directory.](/azure/active-directory/device-management-introduction) ## Configure Azure for Device Registration + Begin configuring device registration to support Hybrid Windows Hello for Business by configuring device registration capabilities in Azure AD. To do this, follow the **Configure device settings** steps under [Setting up Azure AD Join in your organization](/azure/active-directory/devices/device-management-azure-portal). @@ -48,6 +49,7 @@ Next, follow the guidance on the [How to configure hybrid Azure Active Directory
## Follow the Windows Hello for Business hybrid key trust deployment guide + 1. [Overview](hello-hybrid-cert-trust.md) 2. [Prerequisites](hello-hybrid-cert-trust-prereqs.md) 3. [New Installation Baseline](hello-hybrid-key-new-install.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-dirsync.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-dirsync.md index db1f93ef28..28c80840a2 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-dirsync.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-dirsync.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: prsriva manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -19,17 +19,17 @@ ms.reviewer: # Configure Directory Synchronization for Hybrid Azure AD joined key trust Windows Hello for Business **Applies to** -- Windows 10, version 1703 or later -- Windows 11 -- Hybrid deployment -- Key trust - -You are ready to configure directory synchronization for your hybrid environment. Hybrid Windows Hello for Business deployment needs both a cloud and an on-premises identity to authenticate and access resources in the cloud or on-premises. +- Windows 10, version 1703 or later +- Windows 11 +- Hybrid deployment +- Key trust + +You are ready to configure directory synchronization for your hybrid environment. Hybrid Windows Hello for Business deployment needs both a cloud and an on-premises identity to authenticate and access resources in the cloud or on-premises. ## Deploy Azure AD Connect -Next, you need to synchronize the on-premises Active Directory with Azure Active Directory. To do this, first review the [Integrating on-prem directories with Azure Active Directory](/azure/active-directory/connect/active-directory-aadconnect) and [hardware and prerequisites](/azure/active-directory/connect/active-directory-aadconnect-prerequisites) needed and then [download the software](https://go.microsoft.com/fwlink/?LinkId=615771). +Next, you need to synchronize the on-premises Active Directory with Azure Active Directory. To do this, first review the [Integrating on-prem directories with Azure Active Directory](/azure/active-directory/connect/active-directory-aadconnect) and [hardware and prerequisites](/azure/active-directory/connect/active-directory-aadconnect-prerequisites) needed and then [download the software](https://go.microsoft.com/fwlink/?LinkId=615771). > [!NOTE] > If you installed Azure AD Connect prior to upgrading the schema, you will need to re-run the Azure AD Connect installation and refresh the on-premises AD schema to ensure the synchronization rule for msDS-KeyCredentialLink is configured. @@ -39,6 +39,7 @@ Next, you need to synchronize the on-premises Active Directory with Azure Active
## Follow the Windows Hello for Business hybrid key trust deployment guide + 1. [Overview](hello-hybrid-key-trust.md) 2. [Prerequisites](hello-hybrid-key-trust-prereqs.md) 3. [New Installation Baseline](hello-hybrid-key-new-install.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md index 29d57a36c6..f32954e088 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md @@ -8,7 +8,7 @@ ms.sitesec: library ms.pagetype: security, mobile audience: ITPro author: mapalko -ms.author: mapalko +ms.author: prsriva manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -19,21 +19,22 @@ ms.reviewer: # Hybrid Azure AD joined Key trust Windows Hello for Business Prerequisites **Applies to** -- Windows 10, version 1703 or later -- Windows 11 -- Hybrid deployment -- Key trust +- Windows 10, version 1703 or later +- Windows 11 +- Hybrid deployment +- Key trust Hybrid environments are distributed systems that enable organizations to use on-premises and Azure-based identities and resources. Windows Hello for Business uses the existing distributed system as a foundation on which organizations can provide two-factor authentication that provides a single sign-in like experience to modern resources. The distributed systems on which these technologies were built involved several pieces of on-premises and cloud infrastructure. High-level pieces of the infrastructure include: -* [Directories](#directories) -* [Public Key Infrastructure](#public-key-infrastructure) -* [Directory Synchronization](#directory-synchronization) -* [Federation](#federation-with-azure) -* [Multifactor authentication](#multifactor-authentication) -* [Device Registration](#device-registration) + +- [Directories](#directories) +- [Public Key Infrastructure](#public-key-infrastructure) +- [Directory Synchronization](#directory-synchronization) +- [Federation](#federation-with-azure) +- [Multifactor authentication](#multifactor-authentication) +- [Device Registration](#device-registration) ## Directories @@ -62,20 +63,21 @@ Review these requirements and those from the Windows Hello for Business planning
## Public Key Infrastructure + The Windows Hello for Business deployment depends on an enterprise public key infrastructure as trust anchor for authentication. Domain controllers for hybrid deployments need a certificate in order for Windows devices to trust the domain controller. Key trust deployments do not need client issued certificates for on-premises authentication. Active Directory user accounts are automatically configured for public key mapping by Azure AD Connect synchronizing the public key of the registered Windows Hello for Business credential to an attribute on the user's Active Directory object. The minimum required Enterprise certificate authority that can be used with Windows Hello for Business is Windows Server 2012, but you can also use a third-party Enterprise certification authority. The requirements for the domain controller certificate are shown below. For more details, see [Requirements for domain controller certificates from a third-party CA](/troubleshoot/windows-server/windows-security/requirements-domain-controller). -* The certificate must have a Certificate Revocation List (CRL) distribution point extension that points to a valid CRL, or an Authority Information Access (AIA) extension that points to an Online Certificate Status Protocol (OCSP) responder. -* Optionally, the certificate Subject section could contain the directory path of the server object (the distinguished name). -* The certificate Key Usage section must contain Digital Signature and Key Encipherment. -* Optionally, the certificate Basic Constraints section should contain: [Subject Type=End Entity, Path Length Constraint=None]. -* The certificate Enhanced Key Usage section must contain Client Authentication (1.3.6.1.5.5.7.3.2), Server Authentication (1.3.6.1.5.5.7.3.1), and KDC Authentication (1.3.6.1.5.2.3.5). -* The certificate Subject Alternative Name section must contain the Domain Name System (DNS) name. -* The certificate template must have an extension that has the value "DomainController", encoded as a [BMPstring](/windows/win32/seccertenroll/about-bmpstring). If you are using Windows Server Enterprise Certificate Authority, this extension is already included in the domain controller certificate template. -* The domain controller certificate must be installed in the local computer's certificate store. See [Configure Hybrid Windows Hello for Business: Public Key Infrastructure](./hello-hybrid-key-whfb-settings-pki.md) for details. +- The certificate must have a Certificate Revocation List (CRL) distribution point extension that points to a valid CRL, or an Authority Information Access (AIA) extension that points to an Online Certificate Status Protocol (OCSP) responder. +- Optionally, the certificate Subject section could contain the directory path of the server object (the distinguished name). +- The certificate Key Usage section must contain Digital Signature and Key Encipherment. +- Optionally, the certificate Basic Constraints section should contain: [Subject Type=End Entity, Path Length Constraint=None]. +- The certificate Enhanced Key Usage section must contain Client Authentication (1.3.6.1.5.5.7.3.2), Server Authentication (1.3.6.1.5.5.7.3.1), and KDC Authentication (1.3.6.1.5.2.3.5). +- The certificate Subject Alternative Name section must contain the Domain Name System (DNS) name. +- The certificate template must have an extension that has the value "DomainController", encoded as a [BMPstring](/windows/win32/seccertenroll/about-bmpstring). If you are using Windows Server Enterprise Certificate Authority, this extension is already included in the domain controller certificate template. +- The domain controller certificate must be installed in the local computer's certificate store. See [Configure Hybrid Windows Hello for Business: Public Key Infrastructure](./hello-hybrid-key-whfb-settings-pki.md) for details. > [!IMPORTANT] @@ -95,7 +97,8 @@ The two directories used in hybrid deployments must be synchronized. You need A Organizations using older directory synchronization technology, such as DirSync or Azure AD sync need to upgrade to Azure AD Connect. -### Section Review +### Section Review + > [!div class="checklist"] > * Azure Active Directory Connect directory synchronization > * [Upgrade from DirSync](/azure/active-directory/connect/active-directory-aadconnect-dirsync-upgrade-get-started) @@ -103,8 +106,8 @@ Organizations using older directory synchronization technology, such as DirSync
- ## Federation with Azure + You can deploy Windows Hello for Business key trust in non-federated and federated environments. For non-federated environments, key trust deployments work in environments that have deployed [Password Synchronization with Azure AD Connect](/azure/active-directory/hybrid/whatis-phs) or [Azure Active Directory Pass-through-Authentication](/azure/active-directory/connect/active-directory-aadconnect-pass-through-authentication). For federated environments, you can deploy Windows Hello for Business key trust using Active Directory Federation Services (AD FS) 2012 R2 or later. > [!div class="checklist"] @@ -119,7 +122,8 @@ Windows Hello for Business is a strong, two-factor credential the helps organiza Hybrid Windows Hello for Business deployments can use Azure's Multifactor Authentication (MFA) service or they can use multifactor authentication provided by AD FS beginning with Windows Server 2012 R2, which includes an adapter model that enables third parties to integrate their MFA into AD FS. The MFA enabled by an Office 365 license is sufficient for Azure AD. -### Section Review +### Section Review + > [!div class="checklist"] > * Azure MFA Service > * Windows Server 2016 AD FS and Azure (optional, if federated) @@ -129,13 +133,12 @@ Hybrid Windows Hello for Business deployments can use Azure's Multifactor Authen ## Device Registration -Organizations wanting to deploy hybrid key trust need their domain joined devices to register to Azure Active Directory. Just as a computer has an identity in Active Directory, that same computer has an identity in the cloud. This ensures that only approved computers are used with that Azure Active Directory. Each computer registers its identity in Azure Active Directory. +Organizations wanting to deploy hybrid key trust need their domain joined devices to register to Azure Active Directory. Just as a computer has an identity in Active Directory, that same computer has an identity in the cloud. This ensures that only approved computers are used with that Azure Active Directory. Each computer registers its identity in Azure Active Directory. ## Provisioning You need to allow access to the URL account.microsoft.com to initiate Windows Hello for Business provisioning. This URL launches the subsequent steps in the provisioning process and is required to successfully complete Windows Hello for Business provisioning. This URL does not require any authentication and as such, does not collect any user data. - ### Section Checklist > [!div class="checklist"] @@ -161,6 +164,7 @@ For federated and non-federated environments, start with **Configure Windows Hel
## Follow the Windows Hello for Business hybrid key trust deployment guide + 1. [Overview](hello-hybrid-key-trust.md) 2. Prerequisites (*You are here*) 3. [New Installation Baseline](hello-hybrid-key-new-install.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust.md index a8b090fc5b..db6d3e0a33 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: prsriva manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-provision.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-provision.md index 224aa7d094..d2c8eb0585 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-provision.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-provision.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: prsriva manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -19,20 +19,20 @@ ms.reviewer: # Hybrid Azure AD joined Windows Hello for Business Key Trust Provisioning **Applies to** -- Windows 10, version 1703 or later -- Windows 11 -- Hybrid deployment -- Key trust +- Windows 10, version 1703 or later +- Windows 11 +- Hybrid deployment +- Key trust ## Provisioning + The Windows Hello for Business provisioning begins immediately after the user has signed in, after the user profile is loaded, but before the user receives their desktop. Windows only launches the provisioning experience if all the prerequisite checks pass. You can determine the status of the prerequisite checks by viewing the **User Device Registration** in the **Event Viewer** under **Applications and Services Logs\Microsoft\Windows**. ![Event358.](images/Event358-2.png) The first thing to validate is the computer has processed device registration. You can view this from the User device registration logs where the check **Device is AAD joined (AADJ or DJ++): Yes** appears. Additionally, you can validate this using the **dsregcmd /status** command from a console prompt where the value for **AzureADJoined** reads **Yes**. - Windows Hello for Business provisioning begins with a full screen page with the title **Setup a PIN** and button with the same name. The user clicks **Setup a PIN**. ![Setup a PIN Provisioning.](images/setupapin.png) @@ -46,12 +46,13 @@ After a successful MFA, the provisioning flow asks the user to create and valida ![Create a PIN during provisioning.](images/createPin.png) The provisioning flow has all the information it needs to complete the Windows Hello for Business enrollment. -* A successful single factor authentication (username and password at sign-in) -* A device that has successfully completed device registration -* A fresh, successful multi-factor authentication -* A validated PIN that meets the PIN complexity requirements -The remainder of the provisioning includes Windows Hello for Business requesting an asymmetric key pair for the user, preferably from the TPM (or required if explicitly set through policy). Once the key pair is acquired, Windows communicates with Azure Active Directory to register the public key. When key registration completes, Windows Hello for Business provisioning informs the user they can use their PIN to sign-in. The user may close the provisioning application and see their desktop. While the user has completed provisioning, Azure AD Connect synchronizes the user's key to Active Directory. +- A successful single factor authentication (username and password at sign-in) +- A device that has successfully completed device registration +- A fresh, successful multi-factor authentication +- A validated PIN that meets the PIN complexity requirements + +The remainder of the provisioning includes Windows Hello for Business requesting an asymmetric key pair for the user, preferably from the TPM (or required if explicitly set through policy). Once the key pair is acquired, Windows communicates with Azure Active Directory to register the public key. When key registration completes, Windows Hello for Business provisioning informs the user they can use their PIN to sign-in. The user may close the provisioning application and see their desktop. While the user has completed provisioning, Azure AD Connect synchronizes the user's key to Active Directory. > [!IMPORTANT] > The minimum time needed to synchronize the user's public key from Azure Active Directory to the on-premises Active Directory is 30 minutes. The Azure AD Connect scheduler controls the synchronization interval. @@ -63,6 +64,7 @@ The remainder of the provisioning includes Windows Hello for Business requesting
## Follow the Windows Hello for Business hybrid key trust deployment guide + 1. [Overview](hello-hybrid-key-trust.md) 2. [Prerequisites](hello-hybrid-key-trust-prereqs.md) 3. [New Installation Baseline](hello-hybrid-key-new-install.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-ad.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-ad.md index c8db509239..46ba983c83 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-ad.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-ad.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: prsriva manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -19,15 +19,14 @@ ms.reviewer: # Configuring Hybrid Azure AD joined key trust Windows Hello for Business: Active Directory **Applies to** -- Windows 10, version 1703 or later -- Windows 11 -- Hybrid deployment -- Key trust +- Windows 10, version 1703 or later +- Windows 11 +- Hybrid deployment +- Key trust Configure the appropriate security groups to efficiently deploy Windows Hello for Business to users. - ### Creating Security Groups Windows Hello for Business uses a security group to simplify the deployment and management. @@ -59,6 +58,7 @@ Sign-in a domain controller or management workstation with *Domain Admin* equiva
## Follow the Windows Hello for Business hybrid key trust deployment guide + 1. [Overview](hello-hybrid-cert-trust.md) 2. [Prerequisites](hello-hybrid-key-trust-prereqs.md) 3. [New Installation Baseline](hello-hybrid-key-new-install.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-dir-sync.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-dir-sync.md index 8e58707531..3843fecaa8 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-dir-sync.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-dir-sync.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: prsriva manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -19,10 +19,11 @@ ms.reviewer: # Configure Hybrid Azure AD joined Windows Hello for Business: Directory Synchronization **Applies to** -- Windows 10, version 1703 or later -- Windows 11 -- Hybrid deployment -- Key trust + +- Windows 10, version 1703 or later +- Windows 11 +- Hybrid deployment +- Key trust ## Directory Synchronization @@ -55,6 +56,7 @@ Sign-in a domain controller or management workstation with _Domain Admin_ equiva
## Follow the Windows Hello for Business hybrid key trust deployment guide + 1. [Overview](hello-hybrid-cert-trust.md) 2. [Prerequisites](hello-hybrid-key-trust-prereqs.md) 3. [New Installation Baseline](hello-hybrid-key-new-install.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-pki.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-pki.md index 700d8a0062..de67cd6dd3 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-pki.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-pki.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: prsriva manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-policy.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-policy.md index 6b08257dd3..6ea84e8f0d 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-policy.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-policy.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: prsriva manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -19,11 +19,11 @@ ms.reviewer: # Configure Hybrid Azure AD joined Windows Hello for Business: Group Policy **Applies to** -- Windows 10, version 1703 or later -- Windows 11 -- Hybrid deployment -- Key trust +- Windows 10, version 1703 or later +- Windows 11 +- Hybrid deployment +- Key trust ## Policy Configuration diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings.md index b7f6408196..38b7194d9c 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: prsriva manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -19,10 +19,11 @@ ms.reviewer: # Configure Hybrid Azure AD joined Windows Hello for Business key trust settings **Applies to** -- Windows 10, version 1703 or later -- Windows 11 -- Hybrid deployment -- Key trust + +- Windows 10, version 1703 or later +- Windows 11 +- Hybrid deployment +- Key trust You are ready to configure your hybrid Azure AD joined key trust environment for Windows Hello for Business. @@ -45,6 +46,7 @@ For the most efficient deployment, configure these technologies in order beginni
## Follow the Windows Hello for Business hybrid key trust deployment guide + 1. [Overview](hello-hybrid-key-trust.md) 2. [Prerequisites](hello-hybrid-key-trust-prereqs.md) 3. [New Installation Baseline](hello-hybrid-key-new-install.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-identity-verification.md b/windows/security/identity-protection/hello-for-business/hello-identity-verification.md index 1bbb178788..4135615f1c 100644 --- a/windows/security/identity-protection/hello-for-business/hello-identity-verification.md +++ b/windows/security/identity-protection/hello-for-business/hello-identity-verification.md @@ -8,8 +8,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: prsriva manager: dansimp ms.collection: - M365-identity-device-management @@ -78,4 +78,4 @@ The table shows the minimum requirements for each deployment. | Azure Account, optional for Azure MFA billing | Azure Account, optional for Azure MFA billing | > [!IMPORTANT] -> For Windows Hello for Business key trust deployments, if you have several domains, at least one Windows Server Domain Controller 2016 or newer is required for each domain. For more information, see the [planning guide](./hello-adequate-domain-controllers.md). \ No newline at end of file +> For Windows Hello for Business key trust deployments, if you have several domains, at least one Windows Server Domain Controller 2016 or newer is required for each domain. For more information, see the [planning guide](./hello-adequate-domain-controllers.md). diff --git a/windows/security/identity-protection/hello-for-business/hello-key-trust-adfs.md b/windows/security/identity-protection/hello-for-business/hello-key-trust-adfs.md index 0dfae840a6..d608421337 100644 --- a/windows/security/identity-protection/hello-for-business/hello-key-trust-adfs.md +++ b/windows/security/identity-protection/hello-for-business/hello-key-trust-adfs.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: prsriva manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -19,11 +19,11 @@ ms.reviewer: # Prepare and Deploy Windows Server 2016 Active Directory Federation Services with Key Trust **Applies to** -- Windows 10, version 1703 or later -- Windows 11 -- On-premises deployment -- Key trust +- Windows 10, version 1703 or later +- Windows 11 +- On-premises deployment +- Key trust Windows Hello for Business works exclusively with the Active Directory Federation Service role included with Windows Server 2016 and requires an additional server update. The on-premises key trust deployment uses Active Directory Federation Services roles for key registration and device registration. @@ -344,6 +344,7 @@ Before you continue with the deployment, validate your deployment progress by re ## Follow the Windows Hello for Business on premises certificate trust deployment guide + 1. [Validate Active Directory prerequisites](hello-key-trust-validate-ad-prereq.md) 2. [Validate and Configure Public Key Infrastructure](hello-key-trust-validate-pki.md) 3. Prepare and Deploy Windows Server 2016 Active Directory Federation Services (*You are here*) diff --git a/windows/security/identity-protection/hello-for-business/hello-key-trust-policy-settings.md b/windows/security/identity-protection/hello-for-business/hello-key-trust-policy-settings.md index 0933808ce7..187d42ad0f 100644 --- a/windows/security/identity-protection/hello-for-business/hello-key-trust-policy-settings.md +++ b/windows/security/identity-protection/hello-for-business/hello-key-trust-policy-settings.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: prsriva manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -19,10 +19,11 @@ ms.reviewer: # Configure Windows Hello for Business Policy settings - Key Trust **Applies to** -- Windows 10, version 1703 or later -- Windows 11 -- On-premises deployment -- Key trust + +- Windows 10, version 1703 or later +- Windows 11 +- On-premises deployment +- Key trust You need at least a Windows 10, version 1703 workstation to run the Group Policy Management Console, which provides the latest Windows Hello for Business and PIN Complexity Group Policy settings. To run the Group Policy Management Console, you need to install the Remote Server Administration Tools for Windows. You can download these tools from [Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=45520). diff --git a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-ad-prereq.md b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-ad-prereq.md index 85a36fa384..2ba08c716b 100644 --- a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-ad-prereq.md +++ b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-ad-prereq.md @@ -6,9 +6,9 @@ ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile -author: dansimp +author: GitPrakhar13 audience: ITPro -ms.author: dansimp +ms.author: prsriva manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -19,11 +19,11 @@ ms.reviewer: # Validate Active Directory prerequisites - Key Trust **Applies to** -- Windows 10, version 1703 or later -- Windows 11 -- On-premises deployment -- Key trust +- Windows 10, version 1703 or later +- Windows 11 +- On-premises deployment +- Key trust Key trust deployments need an adequate number of 2016 or later domain controllers to ensure successful user authentication with Windows Hello for Business. To learn more about domain controller planning for key trust deployments, read the [Windows Hello for Business planning guide](hello-planning-guide.md), the [Planning an adequate number of Windows Server 2016 or later Domain Controllers for Windows Hello for Business deployments](hello-adequate-domain-controllers.md) section. diff --git a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-deploy-mfa.md b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-deploy-mfa.md index 549c4ffd5d..e0d299b2df 100644 --- a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-deploy-mfa.md +++ b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-deploy-mfa.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: prsriva manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -35,6 +35,7 @@ For information on available third-party authentication methods see [Configure A Follow the integration and deployment guide for the authentication provider you select to integrate and deploy it to AD FS. Make sure that the authentication provider is selected as a multi-factor authentication option in the AD FS authentication policy. For information on configuring AD FS authentication policies see [Configure Authentication Policies](/windows-server/identity/ad-fs/operations/configure-authentication-policies). ## Follow the Windows Hello for Business on premises certificate trust deployment guide + 1. [Validate Active Directory prerequisites](hello-key-trust-validate-ad-prereq.md) 2. [Validate and Configure Public Key Infrastructure](hello-key-trust-validate-pki.md) 3. [Prepare and Deploy Windows Server 2016 Active Directory Federation Services](hello-key-trust-adfs.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-pki.md b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-pki.md index e4d0dbd8ab..debf3022c5 100644 --- a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-pki.md +++ b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-pki.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: prsriva manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -20,11 +20,11 @@ ms.reviewer: # Validate and Configure Public Key Infrastructure - Key Trust **Applies to** -- Windows 10, version 1703 or later -- Windows 11 -- On-premises deployment -- Key trust +- Windows 10, version 1703 or later +- Windows 11 +- On-premises deployment +- Key trust Windows Hello for Business must have a public key infrastructure regardless of the deployment or trust model. All trust models depend on the domain controllers having a certificate. The certificate serves as a root of trust for clients to ensure they are not communicating with a rogue domain controller. @@ -51,7 +51,7 @@ Sign-in using _Enterprise Admin_ equivalent credentials on Windows Server 2012 o ```PowerShell Install-AdcsCertificationAuthority ``` - + ## Configure a Production Public Key Infrastructure If you do have an existing public key infrastructure, please review [Certification Authority Guidance](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh831574(v=ws.11)) from Microsoft TechNet to properly design your infrastructure. Then, consult the [Test Lab Guide: Deploying an AD CS Two-Tier PKI Hierarchy](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh831348(v=ws.11)) for instructions on how to configure your public key infrastructure using the information from your design session. @@ -176,9 +176,9 @@ Sign-in to the certificate authority or management workstations with an _Enterpr 5. In the **Enable Certificates Templates** window, select the **Domain Controller Authentication (Kerberos)**, and **Internal Web Server** templates you created in the previous steps. Click **OK** to publish the selected certificate templates to the certificate authority. -6. If you published the Domain Controller Authentication (Kerberos) certificate template, then you should unpublish the certificate templates you included in the superseded templates list. +6. If you published the Domain Controller Authentication (Kerberos) certificate template, then you should unpublish the certificate templates you included in the superseded templates list. - \* To unpublish a certificate template, right-click the certificate template you want to unpublish in the details pane of the Certificate Authority console and select **Delete**. Click **Yes** to confirm the operation. + \* To unpublish a certificate template, right-click the certificate template you want to unpublish in the details pane of the Certificate Authority console and select **Delete**. Click **Yes** to confirm the operation. 7. Close the console. @@ -234,7 +234,6 @@ Look for an event indicating a new certificate enrollment (autoenrollment). The Certificates superseded by your new domain controller certificate generate an archive event in the CertificateServices-Lifecycles-System event. The archive event contains the certificate template name and thumbprint of the certificate that was superseded by the new certificate. - #### Certificate Manager You can use the Certificate Manager console to validate the domain controller has the properly enrolled certificate based on the correct certificate template with the proper EKUs. Use **certlm.msc** to view certificate in the local computers certificate stores. Expand the **Personal** store and view the certificates enrolled for the computer. Archived certificates do not appear in Certificate Manager. @@ -243,7 +242,7 @@ You can use the Certificate Manager console to validate the domain controller ha You can use **certutil.exe** to view enrolled certificates in the local computer. Certutil shows enrolled and archived certificates for the local computer. From an elevated command prompt, run `certutil -q -store my` to view locally enrolled certificates. -To view detailed information about each certificate in the store, use `certutil -q -v -store my` to validate automatic certificate enrollment enrolled the proper certificates. +To view detailed information about each certificate in the store, use `certutil -q -v -store my` to validate automatic certificate enrollment enrolled the proper certificates. #### Troubleshooting @@ -253,10 +252,10 @@ Alternatively, you can forcefully trigger automatic certificate enrollment using Use the event logs to monitor certificate enrollment and archive. Review the configuration, such as publishing certificate templates to issuing certificate authority and the allow auto enrollment permissions. - ## Follow the Windows Hello for Business on premises key trust deployment guide + 1. [Validate Active Directory prerequisites](hello-key-trust-validate-ad-prereq.md) 2. Validate and Configure Public Key Infrastructure (*You are here*) 3. [Prepare and Deploy Windows Server 2016 Active Directory Federation Services](hello-key-trust-adfs.md) 4. [Validate and Deploy Multifactor Authentication Services (MFA)](hello-key-trust-validate-deploy-mfa.md) -5. [Configure Windows Hello for Business Policy settings](hello-key-trust-policy-settings.md) \ No newline at end of file +5. [Configure Windows Hello for Business Policy settings](hello-key-trust-policy-settings.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-manage-in-organization.md b/windows/security/identity-protection/hello-for-business/hello-manage-in-organization.md index d6d92affa4..4b44e661ec 100644 --- a/windows/security/identity-protection/hello-for-business/hello-manage-in-organization.md +++ b/windows/security/identity-protection/hello-for-business/hello-manage-in-organization.md @@ -8,20 +8,21 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: prsriva manager: dansimp ms.collection: - M365-identity-device-management - highpri ms.topic: article ms.localizationpriority: medium -ms.date: 1/20/2021 +ms.date: 2/15/2022 --- # Manage Windows Hello for Business in your organization **Applies to** + - Windows 10 - Windows 11 diff --git a/windows/security/identity-protection/hello-for-business/hello-overview.md b/windows/security/identity-protection/hello-for-business/hello-overview.md index 5938679856..2cc0527401 100644 --- a/windows/security/identity-protection/hello-for-business/hello-overview.md +++ b/windows/security/identity-protection/hello-for-business/hello-overview.md @@ -8,8 +8,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: prsriva manager: dansimp ms.collection: - M365-identity-device-management @@ -120,7 +120,6 @@ Windows Hello for Business with a key, including cloud trust, does not support s [Windows 10: The End Game for Passwords and Credential Theft?](https://go.microsoft.com/fwlink/p/?LinkId=533891) - ## Related topics - [How Windows Hello for Business works](hello-how-it-works.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-planning-guide.md b/windows/security/identity-protection/hello-for-business/hello-planning-guide.md index b5c42012a1..65b58ef1a0 100644 --- a/windows/security/identity-protection/hello-for-business/hello-planning-guide.md +++ b/windows/security/identity-protection/hello-for-business/hello-planning-guide.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: prsriva manager: dansimp ms.collection: - M365-identity-device-management diff --git a/windows/security/identity-protection/hello-for-business/hello-prepare-people-to-use.md b/windows/security/identity-protection/hello-for-business/hello-prepare-people-to-use.md index 966f0adef8..8ab37765f1 100644 --- a/windows/security/identity-protection/hello-for-business/hello-prepare-people-to-use.md +++ b/windows/security/identity-protection/hello-for-business/hello-prepare-people-to-use.md @@ -9,8 +9,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: prsriva manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -21,8 +21,9 @@ ms.date: 08/19/2018 # Prepare people to use Windows Hello **Applies to** -- Windows 10 -- Windows 11 + +- Windows 10 +- Windows 11 When you set a policy to require Windows Hello for Business in the workplace, you will want to prepare people in your organization by explaining how to use Hello. diff --git a/windows/security/identity-protection/hello-for-business/hello-videos.md b/windows/security/identity-protection/hello-for-business/hello-videos.md index 61a06b945e..013f236742 100644 --- a/windows/security/identity-protection/hello-for-business/hello-videos.md +++ b/windows/security/identity-protection/hello-for-business/hello-videos.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: prsriva manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -19,8 +19,9 @@ ms.reviewer: # Windows Hello for Business Videos **Applies to** -- Windows 10 -- Windows 11 + +- Windows 10 +- Windows 11 ## Overview of Windows Hello for Business and Features diff --git a/windows/security/identity-protection/hello-for-business/hello-why-pin-is-better-than-password.md b/windows/security/identity-protection/hello-for-business/hello-why-pin-is-better-than-password.md index 88adebf4e7..0635a17b37 100644 --- a/windows/security/identity-protection/hello-for-business/hello-why-pin-is-better-than-password.md +++ b/windows/security/identity-protection/hello-for-business/hello-why-pin-is-better-than-password.md @@ -8,8 +8,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: prsriva manager: dansimp ms.collection: - M365-identity-device-management @@ -23,8 +23,8 @@ ms.date: 10/23/2017 **Applies to** -- Windows 10 -- Windows 11 +- Windows 10 +- Windows 11 Windows Hello in Windows 10 enables users to sign in to their device using a PIN. How is a PIN different from (and better than) a password? On the surface, a PIN looks much like a password. A PIN can be a set of numbers, but enterprise policy might allow complex PINs that include special characters and letters, both upper-case and lower-case. Something like **t758A!** could be an account password or a complex Hello PIN. It isn't the structure of a PIN (length, complexity) that makes it better than a password, it's how it works. diff --git a/windows/security/identity-protection/hello-for-business/index.yml b/windows/security/identity-protection/hello-for-business/index.yml index 4cb62fb1ce..62c038bd6b 100644 --- a/windows/security/identity-protection/hello-for-business/index.yml +++ b/windows/security/identity-protection/hello-for-business/index.yml @@ -8,9 +8,9 @@ metadata: description: Learn how to manage and deploy Windows Hello for Business. ms.prod: m365-security ms.topic: landing-page - author: mapalko + author: GitPrakhar13 manager: dansimp - ms.author: mapalko + ms.author: prsriva ms.date: 01/22/2021 ms.collection: - M365-identity-device-management diff --git a/windows/security/identity-protection/hello-for-business/microsoft-compatible-security-key.md b/windows/security/identity-protection/hello-for-business/microsoft-compatible-security-key.md index 308554bde8..556f49c888 100644 --- a/windows/security/identity-protection/hello-for-business/microsoft-compatible-security-key.md +++ b/windows/security/identity-protection/hello-for-business/microsoft-compatible-security-key.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: prsriva manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -16,9 +16,10 @@ localizationpriority: medium ms.date: 11/14/2018 ms.reviewer: --- -# What is a Microsoft-compatible security key? +# What is a Microsoft-compatible security key? + > [!Warning] -> Some information relates to pre-released product that may change before it is commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. +> Some information relates to pre-released product that may change before it is commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. Microsoft has been aligned with the [FIDO Alliance](https://fidoalliance.org/) with a mission to replace passwords with an easy to use, strong 2FA credential. We have been working with our partners to extensively test and deliver a seamless and secure authentication experience to end users. See [FIDO2 security keys features and providers](/azure/active-directory/authentication/concept-authentication-passwordless#fido2-security-keys). diff --git a/windows/security/identity-protection/hello-for-business/passwordless-strategy.md b/windows/security/identity-protection/hello-for-business/passwordless-strategy.md index 56a0e61012..f54986956f 100644 --- a/windows/security/identity-protection/hello-for-business/passwordless-strategy.md +++ b/windows/security/identity-protection/hello-for-business/passwordless-strategy.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: prsriva manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/reset-security-key.md b/windows/security/identity-protection/hello-for-business/reset-security-key.md index d9743650a3..99df1a799a 100644 --- a/windows/security/identity-protection/hello-for-business/reset-security-key.md +++ b/windows/security/identity-protection/hello-for-business/reset-security-key.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mapalko -ms.author: mapalko +author: GitPrakhar13 +ms.author: prsriva manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -18,7 +18,7 @@ ms.reviewer: --- # How to reset a Microsoft-compatible security key? > [!Warning] -> Some information relates to pre-released product that may change before it is commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. +> Some information relates to pre-released product that may change before it is commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. >[!IMPORTANT] >This operation will wipe everything from your security key and reset it to factory defaults.
**All data and credentials will be cleared.** @@ -37,4 +37,4 @@ Follow the instructions in the Settings app and look for specific instructions b >[!NOTE] >The steps to reset your security key may vary based on the security key manufacturer.
->If your security key is not listed here, please reach out to your security key manufacturer for reset instructions. \ No newline at end of file +>If your security key is not listed here, please reach out to your security key manufacturer for reset instructions.