diff --git a/.openpublishing.redirection.windows-security.json b/.openpublishing.redirection.windows-security.json index 0c3ed90ba7..4d5a16a8af 100644 --- a/.openpublishing.redirection.windows-security.json +++ b/.openpublishing.redirection.windows-security.json @@ -8114,6 +8114,76 @@ "source_path": "windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-pki.md", "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/on-premises-cert-trust-pki", "redirect_document_id": false - } + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-deployment-key-trust.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/on-premises-key-trust", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-key-trust-validate-ad-prereq.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/on-premises-key-trust", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-aad-join-cloud-only-deploy.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/cloud", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-hybrid-cloud-kerberos-trust-provision.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/hybrid-cloud-kerberos-trust-enroll", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-hybrid-cloud-kerberos-trust.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/hybrid-cloud-kerberos-trust", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-provision.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/hybrid-key-trust-enroll", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-validate-pki.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/hybrid-key-trust-pki", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/hybrid-key-trust", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-deployment-guide.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-key-trust-adfs.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/on-premises-key-trust-adfs", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-key-trust-policy-settings.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/on-premises-key-trust-enroll", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-key-trust-validate-deploy-mfa.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/on-premises-key-trust-mfa", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-key-trust-validate-pki.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/on-premises-key-trust-pki", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-identity-verification.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/requirements", + "redirect_document_id": false + } ] } \ No newline at end of file diff --git a/windows/security/identity-protection/hello-for-business/hello-aad-join-cloud-only-deploy.md b/windows/security/identity-protection/hello-for-business/deploy/cloud.md similarity index 94% rename from windows/security/identity-protection/hello-for-business/hello-aad-join-cloud-only-deploy.md rename to windows/security/identity-protection/hello-for-business/deploy/cloud.md index 58eac4892c..ca409fc0b7 100644 --- a/windows/security/identity-protection/hello-for-business/hello-aad-join-cloud-only-deploy.md +++ b/windows/security/identity-protection/hello-for-business/deploy/cloud.md @@ -6,7 +6,7 @@ ms.topic: how-to --- # Cloud-only deployment -[!INCLUDE [hello-hybrid-key-trust](./includes/hello-cloud.md)] +[!INCLUDE [apply-to-cloud](includes/apply-to-cloud.md)] ## Introduction @@ -21,7 +21,7 @@ You may wish to disable the automatic Windows Hello for Business enrollment prom Cloud only deployments will use Microsoft Entra multifactor authentication (MFA) during Windows Hello for Business enrollment, and there's no additional MFA configuration needed. If you aren't already registered in MFA, you'll be guided through the MFA registration as part of the Windows Hello for Business enrollment process. -The necessary Windows Hello for Business prerequisites are located at [Cloud Only Deployment](hello-identity-verification.md#azure-ad-cloud-only-deployment). +The necessary Windows Hello for Business prerequisites are located at [Cloud Only Deployment](requirements.md#azure-ad-cloud-only-deployment). It's possible for federated domains to configure the *FederatedIdpMfaBehavior* flag. The flag instructs Microsoft Entra ID to accept, enforce, or reject the MFA challenge from the federated IdP. For more information, see [federatedIdpMfaBehavior values](/graph/api/resources/internaldomainfederation#federatedidpmfabehavior-values). To check this setting, use the following PowerShell command: @@ -54,7 +54,7 @@ The following method explains how to disable Windows Hello for Business enrollme When disabled, users can't provision Windows Hello for Business. When set to Disabled, you can still configure the subsequent settings for Windows Hello for Business even though this policy won't enable Windows Hello for Business. > [!NOTE] -> This policy is only applied during new device enrollments. For currently enrolled devices, you can [set the same settings in a device configuration policy](hello-manage-in-organization.md). +> This policy is only applied during new device enrollments. For currently enrolled devices, you can [set the same settings in a device configuration policy](../hello-manage-in-organization.md). ## Disable Windows Hello for Business enrollment without Intune @@ -62,7 +62,7 @@ If you don't use Intune in your organization, then you can disable Windows Hello Intune uses the following registry keys: **`HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Policies\PassportForWork\\Device\Policies`** -To look up your Tenant ID, see [How to find your Microsoft Entra tenant ID](/azure/active-directory/fundamentals/how-to-find-tenant) or try the following, ensuring to sign-in with your organization's account: +To look up your Tenant ID, see [How to find your Microsoft Entra tenant ID](/azure/active-directory/fundamentals/how-to-find-tenant) or try the following, ensuring to sign in with your organization's account: ```msgraph-interactive GET https://graph.microsoft.com/v1.0/organization?$select=id diff --git a/windows/security/identity-protection/hello-for-business/deploy/hybrid-cert-trust-enroll.md b/windows/security/identity-protection/hello-for-business/deploy/hybrid-cert-trust-enroll.md index 1cf3d29281..a9363c8a74 100644 --- a/windows/security/identity-protection/hello-for-business/deploy/hybrid-cert-trust-enroll.md +++ b/windows/security/identity-protection/hello-for-business/deploy/hybrid-cert-trust-enroll.md @@ -19,7 +19,7 @@ ms.topic: tutorial After the prerequisites are met and the PKI and AD FS configurations are validated, Windows Hello for business must be enabled on the Windows devices. Follow the instructions below to configure your devices using either Microsoft Intune or group policy (GPO). -# [:::image type="icon" source="../../../images/icons/group-policy.svg"::: **GPO**](#tab/gpo) +# [:::image type="icon" source="images/group-policy.svg"::: **GPO**](#tab/gpo) > [!IMPORTANT] > The information in this section applies to Microsoft Entra hybrid joined devices only. @@ -96,7 +96,7 @@ The application of Group Policy object uses security group filtering. This solut Users (or devices) must receive the Windows Hello for Business group policy settings and have the proper permission to provision Windows Hello for Business. You can provide users with these settings and permissions by adding members to the *Windows Hello for Business Users* group. Users and groups who aren't members of this group won't attempt to enroll for Windows Hello for Business. -# [:::image type="icon" source="../../../images/icons/intune.svg"::: **Intune**](#tab/intune) +# [:::image type="icon" source="images/intune.svg"::: **Intune**](#tab/intune) ## Configure Windows Hello for Business using Microsoft Intune @@ -113,7 +113,7 @@ There are different ways to enable and configure Windows Hello for Business in I - Using a policy applied at the tenant level. The tenant policy: - Is only applied at enrollment time, and any changes to its configuration won't apply to devices already enrolled in Intune - It applies to *all devices* getting enrolled in Intune. For this reason, the policy is usually disabled and Windows Hello for Business is enabled using a policy targeted to a security group -- A device configuration policy that is applied *after* device enrollment. Any changes to the policy will be applied to the devices during regular policy refresh intervals. Chose from the following policy types: +- A device configuration policy that is applied *after* device enrollment. Any changes to the policy will be applied to the devices during regular policy refresh intervals. Choose from the following policy types: - [Settings catalog][MEM-1] - [Security baselines][MEM-2] - [Custom policy][MEM-3], via the [PassportForWork CSP][MEM-4] @@ -129,7 +129,7 @@ To check the Windows Hello for Business policy applied at enrollment time: 1. Select **Windows Hello for Business** 1. Verify the status of **Configure Windows Hello for Business** and any settings that may be configured -:::image type="content" source="../images/whfb-intune-disable.png" alt-text="Disablement of Windows Hello for Business from Microsoft Intune admin center." lightbox="../images/whfb-intune-disable.png"::: +:::image type="content" source="images/whfb-intune-disable.png" alt-text="Screenshot that shows disablement of Windows Hello for Business from Microsoft Intune admin center." lightbox="images/whfb-intune-disable.png"::: If the tenant-wide policy is enabled and configured to your needs, you can skip to [Enroll in Windows Hello for Business](#enroll-in-windows-hello-for-business). Otherwise, follow the instructions below to create a policy using an *account protection* policy. @@ -152,7 +152,7 @@ To configure Windows Hello for Business using an *account protection* policy: 1. Assign the policy to a security group that contains as members the devices or users that you want to configure > **Next** 1. Review the policy configuration and select **Create** -:::image type="content" source="../images/whfb-intune-account-protection-cert-enable.png" alt-text="Enablement of Windows Hello for Business from Microsoft Intune admin center using an account protection policy." lightbox="../images/whfb-intune-account-protection-cert-enable.png"::: +:::image type="content" source="images/whfb-intune-account-protection-cert-enable.png" alt-text="Screenshot that shows enablement of Windows Hello for Business from Microsoft Intune admin center using an account protection policy." lightbox="images/whfb-intune-account-protection-cert-enable.png"::: --- @@ -172,7 +172,7 @@ This is the process that occurs after a user signs in, to enroll in Windows Hell 1. After a successful MFA, the provisioning flow asks the user to create and validate a PIN. This PIN must observe any PIN complexity policies configured on the device 1. The remainder of the provisioning includes Windows Hello for Business requesting an asymmetric key pair for the user, preferably from the TPM (or required if explicitly set through policy). Once the key pair is acquired, Windows communicates with Microsoft Entra ID to register the public key. When key registration completes, Windows Hello for Business provisioning informs the user they can use their PIN to sign-in. The user may close the provisioning application and see their desktop. While the user has completed provisioning, Microsoft Entra Connect synchronizes the user's key to Active Directory -:::image type="content" source="../images/haadj-whfb-pin-provisioning.gif" alt-text="Animation showing a user logging on to an HAADJ device with a password, and being prompted to enroll in Windows Hello for Business."::: +:::image type="content" source="images/haadj-whfb-pin-provisioning.gif" alt-text="Screenshot that shows animation showing a user logging on to an HAADJ device with a password, and being prompted to enroll in Windows Hello for Business."::: > [!IMPORTANT] > The following is the enrollment behavior prior to Windows Server 2016 update [KB4088889 (14393.2155)](https://support.microsoft.com/help/4088889). diff --git a/windows/security/identity-protection/hello-for-business/deploy/hybrid-cert-trust-pki.md b/windows/security/identity-protection/hello-for-business/deploy/hybrid-cert-trust-pki.md index 38b871bba1..7ff5c70e48 100644 --- a/windows/security/identity-protection/hello-for-business/deploy/hybrid-cert-trust-pki.md +++ b/windows/security/identity-protection/hello-for-business/deploy/hybrid-cert-trust-pki.md @@ -10,7 +10,7 @@ appliesto: - ✅ Windows Server 2016 ms.topic: tutorial --- -# Configure and validate the PKI in an hybrid certificate trust model +# Configure and validate the PKI in a hybrid certificate trust model [!INCLUDE [apply-to-hybrid-cert-trust](includes/apply-to-hybrid-cert-trust.md)] @@ -18,11 +18,11 @@ Windows Hello for Business must have a Public Key Infrastructure (PKI) when usin Hybrid certificate trust deployments issue users a sign-in certificate, enabling them to authenticate to Active Directory using Windows Hello for Business credentials. Additionally, hybrid certificate trust deployments issue certificates to registration authorities to provide defense-in-depth security when issuing user authentication certificates. -[!INCLUDE [lab-based-pki-deploy](../includes/lab-based-pki-deploy.md)] +[!INCLUDE [lab-based-pki-deploy](includes/lab-based-pki-deploy.md)] ## Configure the enterprise PKI -[!INCLUDE [dc-certificate-template](../includes/dc-certificate-template.md)] +[!INCLUDE [dc-certificate-template](includes/dc-certificate-template.md)] > [!NOTE] > Inclusion of the *KDC Authentication* OID in domain controller certificate is not required for Microsoft Entra hybrid joined devices. The OID is required for enabling authentication with Windows Hello for Business to on-premises resources by Microsoft Entra joined devices. @@ -33,13 +33,13 @@ Hybrid certificate trust deployments issue users a sign-in certificate, enabling > - Install the root CA certificate in the device's trusted root certificate store. See [how to deploy a trusted certificate profile](/mem/intune/protect/certificates-trusted-root#to-create-a-trusted-certificate-profile) via Intune > - Publish your certificate revocation list to a location that is available to Microsoft Entra joined devices, such as a web-based URL -[!INCLUDE [dc-certificate-template-supersede](../includes/dc-certificate-supersede.md)] +[!INCLUDE [dc-certificate-template-supersede](includes/dc-certificate-supersede.md)] -[!INCLUDE [enrollment-agent-certificate-template](../includes/enrollment-agent-certificate-template.md)] +[!INCLUDE [enrollment-agent-certificate-template](includes/enrollment-agent-certificate-template.md)] -[!INCLUDE [auth-certificate-template](../includes/auth-certificate-template.md)] +[!INCLUDE [auth-certificate-template](includes/auth-certificate-template.md)] -[!INCLUDE [unpublish-superseded-templates](../includes/unpublish-superseded-templates.md)] +[!INCLUDE [unpublish-superseded-templates](includes/unpublish-superseded-templates.md)] ### Publish the certificate templates to the CA @@ -59,11 +59,11 @@ Sign in to the CA or management workstations with **Enterprise Admin** equivalen ## Configure and deploy certificates to domain controllers -[!INCLUDE [dc-certificate-deployment](../includes/dc-certificate-deployment.md)] +[!INCLUDE [dc-certificate-deployment](includes/dc-certificate-deployment.md)] ## Validate the configuration -[!INCLUDE [dc-certificate-validate](../includes/dc-certificate-validate.md)] +[!INCLUDE [dc-certificate-validate](includes/dc-certificate-validate.md)] ## Section review and next steps diff --git a/windows/security/identity-protection/hello-for-business/deploy/hybrid-cert-trust.md b/windows/security/identity-protection/hello-for-business/deploy/hybrid-cert-trust.md index 44cb5bf3a4..a9d49ebfec 100644 --- a/windows/security/identity-protection/hello-for-business/deploy/hybrid-cert-trust.md +++ b/windows/security/identity-protection/hello-for-business/deploy/hybrid-cert-trust.md @@ -20,7 +20,7 @@ Hybrid environments are distributed systems that enable organizations to use on- This deployment guide describes how to deploy Windows Hello for Business in a hybrid certificate trust scenario. > [!IMPORTANT] -> Windows Hello for Business *cloud Kerberos trust* is the recommended deployment model when compared to the *key trust model*. It is also the recommended deployment model if you don't need to deploy certificates to the end users. For more information, see [cloud Kerberos trust deployment](../hello-hybrid-cloud-kerberos-trust.md). +> Windows Hello for Business *cloud Kerberos trust* is the recommended deployment model when compared to the *key trust model*. It is also the recommended deployment model if you don't need to deploy certificates to the end users. For more information, see [cloud Kerberos trust deployment](hybrid-cloud-kerberos-trust.md). It's recommended that you review the [Windows Hello for Business planning guide](../hello-planning-guide.md) prior to using the deployment guide. The planning guide helps you make decisions by explaining the available options with each aspect of the deployment and explains the potential outcomes based on each of these decisions. @@ -44,7 +44,7 @@ Hybrid Windows Hello for Business needs two directories: - A Microsoft Entra tenant with a Microsoft Entra ID P1 or P2 subscription The two directories must be synchronized with [Microsoft Entra Connect Sync][AZ-1], which synchronizes user accounts from the on-premises Active Directory to Microsoft Entra ID. -The hybrid-certificate trust deployment needs an *Microsoft Entra ID P1 or P2* subscription because it uses the device write-back synchronization feature. +The hybrid-certificate trust deployment needs a *Microsoft Entra ID P1 or P2* subscription because it uses the device write-back synchronization feature. > [!NOTE] > Windows Hello for Business hybrid certificate trust is not supported if the users' on-premises UPN suffix cannot be added as a verified domain in Microsoft Entra ID. diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cloud-kerberos-trust-provision.md b/windows/security/identity-protection/hello-for-business/deploy/hybrid-cloud-kerberos-trust-enroll.md similarity index 96% rename from windows/security/identity-protection/hello-for-business/hello-hybrid-cloud-kerberos-trust-provision.md rename to windows/security/identity-protection/hello-for-business/deploy/hybrid-cloud-kerberos-trust-enroll.md index 7b4394d51f..da843f036d 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cloud-kerberos-trust-provision.md +++ b/windows/security/identity-protection/hello-for-business/deploy/hybrid-cloud-kerberos-trust-enroll.md @@ -8,7 +8,7 @@ ms.topic: tutorial --- # Configure and provision Windows Hello for Business - cloud Kerberos trust -[!INCLUDE [hello-hybrid-key-trust](./includes/hello-hybrid-cloudkerb-trust.md)] +[!INCLUDE [apply-to-hybrid-cloud-kerberos-trust](includes/apply-to-hybrid-cloud-kerberos-trust.md)] ## Deployment steps @@ -29,7 +29,7 @@ If you haven't deployed Microsoft Entra Kerberos, follow the instructions in the After setting up the Microsoft Entra Kerberos object, Windows Hello for business cloud Kerberos trust must be enabled on your Windows devices. Follow the instructions below to configure your devices using either Microsoft Intune or group policy (GPO). -#### [:::image type="icon" source="../../images/icons/intune.svg"::: **Intune**](#tab/intune) +#### [:::image type="icon" source="images/intune.svg"::: **Intune**](#tab/intune) For devices managed by Intune, you can use Intune policies to configure Windows Hello for Business. @@ -68,7 +68,7 @@ To configure Windows Hello for Business using an account protection policy: 1. Specify a **Name** and, optionally, a **Description** > **Next**. 1. Under **Block Windows Hello for Business**, select **Disabled** and multiple policies become available. - These policies are optional to configure, but it's recommended to configure **Enable to use a Trusted Platform Module (TPM)** to **Yes**. - - For more information about these policies, see [MDM policy settings for Windows Hello for Business](hello-manage-in-organization.md#mdm-policy-settings-for-windows-hello-for-business). + - For more information about these policies, see [MDM policy settings for Windows Hello for Business](../hello-manage-in-organization.md#mdm-policy-settings-for-windows-hello-for-business). 1. Under **Enable to certificate for on-premises resources**, select **Not configured** 1. Select **Next**. 1. Optionally, add **scope tags** and select **Next**. @@ -107,7 +107,7 @@ To configure the cloud Kerberos trust policy: 1. Assign the policy to a security group that contains as members the devices or users that you want to configure. -#### [:::image type="icon" source="../../images/icons/group-policy.svg"::: **GPO**](#tab/gpo) +#### [:::image type="icon" source="images/group-policy.svg"::: **GPO**](#tab/gpo) Microsoft Entra hybrid joined organizations can use Windows Hello for Business Group Policy to manage the feature. Group Policy can be configured to enable users to enroll and use Windows Hello for Business. @@ -118,7 +118,7 @@ You can configure the Enable Windows Hello for Business Group Policy setting for Cloud Kerberos trust requires setting a dedicated policy for it to be enabled. This policy is only available as a computer configuration. > [!NOTE] -> If you deployed Windows Hello for Business configuration using both Group Policy and Microsoft Intune, Group Policy settings will take precedence and Intune settings will be ignored. For more information about deploying Windows Hello for Business configuration using Microsoft Intune, see [Windows device settings to enable Windows Hello for Business in Intune][MEM-1] and [PassportForWork CSP](/windows/client-management/mdm/passportforwork-csp). For more information about policy conflicts, see [Policy conflicts from multiple policy sources](hello-manage-in-organization.md#policy-conflicts-from-multiple-policy-sources). +> If you deployed Windows Hello for Business configuration using both Group Policy and Microsoft Intune, Group Policy settings will take precedence and Intune settings will be ignored. For more information about deploying Windows Hello for Business configuration using Microsoft Intune, see [Windows device settings to enable Windows Hello for Business in Intune][MEM-1] and [PassportForWork CSP](/windows/client-management/mdm/passportforwork-csp). For more information about policy conflicts, see [Policy conflicts from multiple policy sources](../hello-manage-in-organization.md#policy-conflicts-from-multiple-policy-sources). #### Update administrative templates @@ -199,7 +199,7 @@ If you deployed Windows Hello for Business using the certificate trust model, an ## Frequently Asked Questions -For a list of frequently asked questions about Windows Hello for Business cloud Kerberos trust, see [Windows Hello for Business Frequently Asked Questions](hello-faq.yml#cloud-kerberos-trust). +For a list of frequently asked questions about Windows Hello for Business cloud Kerberos trust, see [Windows Hello for Business Frequently Asked Questions](../hello-faq.yml#cloud-kerberos-trust). diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cloud-kerberos-trust.md b/windows/security/identity-protection/hello-for-business/deploy/hybrid-cloud-kerberos-trust.md similarity index 96% rename from windows/security/identity-protection/hello-for-business/hello-hybrid-cloud-kerberos-trust.md rename to windows/security/identity-protection/hello-for-business/deploy/hybrid-cloud-kerberos-trust.md index 464e918a1e..c53e872bb1 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cloud-kerberos-trust.md +++ b/windows/security/identity-protection/hello-for-business/deploy/hybrid-cloud-kerberos-trust.md @@ -8,7 +8,7 @@ ms.topic: tutorial --- # Cloud Kerberos trust deployment -[!INCLUDE [hello-hybrid-key-trust](./includes/hello-hybrid-cloudkerb-trust.md)] +[!INCLUDE [apply-to-hybrid-cloud-kerberos-trust](includes/apply-to-hybrid-cloud-kerberos-trust.md)] Windows Hello for Business replaces password sign-in with strong authentication, using an asymmetric key pair. This deployment guide provides the information to deploy Windows Hello for Business in a *cloud Kerberos trust* scenario. @@ -45,7 +45,7 @@ When Microsoft Entra Kerberos is enabled in an Active Directory domain, an *Azur :::image type="content" source="images/azuread-kerberos-object.png" alt-text="Active Directory Users and Computers console, showing the computer object representing the Microsoft Entra Kerberos server "::: For more information about how Microsoft Entra Kerberos enables access to on-premises resources, see [enabling passwordless security key sign-in to on-premises resources][AZ-1].\ -For more information about how Microsoft Entra Kerberos works with Windows Hello for Business cloud Kerberos trust, see [Windows Hello for Business authentication technical deep dive](hello-how-it-works-authentication.md#hybrid-azure-ad-join-authentication-using-cloud-kerberos-trust). +For more information about how Microsoft Entra Kerberos works with Windows Hello for Business cloud Kerberos trust, see [Windows Hello for Business authentication technical deep dive](../hello-how-it-works-authentication.md#hybrid-azure-ad-join-authentication-using-cloud-kerberos-trust). > [!IMPORTANT] > When implementing the cloud Kerberos trust deployment model, you *must* ensure that you have an adequate number of *read-write domain controllers* in each Active Directory site where users will be authenticating with Windows Hello for Business. For more information, see [Capacity planning for Active Directory][SERV-1]. @@ -84,7 +84,7 @@ Once the prerequisites are met, deploying Windows Hello for Business with a clou > * Provision Windows Hello for Business on Windows clients > [!div class="nextstepaction"] -> [Next: configure and provision Windows Hello for Business >](hello-hybrid-cloud-kerberos-trust-provision.md) +> [Next: configure and provision Windows Hello for Business >](hybrid-cloud-kerberos-trust-enroll.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-provision.md b/windows/security/identity-protection/hello-for-business/deploy/hybrid-key-trust-enroll.md similarity index 95% rename from windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-provision.md rename to windows/security/identity-protection/hello-for-business/deploy/hybrid-key-trust-enroll.md index dc8d3d3a24..10b8e56a94 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-provision.md +++ b/windows/security/identity-protection/hello-for-business/deploy/hybrid-key-trust-enroll.md @@ -7,11 +7,11 @@ ms.topic: tutorial # Configure and enroll in Windows Hello for Business - hybrid key trust -[!INCLUDE [hello-hybrid-key-trust](./includes/hello-hybrid-key-trust.md)] +[!INCLUDE [apply-to-hybrid-key-trust](includes/apply-to-hybrid-key-trust.md)] After the prerequisites are met and the PKI configuration is validated, Windows Hello for business must be enabled on the Windows devices. Follow the instructions below to configure your devices using either Microsoft Intune or group policy (GPO). -#### [:::image type="icon" source="../../images/icons/intune.svg"::: **Intune**](#tab/intune) +#### [:::image type="icon" source="images/intune.svg"::: **Intune**](#tab/intune) ## Configure Windows Hello for Business using Microsoft Intune @@ -54,7 +54,7 @@ To configure Windows Hello for Business using an *account protection* policy: 1. Specify a **Name** and, optionally, a **Description** > **Next** 1. Under *Block Windows Hello for Business*, select **Disabled** and multiple policies become available - These policies are optional to configure, but it's recommended to configure *Enable to use a Trusted Platform Module (TPM)* to **Yes** - - For more information about these policies, see [MDM policy settings for Windows Hello for Business](hello-manage-in-organization.md#mdm-policy-settings-for-windows-hello-for-business) + - For more information about these policies, see [MDM policy settings for Windows Hello for Business](../hello-manage-in-organization.md#mdm-policy-settings-for-windows-hello-for-business) 1. Select **Next** 1. Optionally, add *scope tags* > **Next** 1. Assign the policy to a security group that contains as members the devices or users that you want to configure > **Next** @@ -62,7 +62,7 @@ To configure Windows Hello for Business using an *account protection* policy: :::image type="content" source="images/whfb-intune-account-protection-enable.png" alt-text="Enablement of Windows Hello for Business from Microsoft Intune admin center using an account protection policy." lightbox="images/whfb-intune-account-protection-enable.png"::: -#### [:::image type="icon" source="../../images/icons/group-policy.svg"::: **GPO**](#tab/gpo) +#### [:::image type="icon" source="images/group-policy.svg"::: **GPO**](#tab/gpo) ## Configure Windows Hello for Business using group policies @@ -72,7 +72,7 @@ It's suggested to create a security group (for example, *Windows Hello for Busin The Windows Hello for Business Group Policy object delivers the correct Group Policy settings to the user, which enables them to enroll and use Windows Hello for Business to authenticate to Azure and Active Directory > [!NOTE] -> If you deployed Windows Hello for Business configuration using both Group Policy and Intune, Group Policy settings will take precedence and Intune settings will be ignored. For more information about policy conflicts, see [Policy conflicts from multiple policy sources](hello-manage-in-organization.md#policy-conflicts-from-multiple-policy-sources) +> If you deployed Windows Hello for Business configuration using both Group Policy and Intune, Group Policy settings will take precedence and Intune settings will be ignored. For more information about policy conflicts, see [Policy conflicts from multiple policy sources](../hello-manage-in-organization.md#policy-conflicts-from-multiple-policy-sources) ### Enable Windows Hello for Business group policy setting @@ -100,8 +100,8 @@ Sign-in a domain controller or management workstations with *Domain Admin* equiv > [!NOTE] > Windows Hello for Business can be configured using different policies. These policies are optional to configure, but it's recommended to enable *Use a hardware security device*. -> -> For more information about these policies, see [Group Policy settings for Windows Hello for Business](hello-manage-in-organization.md#group-policy-settings-for-windows-hello-for-business). +> +> For more information about these policies, see [Group Policy settings for Windows Hello for Business](../hello-manage-in-organization.md#group-policy-settings-for-windows-hello-for-business). ### Configure security for GPO diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-validate-pki.md b/windows/security/identity-protection/hello-for-business/deploy/hybrid-key-trust-pki.md similarity index 96% rename from windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-validate-pki.md rename to windows/security/identity-protection/hello-for-business/deploy/hybrid-key-trust-pki.md index f39545b8e8..2fa08c15c9 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-validate-pki.md +++ b/windows/security/identity-protection/hello-for-business/deploy/hybrid-key-trust-pki.md @@ -1,6 +1,6 @@ --- -title: Configure and validate the Public Key Infrastructure in an hybrid key trust model -description: Configure and validate the Public Key Infrastructure when deploying Windows Hello for Business in an hybrid key trust model. +title: Configure and validate the Public Key Infrastructure in a hybrid key trust model +description: Configure and validate the Public Key Infrastructure when deploying Windows Hello for Business in a hybrid key trust model. ms.date: 01/03/2023 appliesto: - ✅ Windows 11 @@ -12,7 +12,7 @@ ms.topic: tutorial --- # Configure and validate the Public Key Infrastructure - hybrid key trust -[!INCLUDE [hello-hybrid-key-trust](./includes/hello-hybrid-key-trust.md)] +[!INCLUDE [apply-to-hybrid-key-trust](includes/apply-to-hybrid-key-trust.md)] Windows Hello for Business must have a Public Key Infrastructure (PKI) when using the *key trust* model. The domain controllers must have a certificate, which serves as a *root of trust* for clients. The certificate ensures that clients don't communicate with rogue domain controllers. @@ -53,6 +53,7 @@ Sign in using *Enterprise Administrator* equivalent credentials on a Windows Ser > [!IMPORTANT] > For Microsoft Entra joined devices to authenticate to on-premises resources, ensure to: +> > - Install the root CA certificate in the device's trusted root certificate store. See [how to deploy a trusted certificate profile](/mem/intune/protect/certificates-trusted-root#to-create-a-trusted-certificate-profile) via Intune > - Publish your certificate revocation list to a location that is available to Microsoft Entra joined devices, such as a web-based URL @@ -74,7 +75,7 @@ Sign in to the CA or management workstations with **Enterprise Admin** equivalen 1. Close the console > [!IMPORTANT] -> If you plan to deploy **Microsoft Entra joined** devices, and require single sign-on (SSO) to on-premises resources when signing in with Windows Hello for Business, follow the procedures to [update your CA to include an http-based CRL distribution point](hello-hybrid-aadj-sso.md). +> If you plan to deploy **Microsoft Entra joined** devices, and require single sign-on (SSO) to on-premises resources when signing in with Windows Hello for Business, follow the procedures to [update your CA to include an http-based CRL distribution point](../hello-hybrid-aadj-sso.md). ## Configure and deploy certificates to domain controllers @@ -89,6 +90,7 @@ Sign in to the CA or management workstations with **Enterprise Admin** equivalen Before moving to the next section, ensure the following steps are complete: > [!div class="checklist"] +> > - Configure domain controller certificates > - Supersede existing domain controller certificates > - Unpublish superseded certificate templates @@ -97,7 +99,7 @@ Before moving to the next section, ensure the following steps are complete: > - Validate the domain controllers configuration > [!div class="nextstepaction"] -> [Next: configure and provision Windows Hello for Business >](hello-hybrid-key-trust-provision.md) +> [Next: configure and provision Windows Hello for Business >](hybrid-key-trust-enroll.md) [SERV-1]: /troubleshoot/windows-server/windows-security/requirements-domain-controller diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust.md b/windows/security/identity-protection/hello-for-business/deploy/hybrid-key-trust.md similarity index 92% rename from windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust.md rename to windows/security/identity-protection/hello-for-business/deploy/hybrid-key-trust.md index a0a36f2cc0..2b0ec7021d 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust.md +++ b/windows/security/identity-protection/hello-for-business/deploy/hybrid-key-trust.md @@ -12,16 +12,16 @@ ms.topic: how-to --- # Hybrid key trust deployment -[!INCLUDE [hello-hybrid-key-trust](./includes/hello-hybrid-key-trust.md)] +[!INCLUDE [apply-to-hybrid-key-trust](includes/apply-to-hybrid-key-trust.md)] Hybrid environments are distributed systems that enable organizations to use on-premises and Microsoft Entra protected resources. Windows Hello for Business uses the existing distributed system as a foundation on which organizations can provide two-factor authentication and single sign-on to modern resources. This deployment guide describes how to deploy Windows Hello for Business in a hybrid key trust scenario. > [!IMPORTANT] -> Windows Hello for Business *cloud Kerberos trust* is the recommended deployment model when compared to the *key trust model*. For more information, see [cloud Kerberos trust deployment](hello-hybrid-cloud-kerberos-trust.md). +> Windows Hello for Business *cloud Kerberos trust* is the recommended deployment model when compared to the *key trust model*. For more information, see [cloud Kerberos trust deployment](hybrid-cloud-kerberos-trust.md). -It is recommended that you review the [Windows Hello for Business planning guide](hello-planning-guide.md) prior to using the deployment guide. The planning guide helps you make decisions by explaining the available options with each aspect of the deployment and explains the potential outcomes based on each of these decisions. +It is recommended that you review the [Windows Hello for Business planning guide](../hello-planning-guide.md) prior to using the deployment guide. The planning guide helps you make decisions by explaining the available options with each aspect of the deployment and explains the potential outcomes based on each of these decisions. ## Prerequisites @@ -94,7 +94,7 @@ Once the prerequisites are met, deploying Windows Hello for Business with a hybr > * Configure single sign-on (SSO) for Microsoft Entra joined devices > [!div class="nextstepaction"] -> [Next: configure and validate the Public Key Infrastructure >](hello-hybrid-key-trust-validate-pki.md) +> [Next: configure and validate the Public Key Infrastructure >](hybrid-key-trust-pki.md) [AZ-1]: /azure/active-directory/hybrid/how-to-connect-sync-whatis diff --git a/windows/security/identity-protection/hello-for-business/images/adfs-device-registration.png b/windows/security/identity-protection/hello-for-business/deploy/images/adfs-device-registration.png similarity index 100% rename from windows/security/identity-protection/hello-for-business/images/adfs-device-registration.png rename to windows/security/identity-protection/hello-for-business/deploy/images/adfs-device-registration.png diff --git a/windows/security/identity-protection/hello-for-business/images/adfs-scp.png b/windows/security/identity-protection/hello-for-business/deploy/images/adfs-scp.png similarity index 100% rename from windows/security/identity-protection/hello-for-business/images/adfs-scp.png rename to windows/security/identity-protection/hello-for-business/deploy/images/adfs-scp.png diff --git a/windows/security/identity-protection/hello-for-business/images/azuread-kerberos-object.png b/windows/security/identity-protection/hello-for-business/deploy/images/azuread-kerberos-object.png similarity index 100% rename from windows/security/identity-protection/hello-for-business/images/azuread-kerberos-object.png rename to windows/security/identity-protection/hello-for-business/deploy/images/azuread-kerberos-object.png diff --git a/windows/security/identity-protection/hello-for-business/images/cloud-trust-prereq-check.png b/windows/security/identity-protection/hello-for-business/deploy/images/cloud-trust-prereq-check.png similarity index 100% rename from windows/security/identity-protection/hello-for-business/images/cloud-trust-prereq-check.png rename to windows/security/identity-protection/hello-for-business/deploy/images/cloud-trust-prereq-check.png diff --git a/windows/security/identity-protection/hello-for-business/images/event358.png b/windows/security/identity-protection/hello-for-business/deploy/images/event358.png similarity index 100% rename from windows/security/identity-protection/hello-for-business/images/event358.png rename to windows/security/identity-protection/hello-for-business/deploy/images/event358.png diff --git a/windows/security/identity-protection/hello-for-business/deploy/images/group-policy.svg b/windows/security/identity-protection/hello-for-business/deploy/images/group-policy.svg new file mode 100644 index 0000000000..ace95add6b --- /dev/null +++ b/windows/security/identity-protection/hello-for-business/deploy/images/group-policy.svg @@ -0,0 +1,3 @@ + + + \ No newline at end of file diff --git a/windows/security/identity-protection/hello-for-business/images/haadj-whfb-pin-provisioning.gif b/windows/security/identity-protection/hello-for-business/deploy/images/haadj-whfb-pin-provisioning.gif similarity index 100% rename from windows/security/identity-protection/hello-for-business/images/haadj-whfb-pin-provisioning.gif rename to windows/security/identity-protection/hello-for-business/deploy/images/haadj-whfb-pin-provisioning.gif diff --git a/windows/security/identity-protection/hello-for-business/images/hello-cloud-trust-intune-large.png b/windows/security/identity-protection/hello-for-business/deploy/images/hello-cloud-trust-intune-large.png similarity index 100% rename from windows/security/identity-protection/hello-for-business/images/hello-cloud-trust-intune-large.png rename to windows/security/identity-protection/hello-for-business/deploy/images/hello-cloud-trust-intune-large.png diff --git a/windows/security/identity-protection/hello-for-business/images/hello-cloud-trust-intune.png b/windows/security/identity-protection/hello-for-business/deploy/images/hello-cloud-trust-intune.png similarity index 100% rename from windows/security/identity-protection/hello-for-business/images/hello-cloud-trust-intune.png rename to windows/security/identity-protection/hello-for-business/deploy/images/hello-cloud-trust-intune.png diff --git a/windows/security/identity-protection/hello-for-business/images/hello-internal-web-server-cert.png b/windows/security/identity-protection/hello-for-business/deploy/images/hello-internal-web-server-cert.png similarity index 100% rename from windows/security/identity-protection/hello-for-business/images/hello-internal-web-server-cert.png rename to windows/security/identity-protection/hello-for-business/deploy/images/hello-internal-web-server-cert.png diff --git a/windows/security/identity-protection/hello-for-business/deploy/images/information.svg b/windows/security/identity-protection/hello-for-business/deploy/images/information.svg new file mode 100644 index 0000000000..bc692eabb9 --- /dev/null +++ b/windows/security/identity-protection/hello-for-business/deploy/images/information.svg @@ -0,0 +1,3 @@ + + + \ No newline at end of file diff --git a/windows/security/identity-protection/hello-for-business/deploy/images/intune.svg b/windows/security/identity-protection/hello-for-business/deploy/images/intune.svg new file mode 100644 index 0000000000..6e0d938aed --- /dev/null +++ b/windows/security/identity-protection/hello-for-business/deploy/images/intune.svg @@ -0,0 +1,24 @@ + + + + + + + + + + + + + + + + Icon-intune-329 + + + + + + + + \ No newline at end of file diff --git a/windows/security/identity-protection/hello-for-business/images/whfb-intune-account-protection-cert-enable.png b/windows/security/identity-protection/hello-for-business/deploy/images/whfb-intune-account-protection-cert-enable.png similarity index 100% rename from windows/security/identity-protection/hello-for-business/images/whfb-intune-account-protection-cert-enable.png rename to windows/security/identity-protection/hello-for-business/deploy/images/whfb-intune-account-protection-cert-enable.png diff --git a/windows/security/identity-protection/hello-for-business/images/whfb-intune-account-protection-enable.png b/windows/security/identity-protection/hello-for-business/deploy/images/whfb-intune-account-protection-enable.png similarity index 100% rename from windows/security/identity-protection/hello-for-business/images/whfb-intune-account-protection-enable.png rename to windows/security/identity-protection/hello-for-business/deploy/images/whfb-intune-account-protection-enable.png diff --git a/windows/security/identity-protection/hello-for-business/images/whfb-intune-disable.png b/windows/security/identity-protection/hello-for-business/deploy/images/whfb-intune-disable.png similarity index 100% rename from windows/security/identity-protection/hello-for-business/images/whfb-intune-disable.png rename to windows/security/identity-protection/hello-for-business/deploy/images/whfb-intune-disable.png diff --git a/windows/security/identity-protection/hello-for-business/deploy/includes/apply-to-cloud.md b/windows/security/identity-protection/hello-for-business/deploy/includes/apply-to-cloud.md new file mode 100644 index 0000000000..69c159b0a2 --- /dev/null +++ b/windows/security/identity-protection/hello-for-business/deploy/includes/apply-to-cloud.md @@ -0,0 +1,9 @@ +--- +ms.date: 12/15/2023 +ms.topic: include +--- + +[!INCLUDE [intro](intro.md)] +- **Deployment type:** [!INCLUDE [tooltip-deployment-cloud](tooltip-deployment-cloud.md)] +- **Join type:** [!INCLUDE [tootip-join-entra](tooltip-join-entra.md)] +--- \ No newline at end of file diff --git a/windows/security/identity-protection/hello-for-business/deploy/includes/apply-to-hybrid-cert-trust-entra.md b/windows/security/identity-protection/hello-for-business/deploy/includes/apply-to-hybrid-cert-trust-entra.md index 97bfdbe297..31073eae23 100644 --- a/windows/security/identity-protection/hello-for-business/deploy/includes/apply-to-hybrid-cert-trust-entra.md +++ b/windows/security/identity-protection/hello-for-business/deploy/includes/apply-to-hybrid-cert-trust-entra.md @@ -3,8 +3,8 @@ ms.date: 12/15/2023 ms.topic: include --- -[!INCLUDE [hello-intro](../../includes/hello-intro.md)] -- **Deployment type:** [!INCLUDE [hello-deployment-hybrid](../../includes/hello-deployment-hybrid.md)] -- **Trust type:** [!INCLUDE [tooltip-cert-trust](tooltip-cert-trust.md)] -- **Join type:** [!INCLUDE [hello-join-aadj](../../includes/hello-join-aad.md)] +[!INCLUDE [intro](intro.md)] +- **Deployment type:** [!INCLUDE [tooltip-deployment-hybrid](tooltip-deployment-hybrid.md)] +- **Trust type:** [!INCLUDE [tooltip-cert-trust](tooltip-trust-cert.md)] +- **Join type:** [!INCLUDE [tooltip-join-entra](tooltip-join-entra.md)] --- \ No newline at end of file diff --git a/windows/security/identity-protection/hello-for-business/deploy/includes/apply-to-hybrid-cert-trust.md b/windows/security/identity-protection/hello-for-business/deploy/includes/apply-to-hybrid-cert-trust.md index 0b5a246fbe..4f8eb7e613 100644 --- a/windows/security/identity-protection/hello-for-business/deploy/includes/apply-to-hybrid-cert-trust.md +++ b/windows/security/identity-protection/hello-for-business/deploy/includes/apply-to-hybrid-cert-trust.md @@ -3,8 +3,8 @@ ms.date: 12/15/2023 ms.topic: include --- -[!INCLUDE [hello-intro](../../includes/hello-intro.md)] -- **Deployment type:** [!INCLUDE [hello-deployment-hybrid](../../includes/hello-deployment-hybrid.md)] -- **Trust type:** [!INCLUDE [tooltip-cert-trust](tooltip-cert-trust.md)] -- **Join type:** [!INCLUDE [hello-join-aadj](../../includes/hello-join-aad.md)], [!INCLUDE [hello-join-hybrid](../../includes/hello-join-hybrid.md)] +[!INCLUDE [intro](intro.md)] +- **Deployment type:** [!INCLUDE [tooltip-deployment-hybrid](tooltip-deployment-hybrid.md)] +- **Trust type:** [!INCLUDE [tooltip-cert-trust](tooltip-trust-cert.md)] +- **Join type:** [!INCLUDE [tooltip-join-entra](tooltip-join-entra.md)], [!INCLUDE [tooltip-join-hybrid](tooltip-join-hybrid.md)] --- \ No newline at end of file diff --git a/windows/security/identity-protection/hello-for-business/deploy/includes/apply-to-hybrid-cloud-kerberos-trust.md b/windows/security/identity-protection/hello-for-business/deploy/includes/apply-to-hybrid-cloud-kerberos-trust.md new file mode 100644 index 0000000000..9fd4c16a63 --- /dev/null +++ b/windows/security/identity-protection/hello-for-business/deploy/includes/apply-to-hybrid-cloud-kerberos-trust.md @@ -0,0 +1,10 @@ +--- +ms.date: 12/15/2023 +ms.topic: include +--- + +[!INCLUDE [intro](intro.md)] +- **Deployment type:** [!INCLUDE [tooltip-deployment-hybrid](tooltip-deployment-hybrid.md)] +- **Trust type:** [!INCLUDE [tooltip-trust-cloud-kerberos](tooltip-trust-cloud-kerberos.md)] +- **Join type:** [!INCLUDE [tooltip-join-entra](tooltip-join-entra.md)], [!INCLUDE [tooltip-join-hybrid](tooltip-join-hybrid.md)] +--- \ No newline at end of file diff --git a/windows/security/identity-protection/hello-for-business/deploy/includes/apply-to-hybrid-key-and-cert-trust.md b/windows/security/identity-protection/hello-for-business/deploy/includes/apply-to-hybrid-key-and-cert-trust.md new file mode 100644 index 0000000000..1a17ea9d1f --- /dev/null +++ b/windows/security/identity-protection/hello-for-business/deploy/includes/apply-to-hybrid-key-and-cert-trust.md @@ -0,0 +1,10 @@ +--- +ms.date: 12/15/2023 +ms.topic: include +--- + +[!INCLUDE [intro](intro.md)] +- **Deployment type:** [!INCLUDE [tooltip-deployment-hybrid](tooltip-deployment-hybrid.md)] +- **Trust type:** [!INCLUDE [tooltip-trust-key](tooltip-trust-key.md)],[!INCLUDE [tooltip-cert-trust](tooltip-trust-cert.md)] +- **Join type:** [!INCLUDE [tooltip-join-entra](tooltip-join-entra.md)] +--- \ No newline at end of file diff --git a/windows/security/identity-protection/hello-for-business/deploy/includes/apply-to-hybrid-key-trust.md b/windows/security/identity-protection/hello-for-business/deploy/includes/apply-to-hybrid-key-trust.md new file mode 100644 index 0000000000..a74e9ead78 --- /dev/null +++ b/windows/security/identity-protection/hello-for-business/deploy/includes/apply-to-hybrid-key-trust.md @@ -0,0 +1,10 @@ +--- +ms.date: 12/15/2023 +ms.topic: include +--- + +[!INCLUDE [intro](intro.md)] +- **Deployment type:** [!INCLUDE [tooltip-deployment-hybrid](tooltip-deployment-hybrid.md)] +- **Trust type:** [!INCLUDE [tooltip-trust-key](tooltip-trust-key.md)] +- **Join type:** [!INCLUDE [tooltip-join-entra](tooltip-join-entra.md)], [!INCLUDE [tooltip-join-hybrid](tooltip-join-hybrid.md)] +--- \ No newline at end of file diff --git a/windows/security/identity-protection/hello-for-business/deploy/includes/apply-to-on-premises-cert-trust-entra.md b/windows/security/identity-protection/hello-for-business/deploy/includes/apply-to-on-premises-cert-trust-entra.md index 5f64fba40f..e3c6bad7b3 100644 --- a/windows/security/identity-protection/hello-for-business/deploy/includes/apply-to-on-premises-cert-trust-entra.md +++ b/windows/security/identity-protection/hello-for-business/deploy/includes/apply-to-on-premises-cert-trust-entra.md @@ -3,8 +3,8 @@ ms.date: 12/15/2023 ms.topic: include --- -[!INCLUDE [hello-intro](../../includes/hello-intro.md)] -- **Deployment type:** [!INCLUDE [hello-deployment-onpremises](../../includes/hello-deployment-onpremises.md)] -- **Trust type:** [!INCLUDE [tooltip-cert-trust](tooltip-cert-trust.md)] -- **Join type:** [!INCLUDE [hello-join-domain](../../includes/hello-join-domain.md)] +[!INCLUDE [intro](intro.md)] +- **Deployment type:** [!INCLUDE [tooltip-deployment-onpremises](tooltip-deployment-onpremises.md)] +- **Trust type:** [!INCLUDE [tooltip-cert-trust](tooltip-trust-cert.md)] +- **Join type:** [!INCLUDE [tooltip-join-domain](tooltip-join-domain.md)] --- \ No newline at end of file diff --git a/windows/security/identity-protection/hello-for-business/deploy/includes/apply-to-on-premises-key-trust.md b/windows/security/identity-protection/hello-for-business/deploy/includes/apply-to-on-premises-key-trust.md new file mode 100644 index 0000000000..1966807ca5 --- /dev/null +++ b/windows/security/identity-protection/hello-for-business/deploy/includes/apply-to-on-premises-key-trust.md @@ -0,0 +1,10 @@ +--- +ms.date: 12/08/2022 +ms.topic: include +--- + +[!INCLUDE [intro](intro.md)] +- **Deployment type:** [!INCLUDE [tooltip-deployment-onpremises](tooltip-deployment-onpremises.md)] +- **Trust type:** [!INCLUDE [tooltip-trust-key](tooltip-trust-key.md)] +- **Join type:** [!INCLUDE [tooltip-join-domain](tooltip-join-domain.md)] +--- \ No newline at end of file diff --git a/windows/security/identity-protection/hello-for-business/includes/auth-certificate-template.md b/windows/security/identity-protection/hello-for-business/deploy/includes/auth-certificate-template.md similarity index 100% rename from windows/security/identity-protection/hello-for-business/includes/auth-certificate-template.md rename to windows/security/identity-protection/hello-for-business/deploy/includes/auth-certificate-template.md diff --git a/windows/security/identity-protection/hello-for-business/includes/dc-certificate-deployment.md b/windows/security/identity-protection/hello-for-business/deploy/includes/dc-certificate-deployment.md similarity index 100% rename from windows/security/identity-protection/hello-for-business/includes/dc-certificate-deployment.md rename to windows/security/identity-protection/hello-for-business/deploy/includes/dc-certificate-deployment.md diff --git a/windows/security/identity-protection/hello-for-business/includes/dc-certificate-supersede.md b/windows/security/identity-protection/hello-for-business/deploy/includes/dc-certificate-supersede.md similarity index 100% rename from windows/security/identity-protection/hello-for-business/includes/dc-certificate-supersede.md rename to windows/security/identity-protection/hello-for-business/deploy/includes/dc-certificate-supersede.md diff --git a/windows/security/identity-protection/hello-for-business/includes/dc-certificate-template.md b/windows/security/identity-protection/hello-for-business/deploy/includes/dc-certificate-template.md similarity index 100% rename from windows/security/identity-protection/hello-for-business/includes/dc-certificate-template.md rename to windows/security/identity-protection/hello-for-business/deploy/includes/dc-certificate-template.md diff --git a/windows/security/identity-protection/hello-for-business/includes/dc-certificate-validate.md b/windows/security/identity-protection/hello-for-business/deploy/includes/dc-certificate-validate.md similarity index 100% rename from windows/security/identity-protection/hello-for-business/includes/dc-certificate-validate.md rename to windows/security/identity-protection/hello-for-business/deploy/includes/dc-certificate-validate.md diff --git a/windows/security/identity-protection/hello-for-business/includes/enrollment-agent-certificate-template.md b/windows/security/identity-protection/hello-for-business/deploy/includes/enrollment-agent-certificate-template.md similarity index 100% rename from windows/security/identity-protection/hello-for-business/includes/enrollment-agent-certificate-template.md rename to windows/security/identity-protection/hello-for-business/deploy/includes/enrollment-agent-certificate-template.md diff --git a/windows/security/identity-protection/hello-for-business/includes/hello-intro.md b/windows/security/identity-protection/hello-for-business/deploy/includes/intro.md similarity index 100% rename from windows/security/identity-protection/hello-for-business/includes/hello-intro.md rename to windows/security/identity-protection/hello-for-business/deploy/includes/intro.md diff --git a/windows/security/identity-protection/hello-for-business/includes/lab-based-pki-deploy.md b/windows/security/identity-protection/hello-for-business/deploy/includes/lab-based-pki-deploy.md similarity index 100% rename from windows/security/identity-protection/hello-for-business/includes/lab-based-pki-deploy.md rename to windows/security/identity-protection/hello-for-business/deploy/includes/lab-based-pki-deploy.md diff --git a/windows/security/identity-protection/hello-for-business/deploy/includes/tooltip-cert-trust.md b/windows/security/identity-protection/hello-for-business/deploy/includes/tooltip-cert-trust.md deleted file mode 100644 index 191890e588..0000000000 --- a/windows/security/identity-protection/hello-for-business/deploy/includes/tooltip-cert-trust.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -ms.date: 12/15/2023 -ms.topic: include ---- - -[certificate trust :::image type="icon" source="../../../../images/icons/information.svg" border="false":::](../../hello-how-it-works-technology.md#certificate-trust "This trust type uses a certificate to authenticate the users to Active Directory. It's required to issue certificates to the users and to the domain controllers") \ No newline at end of file diff --git a/windows/security/identity-protection/hello-for-business/deploy/includes/tooltip-deployment-cloud.md b/windows/security/identity-protection/hello-for-business/deploy/includes/tooltip-deployment-cloud.md new file mode 100644 index 0000000000..fa5e9a3489 --- /dev/null +++ b/windows/security/identity-protection/hello-for-business/deploy/includes/tooltip-deployment-cloud.md @@ -0,0 +1,6 @@ +--- +ms.date: 12/15/2023 +ms.topic: include +--- + +[cloud :::image type="icon" source="../images/information.svg" border="false":::](../../hello-how-it-works-technology.md#cloud-deployment "For organizations using Microsoft Entra-only identities. Device management is usually done via Intune/MDM") diff --git a/windows/security/identity-protection/hello-for-business/deploy/includes/tooltip-deployment-hybrid.md b/windows/security/identity-protection/hello-for-business/deploy/includes/tooltip-deployment-hybrid.md new file mode 100644 index 0000000000..d273002ddd --- /dev/null +++ b/windows/security/identity-protection/hello-for-business/deploy/includes/tooltip-deployment-hybrid.md @@ -0,0 +1,6 @@ +--- +ms.date: 12/15/2023 +ms.topic: include +--- + +[hybrid :::image type="icon" source="../images/information.svg" border="false":::](../../hello-how-it-works-technology.md#hybrid-deployment "For organizations using Active Directory identities synchronized to Microsoft Entra ID. Device management is usually done via Group Policy or Intune/MDM") diff --git a/windows/security/identity-protection/hello-for-business/deploy/includes/tooltip-deployment-onpremises.md b/windows/security/identity-protection/hello-for-business/deploy/includes/tooltip-deployment-onpremises.md new file mode 100644 index 0000000000..5594bf39dd --- /dev/null +++ b/windows/security/identity-protection/hello-for-business/deploy/includes/tooltip-deployment-onpremises.md @@ -0,0 +1,6 @@ +--- +ms.date: 12/15/2023 +ms.topic: include +--- + +[on-premises :::image type="icon" source="../images/information.svg" border="false":::](../../hello-how-it-works-technology.md#on-premises-deployment "For organizations using Active Directory identities, not synchronized to Microsoft Entra ID. Device management is usually done via Group Policy") diff --git a/windows/security/identity-protection/hello-for-business/deploy/includes/tooltip-join-domain.md b/windows/security/identity-protection/hello-for-business/deploy/includes/tooltip-join-domain.md new file mode 100644 index 0000000000..5e4dd851b9 --- /dev/null +++ b/windows/security/identity-protection/hello-for-business/deploy/includes/tooltip-join-domain.md @@ -0,0 +1,6 @@ +--- +ms.date: 12/15/2023 +ms.topic: include +--- + +[domain join :::image type="icon" source="../images/information.svg" border="false":::](../../hello-how-it-works-technology.md) diff --git a/windows/security/identity-protection/hello-for-business/deploy/includes/tooltip-join-entra.md b/windows/security/identity-protection/hello-for-business/deploy/includes/tooltip-join-entra.md new file mode 100644 index 0000000000..dbddf38006 --- /dev/null +++ b/windows/security/identity-protection/hello-for-business/deploy/includes/tooltip-join-entra.md @@ -0,0 +1,6 @@ +--- +ms.date: 12/15/2023 +ms.topic: include +--- + +[Microsoft Entra join :::image type="icon" source="../images/information.svg" border="false":::](../../hello-how-it-works-technology.md#azure-active-directory-join "Devices that are Microsoft Entra joined do not have any dependencies on Active Directory. Only local users accounts and Microsoft Entra users can sign in to these devices") diff --git a/windows/security/identity-protection/hello-for-business/deploy/includes/tooltip-join-hybrid.md b/windows/security/identity-protection/hello-for-business/deploy/includes/tooltip-join-hybrid.md new file mode 100644 index 0000000000..206857ace8 --- /dev/null +++ b/windows/security/identity-protection/hello-for-business/deploy/includes/tooltip-join-hybrid.md @@ -0,0 +1,6 @@ +--- +ms.date: 12/15/2023 +ms.topic: include +--- + +[Microsoft Entra hybrid join :::image type="icon" source="../images/information.svg" border="false":::](../../hello-how-it-works-technology.md#hybrid-azure-ad-join "Devices that are Microsoft Entra hybrid joined don't have any dependencies on Microsoft Entra ID. Only local users accounts and Active Directory users can sign in to these devices. Active Directory users that are synchronized to Microsoft Entra ID will have single-sign on to both Active Directory and Microsoft Entra protected resources") diff --git a/windows/security/identity-protection/hello-for-business/deploy/includes/tooltip-trust-cert.md b/windows/security/identity-protection/hello-for-business/deploy/includes/tooltip-trust-cert.md new file mode 100644 index 0000000000..8719e2a1cc --- /dev/null +++ b/windows/security/identity-protection/hello-for-business/deploy/includes/tooltip-trust-cert.md @@ -0,0 +1,6 @@ +--- +ms.date: 12/15/2023 +ms.topic: include +--- + +[certificate trust :::image type="icon" source="../images/information.svg" border="false":::](../../hello-how-it-works-technology.md#certificate-trust "This trust type uses a certificate to authenticate the users to Active Directory. It's required to issue certificates to the users and to the domain controllers") \ No newline at end of file diff --git a/windows/security/identity-protection/hello-for-business/deploy/includes/tooltip-trust-cloud-kerberos.md b/windows/security/identity-protection/hello-for-business/deploy/includes/tooltip-trust-cloud-kerberos.md new file mode 100644 index 0000000000..57fd74f5c3 --- /dev/null +++ b/windows/security/identity-protection/hello-for-business/deploy/includes/tooltip-trust-cloud-kerberos.md @@ -0,0 +1,6 @@ +--- +ms.date: 12/08/2022 +ms.topic: include +--- + +[cloud Kerberos trust :::image type="icon" source="../images/information.svg" border="false":::](../../hello-how-it-works-technology.md#cloud-kerberos-trust "This trust type uses security keys to authenticate the users to Active Directory. It's not required to issue any certificates, making it the recommended choice for environments that don't need certificate authentication") \ No newline at end of file diff --git a/windows/security/identity-protection/hello-for-business/deploy/includes/tooltip-trust-key.md b/windows/security/identity-protection/hello-for-business/deploy/includes/tooltip-trust-key.md new file mode 100644 index 0000000000..3bbbe2214f --- /dev/null +++ b/windows/security/identity-protection/hello-for-business/deploy/includes/tooltip-trust-key.md @@ -0,0 +1,6 @@ +--- +ms.date: 12/08/2022 +ms.topic: include +--- + +[key trust :::image type="icon" source="../images/information.svg" border="false":::](../../hello-how-it-works-technology.md#key-trust "This trust type uses a raw key to authenticate the users to Active Directory. It's not required to issue certificates to users, but it's required to deploy certificates to domain controllers") \ No newline at end of file diff --git a/windows/security/identity-protection/hello-for-business/includes/unpublish-superseded-templates.md b/windows/security/identity-protection/hello-for-business/deploy/includes/unpublish-superseded-templates.md similarity index 100% rename from windows/security/identity-protection/hello-for-business/includes/unpublish-superseded-templates.md rename to windows/security/identity-protection/hello-for-business/deploy/includes/unpublish-superseded-templates.md diff --git a/windows/security/identity-protection/hello-for-business/includes/web-server-certificate-template.md b/windows/security/identity-protection/hello-for-business/deploy/includes/web-server-certificate-template.md similarity index 79% rename from windows/security/identity-protection/hello-for-business/includes/web-server-certificate-template.md rename to windows/security/identity-protection/hello-for-business/deploy/includes/web-server-certificate-template.md index 8ba241a5c8..1bde4860fe 100644 --- a/windows/security/identity-protection/hello-for-business/includes/web-server-certificate-template.md +++ b/windows/security/identity-protection/hello-for-business/deploy/includes/web-server-certificate-template.md @@ -15,13 +15,13 @@ Sign in to a CA or management workstations with *Domain Administrator* equivalen 1. Use the following table to configure the template: | Tab Name | Configurations | - | --- | --- | - | *Compatibility* | | - | *General* | | + |--|--| + | *Compatibility* | | + | *General* | | | *Request Handling* | Select **Allow private key to be exported** | - | *Subject Name* | Select **Supply in the request**| - |*Security*|Add **Domain Computers** with **Enroll** access| - |*Cryptography*|