From 5c201c955e83cba073dc554fdbeaf3a98a488e27 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Fri, 15 Dec 2023 15:56:54 -0500 Subject: [PATCH 01/13] Restructure of deployment guides --- .../cloud.md} | 4 +-- .../deploy/hybrid-cert-trust-pki.md | 16 ++++----- .../deploy/hybrid-cert-trust.md | 2 +- .../hybrid-cloud-kerberos-trust-enroll.md} | 2 +- .../hybrid-cloud-kerberos-trust.md} | 4 +-- .../hybrid-key-trust-enroll.md} | 2 +- .../hybrid-key-trust-pki.md} | 4 +-- .../hybrid-key-trust.md} | 6 ++-- .../deploy/includes/apply-to-cloud.md | 9 +++++ .../apply-to-hybrid-cert-trust-entra.md | 6 ++-- .../includes/apply-to-hybrid-cert-trust.md | 8 ++--- .../apply-to-hybrid-cloud-kerberos-trust.md | 10 ++++++ .../apply-to-hybrid-key-and-cert-trust.md | 10 ++++++ .../includes/apply-to-hybrid-key-trust.md | 10 ++++++ .../apply-to-on-premises-cert-trust-entra.md | 6 ++-- .../apply-to-on-premises-key-trust.md | 10 ++++++ .../includes/auth-certificate-template.md | 0 .../includes/dc-certificate-deployment.md | 0 .../includes/dc-certificate-supersede.md | 0 .../includes/dc-certificate-template.md | 0 .../includes/dc-certificate-validate.md | 0 .../enrollment-agent-certificate-template.md | 0 .../deploy/includes/information.svg | 3 ++ .../includes/intro.md} | 0 .../includes/lab-based-pki-deploy.md | 0 .../includes/tooltip-deployment-cloud.md | 6 ++++ .../includes/tooltip-deployment-hybrid.md | 6 ++++ .../includes/tooltip-deployment-onpremises.md | 6 ++++ .../deploy/includes/tooltip-join-domain.md | 6 ++++ .../deploy/includes/tooltip-join-entra.md | 6 ++++ .../deploy/includes/tooltip-join-hybrid.md | 6 ++++ ...ip-cert-trust.md => tooltip-trust-cert.md} | 0 .../includes/tooltip-trust-cloud-kerberos.md | 6 ++++ .../deploy/includes/tooltip-trust-key.md | 6 ++++ .../unpublish-superseded-templates.md | 0 .../web-server-certificate-template.md | 12 +++---- .../index.md} | 16 ++++----- .../deploy/on-premises-cert-trust-pki.md | 18 +++++----- .../on-premises-key-trust-adfs.md} | 4 +-- .../on-premises-key-trust-enroll.md} | 2 +- .../on-premises-key-trust-mfa.md} | 4 +-- .../on-premises-key-trust-pki.md} | 4 +-- .../deploy/on-premises-key-trust.md | 35 +++++++++++++++++++ .../requirements.md} | 0 .../hello-for-business/deploy/toc.yml | 28 +++++++-------- .../hello-deployment-key-trust.md | 17 --------- .../hello-how-it-works-technology.md | 2 +- .../hello-hybrid-aadj-sso.md | 2 +- .../hello-key-trust-validate-ad-prereq.md | 35 ------------------- .../hello-planning-guide.md | 2 +- .../includes/hello-cloud.md | 9 ----- .../includes/hello-deployment-cloud.md | 6 ---- .../includes/hello-deployment-hybrid.md | 6 ---- .../includes/hello-deployment-onpremises.md | 6 ---- .../includes/hello-hybrid-cloudkerb-trust.md | 10 ------ .../includes/hello-hybrid-key-trust.md | 10 ------ .../hello-hybrid-keycert-trust-aad.md | 10 ------ .../includes/hello-join-aad.md | 6 ---- .../includes/hello-join-domain.md | 6 ---- .../includes/hello-join-hybrid.md | 6 ---- .../includes/hello-on-premises-key-trust.md | 10 ------ .../includes/hello-trust-cloud-kerberos.md | 6 ---- .../includes/hello-trust-key.md | 6 ---- .../hello-for-business/toc.yml | 2 ++ 64 files changed, 213 insertions(+), 227 deletions(-) rename windows/security/identity-protection/hello-for-business/{hello-aad-join-cloud-only-deploy.md => deploy/cloud.md} (97%) rename windows/security/identity-protection/hello-for-business/{hello-hybrid-cloud-kerberos-trust-provision.md => deploy/hybrid-cloud-kerberos-trust-enroll.md} (99%) rename windows/security/identity-protection/hello-for-business/{hello-hybrid-cloud-kerberos-trust.md => deploy/hybrid-cloud-kerberos-trust.md} (98%) rename windows/security/identity-protection/hello-for-business/{hello-hybrid-key-trust-provision.md => deploy/hybrid-key-trust-enroll.md} (99%) rename windows/security/identity-protection/hello-for-business/{hello-hybrid-key-trust-validate-pki.md => deploy/hybrid-key-trust-pki.md} (98%) rename windows/security/identity-protection/hello-for-business/{hello-hybrid-key-trust.md => deploy/hybrid-key-trust.md} (96%) create mode 100644 windows/security/identity-protection/hello-for-business/deploy/includes/apply-to-cloud.md create mode 100644 windows/security/identity-protection/hello-for-business/deploy/includes/apply-to-hybrid-cloud-kerberos-trust.md create mode 100644 windows/security/identity-protection/hello-for-business/deploy/includes/apply-to-hybrid-key-and-cert-trust.md create mode 100644 windows/security/identity-protection/hello-for-business/deploy/includes/apply-to-hybrid-key-trust.md create mode 100644 windows/security/identity-protection/hello-for-business/deploy/includes/apply-to-on-premises-key-trust.md rename windows/security/identity-protection/hello-for-business/{ => deploy}/includes/auth-certificate-template.md (100%) rename windows/security/identity-protection/hello-for-business/{ => deploy}/includes/dc-certificate-deployment.md (100%) rename windows/security/identity-protection/hello-for-business/{ => deploy}/includes/dc-certificate-supersede.md (100%) rename windows/security/identity-protection/hello-for-business/{ => deploy}/includes/dc-certificate-template.md (100%) rename windows/security/identity-protection/hello-for-business/{ => deploy}/includes/dc-certificate-validate.md (100%) rename windows/security/identity-protection/hello-for-business/{ => deploy}/includes/enrollment-agent-certificate-template.md (100%) create mode 100644 windows/security/identity-protection/hello-for-business/deploy/includes/information.svg rename windows/security/identity-protection/hello-for-business/{includes/hello-intro.md => deploy/includes/intro.md} (100%) rename windows/security/identity-protection/hello-for-business/{ => deploy}/includes/lab-based-pki-deploy.md (100%) create mode 100644 windows/security/identity-protection/hello-for-business/deploy/includes/tooltip-deployment-cloud.md create mode 100644 windows/security/identity-protection/hello-for-business/deploy/includes/tooltip-deployment-hybrid.md create mode 100644 windows/security/identity-protection/hello-for-business/deploy/includes/tooltip-deployment-onpremises.md create mode 100644 windows/security/identity-protection/hello-for-business/deploy/includes/tooltip-join-domain.md create mode 100644 windows/security/identity-protection/hello-for-business/deploy/includes/tooltip-join-entra.md create mode 100644 windows/security/identity-protection/hello-for-business/deploy/includes/tooltip-join-hybrid.md rename windows/security/identity-protection/hello-for-business/deploy/includes/{tooltip-cert-trust.md => tooltip-trust-cert.md} (100%) create mode 100644 windows/security/identity-protection/hello-for-business/deploy/includes/tooltip-trust-cloud-kerberos.md create mode 100644 windows/security/identity-protection/hello-for-business/deploy/includes/tooltip-trust-key.md rename windows/security/identity-protection/hello-for-business/{ => deploy}/includes/unpublish-superseded-templates.md (100%) rename windows/security/identity-protection/hello-for-business/{ => deploy}/includes/web-server-certificate-template.md (79%) rename windows/security/identity-protection/hello-for-business/{hello-deployment-guide.md => deploy/index.md} (89%) rename windows/security/identity-protection/hello-for-business/{hello-key-trust-adfs.md => deploy/on-premises-key-trust-adfs.md} (99%) rename windows/security/identity-protection/hello-for-business/{hello-key-trust-policy-settings.md => deploy/on-premises-key-trust-enroll.md} (99%) rename windows/security/identity-protection/hello-for-business/{hello-key-trust-validate-deploy-mfa.md => deploy/on-premises-key-trust-mfa.md} (93%) rename windows/security/identity-protection/hello-for-business/{hello-key-trust-validate-pki.md => deploy/on-premises-key-trust-pki.md} (95%) create mode 100644 windows/security/identity-protection/hello-for-business/deploy/on-premises-key-trust.md rename windows/security/identity-protection/hello-for-business/{hello-identity-verification.md => deploy/requirements.md} (100%) delete mode 100644 windows/security/identity-protection/hello-for-business/hello-deployment-key-trust.md delete mode 100644 windows/security/identity-protection/hello-for-business/hello-key-trust-validate-ad-prereq.md delete mode 100644 windows/security/identity-protection/hello-for-business/includes/hello-cloud.md delete mode 100644 windows/security/identity-protection/hello-for-business/includes/hello-deployment-cloud.md delete mode 100644 windows/security/identity-protection/hello-for-business/includes/hello-deployment-hybrid.md delete mode 100644 windows/security/identity-protection/hello-for-business/includes/hello-deployment-onpremises.md delete mode 100644 windows/security/identity-protection/hello-for-business/includes/hello-hybrid-cloudkerb-trust.md delete mode 100644 windows/security/identity-protection/hello-for-business/includes/hello-hybrid-key-trust.md delete mode 100644 windows/security/identity-protection/hello-for-business/includes/hello-hybrid-keycert-trust-aad.md delete mode 100644 windows/security/identity-protection/hello-for-business/includes/hello-join-aad.md delete mode 100644 windows/security/identity-protection/hello-for-business/includes/hello-join-domain.md delete mode 100644 windows/security/identity-protection/hello-for-business/includes/hello-join-hybrid.md delete mode 100644 windows/security/identity-protection/hello-for-business/includes/hello-on-premises-key-trust.md delete mode 100644 windows/security/identity-protection/hello-for-business/includes/hello-trust-cloud-kerberos.md delete mode 100644 windows/security/identity-protection/hello-for-business/includes/hello-trust-key.md diff --git a/windows/security/identity-protection/hello-for-business/hello-aad-join-cloud-only-deploy.md b/windows/security/identity-protection/hello-for-business/deploy/cloud.md similarity index 97% rename from windows/security/identity-protection/hello-for-business/hello-aad-join-cloud-only-deploy.md rename to windows/security/identity-protection/hello-for-business/deploy/cloud.md index 58eac4892c..d2695cb7eb 100644 --- a/windows/security/identity-protection/hello-for-business/hello-aad-join-cloud-only-deploy.md +++ b/windows/security/identity-protection/hello-for-business/deploy/cloud.md @@ -6,7 +6,7 @@ ms.topic: how-to --- # Cloud-only deployment -[!INCLUDE [hello-hybrid-key-trust](./includes/hello-cloud.md)] +[!INCLUDE [apply-to-cloud](includes/apply-to-cloud.md)] ## Introduction @@ -21,7 +21,7 @@ You may wish to disable the automatic Windows Hello for Business enrollment prom Cloud only deployments will use Microsoft Entra multifactor authentication (MFA) during Windows Hello for Business enrollment, and there's no additional MFA configuration needed. If you aren't already registered in MFA, you'll be guided through the MFA registration as part of the Windows Hello for Business enrollment process. -The necessary Windows Hello for Business prerequisites are located at [Cloud Only Deployment](hello-identity-verification.md#azure-ad-cloud-only-deployment). +The necessary Windows Hello for Business prerequisites are located at [Cloud Only Deployment](requirements.md#azure-ad-cloud-only-deployment). It's possible for federated domains to configure the *FederatedIdpMfaBehavior* flag. The flag instructs Microsoft Entra ID to accept, enforce, or reject the MFA challenge from the federated IdP. For more information, see [federatedIdpMfaBehavior values](/graph/api/resources/internaldomainfederation#federatedidpmfabehavior-values). To check this setting, use the following PowerShell command: diff --git a/windows/security/identity-protection/hello-for-business/deploy/hybrid-cert-trust-pki.md b/windows/security/identity-protection/hello-for-business/deploy/hybrid-cert-trust-pki.md index 38b871bba1..b20e3a55c4 100644 --- a/windows/security/identity-protection/hello-for-business/deploy/hybrid-cert-trust-pki.md +++ b/windows/security/identity-protection/hello-for-business/deploy/hybrid-cert-trust-pki.md @@ -18,11 +18,11 @@ Windows Hello for Business must have a Public Key Infrastructure (PKI) when usin Hybrid certificate trust deployments issue users a sign-in certificate, enabling them to authenticate to Active Directory using Windows Hello for Business credentials. Additionally, hybrid certificate trust deployments issue certificates to registration authorities to provide defense-in-depth security when issuing user authentication certificates. -[!INCLUDE [lab-based-pki-deploy](../includes/lab-based-pki-deploy.md)] +[!INCLUDE [lab-based-pki-deploy](includes/lab-based-pki-deploy.md)] ## Configure the enterprise PKI -[!INCLUDE [dc-certificate-template](../includes/dc-certificate-template.md)] +[!INCLUDE [dc-certificate-template](includes/dc-certificate-template.md)] > [!NOTE] > Inclusion of the *KDC Authentication* OID in domain controller certificate is not required for Microsoft Entra hybrid joined devices. The OID is required for enabling authentication with Windows Hello for Business to on-premises resources by Microsoft Entra joined devices. @@ -33,13 +33,13 @@ Hybrid certificate trust deployments issue users a sign-in certificate, enabling > - Install the root CA certificate in the device's trusted root certificate store. See [how to deploy a trusted certificate profile](/mem/intune/protect/certificates-trusted-root#to-create-a-trusted-certificate-profile) via Intune > - Publish your certificate revocation list to a location that is available to Microsoft Entra joined devices, such as a web-based URL -[!INCLUDE [dc-certificate-template-supersede](../includes/dc-certificate-supersede.md)] +[!INCLUDE [dc-certificate-template-supersede](includes/dc-certificate-supersede.md)] -[!INCLUDE [enrollment-agent-certificate-template](../includes/enrollment-agent-certificate-template.md)] +[!INCLUDE [enrollment-agent-certificate-template](includes/enrollment-agent-certificate-template.md)] -[!INCLUDE [auth-certificate-template](../includes/auth-certificate-template.md)] +[!INCLUDE [auth-certificate-template](includes/auth-certificate-template.md)] -[!INCLUDE [unpublish-superseded-templates](../includes/unpublish-superseded-templates.md)] +[!INCLUDE [unpublish-superseded-templates](includes/unpublish-superseded-templates.md)] ### Publish the certificate templates to the CA @@ -59,11 +59,11 @@ Sign in to the CA or management workstations with **Enterprise Admin** equivalen ## Configure and deploy certificates to domain controllers -[!INCLUDE [dc-certificate-deployment](../includes/dc-certificate-deployment.md)] +[!INCLUDE [dc-certificate-deployment](includes/dc-certificate-deployment.md)] ## Validate the configuration -[!INCLUDE [dc-certificate-validate](../includes/dc-certificate-validate.md)] +[!INCLUDE [dc-certificate-validate](includes/dc-certificate-validate.md)] ## Section review and next steps diff --git a/windows/security/identity-protection/hello-for-business/deploy/hybrid-cert-trust.md b/windows/security/identity-protection/hello-for-business/deploy/hybrid-cert-trust.md index 44cb5bf3a4..1e1abbb130 100644 --- a/windows/security/identity-protection/hello-for-business/deploy/hybrid-cert-trust.md +++ b/windows/security/identity-protection/hello-for-business/deploy/hybrid-cert-trust.md @@ -20,7 +20,7 @@ Hybrid environments are distributed systems that enable organizations to use on- This deployment guide describes how to deploy Windows Hello for Business in a hybrid certificate trust scenario. > [!IMPORTANT] -> Windows Hello for Business *cloud Kerberos trust* is the recommended deployment model when compared to the *key trust model*. It is also the recommended deployment model if you don't need to deploy certificates to the end users. For more information, see [cloud Kerberos trust deployment](../hello-hybrid-cloud-kerberos-trust.md). +> Windows Hello for Business *cloud Kerberos trust* is the recommended deployment model when compared to the *key trust model*. It is also the recommended deployment model if you don't need to deploy certificates to the end users. For more information, see [cloud Kerberos trust deployment](../hybrid-clud-kerberos-trust.md). It's recommended that you review the [Windows Hello for Business planning guide](../hello-planning-guide.md) prior to using the deployment guide. The planning guide helps you make decisions by explaining the available options with each aspect of the deployment and explains the potential outcomes based on each of these decisions. diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cloud-kerberos-trust-provision.md b/windows/security/identity-protection/hello-for-business/deploy/hybrid-cloud-kerberos-trust-enroll.md similarity index 99% rename from windows/security/identity-protection/hello-for-business/hello-hybrid-cloud-kerberos-trust-provision.md rename to windows/security/identity-protection/hello-for-business/deploy/hybrid-cloud-kerberos-trust-enroll.md index 7b4394d51f..918d86d832 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cloud-kerberos-trust-provision.md +++ b/windows/security/identity-protection/hello-for-business/deploy/hybrid-cloud-kerberos-trust-enroll.md @@ -8,7 +8,7 @@ ms.topic: tutorial --- # Configure and provision Windows Hello for Business - cloud Kerberos trust -[!INCLUDE [hello-hybrid-key-trust](./includes/hello-hybrid-cloudkerb-trust.md)] +[!INCLUDE [hello-hybrid-key-trust](includes/hello-hybrid-cloudkerb-trust.md)] ## Deployment steps diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cloud-kerberos-trust.md b/windows/security/identity-protection/hello-for-business/deploy/hybrid-cloud-kerberos-trust.md similarity index 98% rename from windows/security/identity-protection/hello-for-business/hello-hybrid-cloud-kerberos-trust.md rename to windows/security/identity-protection/hello-for-business/deploy/hybrid-cloud-kerberos-trust.md index 464e918a1e..fb61f15acf 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cloud-kerberos-trust.md +++ b/windows/security/identity-protection/hello-for-business/deploy/hybrid-cloud-kerberos-trust.md @@ -8,7 +8,7 @@ ms.topic: tutorial --- # Cloud Kerberos trust deployment -[!INCLUDE [hello-hybrid-key-trust](./includes/hello-hybrid-cloudkerb-trust.md)] +[!INCLUDE [apply-to-hybrid-cloud-kerberos-trust](includes/apply-to-hybrid-cloud-kerberos-trust.md)] Windows Hello for Business replaces password sign-in with strong authentication, using an asymmetric key pair. This deployment guide provides the information to deploy Windows Hello for Business in a *cloud Kerberos trust* scenario. @@ -84,7 +84,7 @@ Once the prerequisites are met, deploying Windows Hello for Business with a clou > * Provision Windows Hello for Business on Windows clients > [!div class="nextstepaction"] -> [Next: configure and provision Windows Hello for Business >](hello-hybrid-cloud-kerberos-trust-provision.md) +> [Next: configure and provision Windows Hello for Business >](hybrid-clud-kerberos-trust-enroll.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-provision.md b/windows/security/identity-protection/hello-for-business/deploy/hybrid-key-trust-enroll.md similarity index 99% rename from windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-provision.md rename to windows/security/identity-protection/hello-for-business/deploy/hybrid-key-trust-enroll.md index dc8d3d3a24..c36e2167e1 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-provision.md +++ b/windows/security/identity-protection/hello-for-business/deploy/hybrid-key-trust-enroll.md @@ -7,7 +7,7 @@ ms.topic: tutorial # Configure and enroll in Windows Hello for Business - hybrid key trust -[!INCLUDE [hello-hybrid-key-trust](./includes/hello-hybrid-key-trust.md)] +[!INCLUDE [apply-to-hybrid-key-trust](includes/apply-to-hybrid-key-trust.md)] After the prerequisites are met and the PKI configuration is validated, Windows Hello for business must be enabled on the Windows devices. Follow the instructions below to configure your devices using either Microsoft Intune or group policy (GPO). diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-validate-pki.md b/windows/security/identity-protection/hello-for-business/deploy/hybrid-key-trust-pki.md similarity index 98% rename from windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-validate-pki.md rename to windows/security/identity-protection/hello-for-business/deploy/hybrid-key-trust-pki.md index f39545b8e8..299039ae2e 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-validate-pki.md +++ b/windows/security/identity-protection/hello-for-business/deploy/hybrid-key-trust-pki.md @@ -12,7 +12,7 @@ ms.topic: tutorial --- # Configure and validate the Public Key Infrastructure - hybrid key trust -[!INCLUDE [hello-hybrid-key-trust](./includes/hello-hybrid-key-trust.md)] +[!INCLUDE [apply-to-hybrid-key-trust](includes/apply-to-hybrid-key-trust.md)] Windows Hello for Business must have a Public Key Infrastructure (PKI) when using the *key trust* model. The domain controllers must have a certificate, which serves as a *root of trust* for clients. The certificate ensures that clients don't communicate with rogue domain controllers. @@ -97,7 +97,7 @@ Before moving to the next section, ensure the following steps are complete: > - Validate the domain controllers configuration > [!div class="nextstepaction"] -> [Next: configure and provision Windows Hello for Business >](hello-hybrid-key-trust-provision.md) +> [Next: configure and provision Windows Hello for Business >](hybrid-key-trust-enroll.md) [SERV-1]: /troubleshoot/windows-server/windows-security/requirements-domain-controller diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust.md b/windows/security/identity-protection/hello-for-business/deploy/hybrid-key-trust.md similarity index 96% rename from windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust.md rename to windows/security/identity-protection/hello-for-business/deploy/hybrid-key-trust.md index a0a36f2cc0..ac811a8a9d 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust.md +++ b/windows/security/identity-protection/hello-for-business/deploy/hybrid-key-trust.md @@ -12,14 +12,14 @@ ms.topic: how-to --- # Hybrid key trust deployment -[!INCLUDE [hello-hybrid-key-trust](./includes/hello-hybrid-key-trust.md)] +[!INCLUDE [apply-to-hybrid-key-trust](includes/apply-to-hybrid-key-trust.md)] Hybrid environments are distributed systems that enable organizations to use on-premises and Microsoft Entra protected resources. Windows Hello for Business uses the existing distributed system as a foundation on which organizations can provide two-factor authentication and single sign-on to modern resources. This deployment guide describes how to deploy Windows Hello for Business in a hybrid key trust scenario. > [!IMPORTANT] -> Windows Hello for Business *cloud Kerberos trust* is the recommended deployment model when compared to the *key trust model*. For more information, see [cloud Kerberos trust deployment](hello-hybrid-cloud-kerberos-trust.md). +> Windows Hello for Business *cloud Kerberos trust* is the recommended deployment model when compared to the *key trust model*. For more information, see [cloud Kerberos trust deployment](hybrid-clud-kerberos-trust.md). It is recommended that you review the [Windows Hello for Business planning guide](hello-planning-guide.md) prior to using the deployment guide. The planning guide helps you make decisions by explaining the available options with each aspect of the deployment and explains the potential outcomes based on each of these decisions. @@ -94,7 +94,7 @@ Once the prerequisites are met, deploying Windows Hello for Business with a hybr > * Configure single sign-on (SSO) for Microsoft Entra joined devices > [!div class="nextstepaction"] -> [Next: configure and validate the Public Key Infrastructure >](hello-hybrid-key-trust-validate-pki.md) +> [Next: configure and validate the Public Key Infrastructure >](hybrid-key-trust-pki.md) [AZ-1]: /azure/active-directory/hybrid/how-to-connect-sync-whatis diff --git a/windows/security/identity-protection/hello-for-business/deploy/includes/apply-to-cloud.md b/windows/security/identity-protection/hello-for-business/deploy/includes/apply-to-cloud.md new file mode 100644 index 0000000000..69c159b0a2 --- /dev/null +++ b/windows/security/identity-protection/hello-for-business/deploy/includes/apply-to-cloud.md @@ -0,0 +1,9 @@ +--- +ms.date: 12/15/2023 +ms.topic: include +--- + +[!INCLUDE [intro](intro.md)] +- **Deployment type:** [!INCLUDE [tooltip-deployment-cloud](tooltip-deployment-cloud.md)] +- **Join type:** [!INCLUDE [tootip-join-entra](tooltip-join-entra.md)] +--- \ No newline at end of file diff --git a/windows/security/identity-protection/hello-for-business/deploy/includes/apply-to-hybrid-cert-trust-entra.md b/windows/security/identity-protection/hello-for-business/deploy/includes/apply-to-hybrid-cert-trust-entra.md index 97bfdbe297..ce40bf460b 100644 --- a/windows/security/identity-protection/hello-for-business/deploy/includes/apply-to-hybrid-cert-trust-entra.md +++ b/windows/security/identity-protection/hello-for-business/deploy/includes/apply-to-hybrid-cert-trust-entra.md @@ -3,8 +3,8 @@ ms.date: 12/15/2023 ms.topic: include --- -[!INCLUDE [hello-intro](../../includes/hello-intro.md)] -- **Deployment type:** [!INCLUDE [hello-deployment-hybrid](../../includes/hello-deployment-hybrid.md)] +[!INCLUDE [intro](intro.md)] +- **Deployment type:** [!INCLUDE [tooltip-deployment-hybrid](tooltip-deployment-hybrid.md)] - **Trust type:** [!INCLUDE [tooltip-cert-trust](tooltip-cert-trust.md)] -- **Join type:** [!INCLUDE [hello-join-aadj](../../includes/hello-join-aad.md)] +- **Join type:** [!INCLUDE [tooltip-join-entra](tooltip-join-entra.md)] --- \ No newline at end of file diff --git a/windows/security/identity-protection/hello-for-business/deploy/includes/apply-to-hybrid-cert-trust.md b/windows/security/identity-protection/hello-for-business/deploy/includes/apply-to-hybrid-cert-trust.md index 0b5a246fbe..4f8eb7e613 100644 --- a/windows/security/identity-protection/hello-for-business/deploy/includes/apply-to-hybrid-cert-trust.md +++ b/windows/security/identity-protection/hello-for-business/deploy/includes/apply-to-hybrid-cert-trust.md @@ -3,8 +3,8 @@ ms.date: 12/15/2023 ms.topic: include --- -[!INCLUDE [hello-intro](../../includes/hello-intro.md)] -- **Deployment type:** [!INCLUDE [hello-deployment-hybrid](../../includes/hello-deployment-hybrid.md)] -- **Trust type:** [!INCLUDE [tooltip-cert-trust](tooltip-cert-trust.md)] -- **Join type:** [!INCLUDE [hello-join-aadj](../../includes/hello-join-aad.md)], [!INCLUDE [hello-join-hybrid](../../includes/hello-join-hybrid.md)] +[!INCLUDE [intro](intro.md)] +- **Deployment type:** [!INCLUDE [tooltip-deployment-hybrid](tooltip-deployment-hybrid.md)] +- **Trust type:** [!INCLUDE [tooltip-cert-trust](tooltip-trust-cert.md)] +- **Join type:** [!INCLUDE [tooltip-join-entra](tooltip-join-entra.md)], [!INCLUDE [tooltip-join-hybrid](tooltip-join-hybrid.md)] --- \ No newline at end of file diff --git a/windows/security/identity-protection/hello-for-business/deploy/includes/apply-to-hybrid-cloud-kerberos-trust.md b/windows/security/identity-protection/hello-for-business/deploy/includes/apply-to-hybrid-cloud-kerberos-trust.md new file mode 100644 index 0000000000..9fd4c16a63 --- /dev/null +++ b/windows/security/identity-protection/hello-for-business/deploy/includes/apply-to-hybrid-cloud-kerberos-trust.md @@ -0,0 +1,10 @@ +--- +ms.date: 12/15/2023 +ms.topic: include +--- + +[!INCLUDE [intro](intro.md)] +- **Deployment type:** [!INCLUDE [tooltip-deployment-hybrid](tooltip-deployment-hybrid.md)] +- **Trust type:** [!INCLUDE [tooltip-trust-cloud-kerberos](tooltip-trust-cloud-kerberos.md)] +- **Join type:** [!INCLUDE [tooltip-join-entra](tooltip-join-entra.md)], [!INCLUDE [tooltip-join-hybrid](tooltip-join-hybrid.md)] +--- \ No newline at end of file diff --git a/windows/security/identity-protection/hello-for-business/deploy/includes/apply-to-hybrid-key-and-cert-trust.md b/windows/security/identity-protection/hello-for-business/deploy/includes/apply-to-hybrid-key-and-cert-trust.md new file mode 100644 index 0000000000..7b367e4025 --- /dev/null +++ b/windows/security/identity-protection/hello-for-business/deploy/includes/apply-to-hybrid-key-and-cert-trust.md @@ -0,0 +1,10 @@ +--- +ms.date: 12/15/2023 +ms.topic: include +--- + +[!INCLUDE [intro](intro.md)] +- **Deployment type:** [!INCLUDE [tooltip-deployment-hybrid](tooltip-deployment-hybrid.md)] +- **Trust type:** [!INCLUDE [tooltip-trust-key](tooltip-trust-key.md)],[!INCLUDE [tooltip-cert-trust](../deploy/includes/tooltip-cert-trust.md)] +- **Join type:** [!INCLUDE [tooltip-join-entra](tooltip-join-entra.md)] +--- \ No newline at end of file diff --git a/windows/security/identity-protection/hello-for-business/deploy/includes/apply-to-hybrid-key-trust.md b/windows/security/identity-protection/hello-for-business/deploy/includes/apply-to-hybrid-key-trust.md new file mode 100644 index 0000000000..a74e9ead78 --- /dev/null +++ b/windows/security/identity-protection/hello-for-business/deploy/includes/apply-to-hybrid-key-trust.md @@ -0,0 +1,10 @@ +--- +ms.date: 12/15/2023 +ms.topic: include +--- + +[!INCLUDE [intro](intro.md)] +- **Deployment type:** [!INCLUDE [tooltip-deployment-hybrid](tooltip-deployment-hybrid.md)] +- **Trust type:** [!INCLUDE [tooltip-trust-key](tooltip-trust-key.md)] +- **Join type:** [!INCLUDE [tooltip-join-entra](tooltip-join-entra.md)], [!INCLUDE [tooltip-join-hybrid](tooltip-join-hybrid.md)] +--- \ No newline at end of file diff --git a/windows/security/identity-protection/hello-for-business/deploy/includes/apply-to-on-premises-cert-trust-entra.md b/windows/security/identity-protection/hello-for-business/deploy/includes/apply-to-on-premises-cert-trust-entra.md index 5f64fba40f..d7a1ab9c2f 100644 --- a/windows/security/identity-protection/hello-for-business/deploy/includes/apply-to-on-premises-cert-trust-entra.md +++ b/windows/security/identity-protection/hello-for-business/deploy/includes/apply-to-on-premises-cert-trust-entra.md @@ -3,8 +3,8 @@ ms.date: 12/15/2023 ms.topic: include --- -[!INCLUDE [hello-intro](../../includes/hello-intro.md)] -- **Deployment type:** [!INCLUDE [hello-deployment-onpremises](../../includes/hello-deployment-onpremises.md)] +[!INCLUDE [intro](intro.md)] +- **Deployment type:** [!INCLUDE [tooltip-deployment-onpremises](tooltip-deployment-onpremises.md)] - **Trust type:** [!INCLUDE [tooltip-cert-trust](tooltip-cert-trust.md)] -- **Join type:** [!INCLUDE [hello-join-domain](../../includes/hello-join-domain.md)] +- **Join type:** [!INCLUDE [tooltip-join-domain](tooltip-join-domain.md)] --- \ No newline at end of file diff --git a/windows/security/identity-protection/hello-for-business/deploy/includes/apply-to-on-premises-key-trust.md b/windows/security/identity-protection/hello-for-business/deploy/includes/apply-to-on-premises-key-trust.md new file mode 100644 index 0000000000..1966807ca5 --- /dev/null +++ b/windows/security/identity-protection/hello-for-business/deploy/includes/apply-to-on-premises-key-trust.md @@ -0,0 +1,10 @@ +--- +ms.date: 12/08/2022 +ms.topic: include +--- + +[!INCLUDE [intro](intro.md)] +- **Deployment type:** [!INCLUDE [tooltip-deployment-onpremises](tooltip-deployment-onpremises.md)] +- **Trust type:** [!INCLUDE [tooltip-trust-key](tooltip-trust-key.md)] +- **Join type:** [!INCLUDE [tooltip-join-domain](tooltip-join-domain.md)] +--- \ No newline at end of file diff --git a/windows/security/identity-protection/hello-for-business/includes/auth-certificate-template.md b/windows/security/identity-protection/hello-for-business/deploy/includes/auth-certificate-template.md similarity index 100% rename from windows/security/identity-protection/hello-for-business/includes/auth-certificate-template.md rename to windows/security/identity-protection/hello-for-business/deploy/includes/auth-certificate-template.md diff --git a/windows/security/identity-protection/hello-for-business/includes/dc-certificate-deployment.md b/windows/security/identity-protection/hello-for-business/deploy/includes/dc-certificate-deployment.md similarity index 100% rename from windows/security/identity-protection/hello-for-business/includes/dc-certificate-deployment.md rename to windows/security/identity-protection/hello-for-business/deploy/includes/dc-certificate-deployment.md diff --git a/windows/security/identity-protection/hello-for-business/includes/dc-certificate-supersede.md b/windows/security/identity-protection/hello-for-business/deploy/includes/dc-certificate-supersede.md similarity index 100% rename from windows/security/identity-protection/hello-for-business/includes/dc-certificate-supersede.md rename to windows/security/identity-protection/hello-for-business/deploy/includes/dc-certificate-supersede.md diff --git a/windows/security/identity-protection/hello-for-business/includes/dc-certificate-template.md b/windows/security/identity-protection/hello-for-business/deploy/includes/dc-certificate-template.md similarity index 100% rename from windows/security/identity-protection/hello-for-business/includes/dc-certificate-template.md rename to windows/security/identity-protection/hello-for-business/deploy/includes/dc-certificate-template.md diff --git a/windows/security/identity-protection/hello-for-business/includes/dc-certificate-validate.md b/windows/security/identity-protection/hello-for-business/deploy/includes/dc-certificate-validate.md similarity index 100% rename from windows/security/identity-protection/hello-for-business/includes/dc-certificate-validate.md rename to windows/security/identity-protection/hello-for-business/deploy/includes/dc-certificate-validate.md diff --git a/windows/security/identity-protection/hello-for-business/includes/enrollment-agent-certificate-template.md b/windows/security/identity-protection/hello-for-business/deploy/includes/enrollment-agent-certificate-template.md similarity index 100% rename from windows/security/identity-protection/hello-for-business/includes/enrollment-agent-certificate-template.md rename to windows/security/identity-protection/hello-for-business/deploy/includes/enrollment-agent-certificate-template.md diff --git a/windows/security/identity-protection/hello-for-business/deploy/includes/information.svg b/windows/security/identity-protection/hello-for-business/deploy/includes/information.svg new file mode 100644 index 0000000000..bc692eabb9 --- /dev/null +++ b/windows/security/identity-protection/hello-for-business/deploy/includes/information.svg @@ -0,0 +1,3 @@ + + + \ No newline at end of file diff --git a/windows/security/identity-protection/hello-for-business/includes/hello-intro.md b/windows/security/identity-protection/hello-for-business/deploy/includes/intro.md similarity index 100% rename from windows/security/identity-protection/hello-for-business/includes/hello-intro.md rename to windows/security/identity-protection/hello-for-business/deploy/includes/intro.md diff --git a/windows/security/identity-protection/hello-for-business/includes/lab-based-pki-deploy.md b/windows/security/identity-protection/hello-for-business/deploy/includes/lab-based-pki-deploy.md similarity index 100% rename from windows/security/identity-protection/hello-for-business/includes/lab-based-pki-deploy.md rename to windows/security/identity-protection/hello-for-business/deploy/includes/lab-based-pki-deploy.md diff --git a/windows/security/identity-protection/hello-for-business/deploy/includes/tooltip-deployment-cloud.md b/windows/security/identity-protection/hello-for-business/deploy/includes/tooltip-deployment-cloud.md new file mode 100644 index 0000000000..dc0a2c315a --- /dev/null +++ b/windows/security/identity-protection/hello-for-business/deploy/includes/tooltip-deployment-cloud.md @@ -0,0 +1,6 @@ +--- +ms.date: 12/15/2023 +ms.topic: include +--- + +[cloud :::image type="icon" source="information.svg" border="false":::](../../hello-how-it-works-technology.md#cloud-deployment "For organizations using Microsoft Entra-only identities. Device management is usually done via Intune/MDM") diff --git a/windows/security/identity-protection/hello-for-business/deploy/includes/tooltip-deployment-hybrid.md b/windows/security/identity-protection/hello-for-business/deploy/includes/tooltip-deployment-hybrid.md new file mode 100644 index 0000000000..5df4ec742e --- /dev/null +++ b/windows/security/identity-protection/hello-for-business/deploy/includes/tooltip-deployment-hybrid.md @@ -0,0 +1,6 @@ +--- +ms.date: 12/15/2023 +ms.topic: include +--- + +[hybrid :::image type="icon" source="information.svg" border="false":::](../../hello-how-it-works-technology.md#hybrid-deployment "For organizations using Active Directory identities synchronized to Microsoft Entra ID. Device management is usually done via Group Policy or Intune/MDM") diff --git a/windows/security/identity-protection/hello-for-business/deploy/includes/tooltip-deployment-onpremises.md b/windows/security/identity-protection/hello-for-business/deploy/includes/tooltip-deployment-onpremises.md new file mode 100644 index 0000000000..12dfec5f8a --- /dev/null +++ b/windows/security/identity-protection/hello-for-business/deploy/includes/tooltip-deployment-onpremises.md @@ -0,0 +1,6 @@ +--- +ms.date: 12/15/2023 +ms.topic: include +--- + +[on-premises :::image type="icon" source="information.svg" border="false":::](../../hello-how-it-works-technology.md#on-premises-deployment "For organizations using Active Directory identities, not synchronized to Microsoft Entra ID. Device management is usually done via Group Policy") diff --git a/windows/security/identity-protection/hello-for-business/deploy/includes/tooltip-join-domain.md b/windows/security/identity-protection/hello-for-business/deploy/includes/tooltip-join-domain.md new file mode 100644 index 0000000000..bb7302821e --- /dev/null +++ b/windows/security/identity-protection/hello-for-business/deploy/includes/tooltip-join-domain.md @@ -0,0 +1,6 @@ +--- +ms.date: 12/15/2023 +ms.topic: include +--- + +[domain join :::image type="icon" source="information.svg" border="false":::](../../hello-how-it-works-technology.md) diff --git a/windows/security/identity-protection/hello-for-business/deploy/includes/tooltip-join-entra.md b/windows/security/identity-protection/hello-for-business/deploy/includes/tooltip-join-entra.md new file mode 100644 index 0000000000..8c5916ead4 --- /dev/null +++ b/windows/security/identity-protection/hello-for-business/deploy/includes/tooltip-join-entra.md @@ -0,0 +1,6 @@ +--- +ms.date: 12/15/2023 +ms.topic: include +--- + +[Microsoft Entra join :::image type="icon" source="information.svg" border="false":::](../../hello-how-it-works-technology.md#azure-active-directory-join "Devices that are Microsoft Entra joined do not have any dependencies on Active Directory. Only local users accounts and Microsoft Entra users can sign in to these devices") diff --git a/windows/security/identity-protection/hello-for-business/deploy/includes/tooltip-join-hybrid.md b/windows/security/identity-protection/hello-for-business/deploy/includes/tooltip-join-hybrid.md new file mode 100644 index 0000000000..e825d14f2d --- /dev/null +++ b/windows/security/identity-protection/hello-for-business/deploy/includes/tooltip-join-hybrid.md @@ -0,0 +1,6 @@ +--- +ms.date: 12/15/2023 +ms.topic: include +--- + +[Microsoft Entra hybrid join :::image type="icon" source="information.svg" border="false":::](../../hello-how-it-works-technology.md#hybrid-azure-ad-join "Devices that are Microsoft Entra hybrid joined don't have any dependencies on Microsoft Entra ID. Only local users accounts and Active Directory users can sign in to these devices. Active Directory users that are synchronized to Microsoft Entra ID will have single-sign on to both Active Directory and Microsoft Entra protected resources") diff --git a/windows/security/identity-protection/hello-for-business/deploy/includes/tooltip-cert-trust.md b/windows/security/identity-protection/hello-for-business/deploy/includes/tooltip-trust-cert.md similarity index 100% rename from windows/security/identity-protection/hello-for-business/deploy/includes/tooltip-cert-trust.md rename to windows/security/identity-protection/hello-for-business/deploy/includes/tooltip-trust-cert.md diff --git a/windows/security/identity-protection/hello-for-business/deploy/includes/tooltip-trust-cloud-kerberos.md b/windows/security/identity-protection/hello-for-business/deploy/includes/tooltip-trust-cloud-kerberos.md new file mode 100644 index 0000000000..4f19945d64 --- /dev/null +++ b/windows/security/identity-protection/hello-for-business/deploy/includes/tooltip-trust-cloud-kerberos.md @@ -0,0 +1,6 @@ +--- +ms.date: 12/08/2022 +ms.topic: include +--- + +[cloud Kerberos trust :::image type="icon" source="information.svg" border="false":::](../../hello-how-it-works-technology.md#cloud-kerberos-trust "This trust type uses security keys to authenticate the users to Active Directory. It's not required to issue any certificates, making it the recommended choice for environments that do not need certificate authentication") \ No newline at end of file diff --git a/windows/security/identity-protection/hello-for-business/deploy/includes/tooltip-trust-key.md b/windows/security/identity-protection/hello-for-business/deploy/includes/tooltip-trust-key.md new file mode 100644 index 0000000000..2f901dc761 --- /dev/null +++ b/windows/security/identity-protection/hello-for-business/deploy/includes/tooltip-trust-key.md @@ -0,0 +1,6 @@ +--- +ms.date: 12/08/2022 +ms.topic: include +--- + +[key trust :::image type="icon" source="information.svg" border="false":::](../../hello-how-it-works-technology.md#key-trust "This trust type uses a raw key to authenticate the users to Active Directory. It's not required to issue certificates to users, but it's required to deploy certificates to domain controllers") \ No newline at end of file diff --git a/windows/security/identity-protection/hello-for-business/includes/unpublish-superseded-templates.md b/windows/security/identity-protection/hello-for-business/deploy/includes/unpublish-superseded-templates.md similarity index 100% rename from windows/security/identity-protection/hello-for-business/includes/unpublish-superseded-templates.md rename to windows/security/identity-protection/hello-for-business/deploy/includes/unpublish-superseded-templates.md diff --git a/windows/security/identity-protection/hello-for-business/includes/web-server-certificate-template.md b/windows/security/identity-protection/hello-for-business/deploy/includes/web-server-certificate-template.md similarity index 79% rename from windows/security/identity-protection/hello-for-business/includes/web-server-certificate-template.md rename to windows/security/identity-protection/hello-for-business/deploy/includes/web-server-certificate-template.md index 8ba241a5c8..1bde4860fe 100644 --- a/windows/security/identity-protection/hello-for-business/includes/web-server-certificate-template.md +++ b/windows/security/identity-protection/hello-for-business/deploy/includes/web-server-certificate-template.md @@ -15,13 +15,13 @@ Sign in to a CA or management workstations with *Domain Administrator* equivalen 1. Use the following table to configure the template: | Tab Name | Configurations | - | --- | --- | - | *Compatibility* | | - | *General* | | + |--|--| + | *Compatibility* | | + | *General* | | | *Request Handling* | Select **Allow private key to be exported** | - | *Subject Name* | Select **Supply in the request**| - |*Security*|Add **Domain Computers** with **Enroll** access| - |*Cryptography*|