mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-12 13:27:23 +00:00
8885e60f0f
Update to the policy definition for secondary authentication factor. The default behavior for consumer devices will change in the next major WIndows 10 release.
506 lines
14 KiB
Markdown
506 lines
14 KiB
Markdown
---
|
||
title: Policy CSP - Authentication
|
||
description: Policy CSP - Authentication
|
||
ms.author: maricia
|
||
ms.topic: article
|
||
ms.prod: w10
|
||
ms.technology: windows
|
||
author: MariciaAlforque
|
||
ms.date: 07/30/2018
|
||
---
|
||
|
||
# Policy CSP - Authentication
|
||
|
||
> [!WARNING]
|
||
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
|
||
|
||
|
||
<hr/>
|
||
|
||
<!--Policies-->
|
||
## Authentication policies
|
||
|
||
<dl>
|
||
<dd>
|
||
<a href="#authentication-allowaadpasswordreset">Authentication/AllowAadPasswordReset</a>
|
||
</dd>
|
||
<dd>
|
||
<a href="#authentication-alloweapcertsso">Authentication/AllowEAPCertSSO</a>
|
||
</dd>
|
||
<dd>
|
||
<a href="#authentication-allowfastreconnect">Authentication/AllowFastReconnect</a>
|
||
</dd>
|
||
<dd>
|
||
<a href="#authentication-allowfidodevicesignon">Authentication/AllowFidoDeviceSignon</a>
|
||
</dd>
|
||
<dd>
|
||
<a href="#authentication-allowsecondaryauthenticationdevice">Authentication/AllowSecondaryAuthenticationDevice</a>
|
||
</dd>
|
||
<dd>
|
||
<a href="#authentication-enablefastfirstsignin">Authentication/EnableFastFirstSignIn</a>
|
||
</dd>
|
||
<dd>
|
||
<a href="#authentication-enablewebsignin">Authentication/EnableWebSignIn</a>
|
||
</dd>
|
||
<dd>
|
||
<a href="#authentication-preferredaadtenantdomainname">Authentication/PreferredAadTenantDomainName</a>
|
||
</dd>
|
||
</dl>
|
||
|
||
|
||
<hr/>
|
||
|
||
<!--Policy-->
|
||
<a href="" id="authentication-allowaadpasswordreset"></a>**Authentication/AllowAadPasswordReset**
|
||
|
||
<!--SupportedSKUs-->
|
||
<table>
|
||
<tr>
|
||
<th>Home</th>
|
||
<th>Pro</th>
|
||
<th>Business</th>
|
||
<th>Enterprise</th>
|
||
<th>Education</th>
|
||
<th>Mobile</th>
|
||
<th>Mobile Enterprise</th>
|
||
</tr>
|
||
<tr>
|
||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||
<td><img src="images/checkmark.png" alt="check mark" /><sup>3</sup></td>
|
||
<td><img src="images/checkmark.png" alt="check mark" /><sup>3</sup></td>
|
||
<td><img src="images/checkmark.png" alt="check mark" /><sup>3</sup></td>
|
||
<td><img src="images/checkmark.png" alt="check mark" /><sup>3</sup></td>
|
||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||
</tr>
|
||
</table>
|
||
|
||
<!--/SupportedSKUs-->
|
||
<!--Scope-->
|
||
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||
|
||
> [!div class = "checklist"]
|
||
> * Device
|
||
|
||
<hr/>
|
||
|
||
<!--/Scope-->
|
||
<!--Description-->
|
||
Added in Windows 10, version 1709. Specifies whether password reset is enabled for Azure Active Directory accounts. This policy allows the Azure AD tenant administrators to enable self service password reset feature on the windows logon screen.
|
||
|
||
<!--/Description-->
|
||
<!--SupportedValues-->
|
||
The following list shows the supported values:
|
||
|
||
- 0 (default) – Not allowed.
|
||
- 1 – Allowed.
|
||
|
||
<!--/SupportedValues-->
|
||
<!--/Policy-->
|
||
|
||
<hr/>
|
||
|
||
<!--Policy-->
|
||
<a href="" id="authentication-alloweapcertsso"></a>**Authentication/AllowEAPCertSSO**
|
||
|
||
<!--SupportedSKUs-->
|
||
<table>
|
||
<tr>
|
||
<th>Home</th>
|
||
<th>Pro</th>
|
||
<th>Business</th>
|
||
<th>Enterprise</th>
|
||
<th>Education</th>
|
||
<th>Mobile</th>
|
||
<th>Mobile Enterprise</th>
|
||
</tr>
|
||
<tr>
|
||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||
</tr>
|
||
</table>
|
||
|
||
<!--/SupportedSKUs-->
|
||
<!--Scope-->
|
||
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||
|
||
> [!div class = "checklist"]
|
||
> * User
|
||
|
||
<hr/>
|
||
|
||
<!--/Scope-->
|
||
<!--Description-->
|
||
Allows an EAP cert-based authentication for a single sign on (SSO) to access internal resources.
|
||
|
||
<!--/Description-->
|
||
<!--SupportedValues-->
|
||
The following list shows the supported values:
|
||
|
||
- 0 – Not allowed.
|
||
- 1 (default) – Allowed.
|
||
|
||
<!--/SupportedValues-->
|
||
<!--/Policy-->
|
||
|
||
<hr/>
|
||
|
||
<!--Policy-->
|
||
<a href="" id="authentication-allowfastreconnect"></a>**Authentication/AllowFastReconnect**
|
||
|
||
<!--SupportedSKUs-->
|
||
<table>
|
||
<tr>
|
||
<th>Home</th>
|
||
<th>Pro</th>
|
||
<th>Business</th>
|
||
<th>Enterprise</th>
|
||
<th>Education</th>
|
||
<th>Mobile</th>
|
||
<th>Mobile Enterprise</th>
|
||
</tr>
|
||
<tr>
|
||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||
</tr>
|
||
</table>
|
||
|
||
<!--/SupportedSKUs-->
|
||
<!--Scope-->
|
||
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||
|
||
> [!div class = "checklist"]
|
||
> * Device
|
||
|
||
<hr/>
|
||
|
||
<!--/Scope-->
|
||
<!--Description-->
|
||
Allows EAP Fast Reconnect from being attempted for EAP Method TLS.
|
||
|
||
Most restricted value is 0.
|
||
|
||
<!--/Description-->
|
||
<!--SupportedValues-->
|
||
The following list shows the supported values:
|
||
|
||
- 0 – Not allowed.
|
||
- 1 (default) – Allowed.
|
||
|
||
<!--/SupportedValues-->
|
||
<!--/Policy-->
|
||
|
||
<hr/>
|
||
|
||
<!--Policy-->
|
||
<a href="" id="authentication-allowfidodevicesignon"></a>**Authentication/AllowFidoDeviceSignon**
|
||
|
||
<!--SupportedSKUs-->
|
||
<table>
|
||
<tr>
|
||
<th>Home</th>
|
||
<th>Pro</th>
|
||
<th>Business</th>
|
||
<th>Enterprise</th>
|
||
<th>Education</th>
|
||
<th>Mobile</th>
|
||
<th>Mobile Enterprise</th>
|
||
</tr>
|
||
<tr>
|
||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||
<td><img src="images/checkmark.png" alt="check mark" /><sup>3</sup></td>
|
||
<td><img src="images/checkmark.png" alt="check mark" /><sup>3</sup></td>
|
||
<td><img src="images/checkmark.png" alt="check mark" /><sup>3</sup></td>
|
||
<td><img src="images/checkmark.png" alt="check mark" /><sup>3</sup></td>
|
||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||
</tr>
|
||
</table>
|
||
|
||
<!--/SupportedSKUs-->
|
||
<!--Scope-->
|
||
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||
|
||
> [!div class = "checklist"]
|
||
> * Device
|
||
|
||
<hr/>
|
||
|
||
<!--/Scope-->
|
||
<!--Description-->
|
||
Preview release in Windows 10, version 1709. Supported in the next release. Specifies whether Fast Identity Online (FIDO) device can be used to sign on. This policy enables the Windows logon credential provider for FIDO 2.0
|
||
|
||
Value type is integer.
|
||
|
||
Here is an example scenario: At Contoso, there are a lot of shared devices and kiosks that employees throughout the day using as many as 20 different devices. To minimize the loss in productivity when employees have to login with username and password everytime they pick up a device, the IT admin deploys SharePC CSP and Authentication/AllowFidoDeviceSignon policy to shared devices. The IT admin provisions and distributes FIDO 2.0 devices to employees, which allows them to authenticate to various shared devices and PCs.
|
||
|
||
<!--/Description-->
|
||
<!--SupportedValues-->
|
||
The following list shows the supported values:
|
||
|
||
- 0 - Do not allow. The FIDO device credential provider disabled.
|
||
- 1 - Allow. The FIDO device credential provider is enabled and allows usage of FIDO devices to sign into an Windows.
|
||
|
||
<!--/SupportedValues-->
|
||
<!--/Policy-->
|
||
|
||
<hr/>
|
||
|
||
<!--Policy-->
|
||
<a href="" id="authentication-allowsecondaryauthenticationdevice"></a>**Authentication/AllowSecondaryAuthenticationDevice**
|
||
|
||
<!--SupportedSKUs-->
|
||
<table>
|
||
<tr>
|
||
<th>Home</th>
|
||
<th>Pro</th>
|
||
<th>Business</th>
|
||
<th>Enterprise</th>
|
||
<th>Education</th>
|
||
<th>Mobile</th>
|
||
<th>Mobile Enterprise</th>
|
||
</tr>
|
||
<tr>
|
||
<td><img src="images/checkmark.png" alt="check mark" /><sup>1</sup></td>
|
||
<td><img src="images/checkmark.png" alt="check mark" /><sup>1</sup></td>
|
||
<td><img src="images/checkmark.png" alt="check mark" /><sup>1</sup></td>
|
||
<td><img src="images/checkmark.png" alt="check mark" /><sup>1</sup></td>
|
||
<td><img src="images/checkmark.png" alt="check mark" /><sup>1</sup></td>
|
||
<td><img src="images/checkmark.png" alt="check mark" /><sup>1</sup></td>
|
||
<td><img src="images/checkmark.png" alt="check mark" /><sup>1</sup></td>
|
||
</tr>
|
||
</table>
|
||
|
||
<!--/SupportedSKUs-->
|
||
<!--Scope-->
|
||
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||
|
||
> [!div class = "checklist"]
|
||
> * Device
|
||
|
||
<hr/>
|
||
|
||
<!--/Scope-->
|
||
<!--Description-->
|
||
Added in Windows 10, version 1607. Allows secondary authentication devices to work with Windows.
|
||
|
||
The default for this policy must be on for consumer devices (defined as local or Microsoft account connected device) and off for enterprise devices (such as cloud domain-joined, cloud domain-joined in an on-premises only environment, cloud domain-joined in a hybrid environment, and BYOD).
|
||
|
||
In the next major release of Windows 10, the default for this policy for consumers devices will be changed to off. This will only affect users that have not already set up a secondary authentication device.
|
||
|
||
<!--/Description-->
|
||
<!--ADMXMapped-->
|
||
ADMX Info:
|
||
- GP English name: *Allow companion device for secondary authentication*
|
||
- GP name: *MSSecondaryAuthFactor_AllowSecondaryAuthenticationDevice*
|
||
- GP path: *Windows Components/Microsoft Secondary Authentication Factor*
|
||
- GP ADMX file name: *DeviceCredential.admx*
|
||
|
||
<!--/ADMXMapped-->
|
||
<!--SupportedValues-->
|
||
The following list shows the supported values:
|
||
|
||
- 0 – Not allowed.
|
||
- 1 – Allowed.
|
||
|
||
<!--/SupportedValues-->
|
||
<!--/Policy-->
|
||
|
||
<hr/>
|
||
|
||
<!--Policy-->
|
||
<a href="" id="authentication-enablefastfirstsignin"></a>**Authentication/EnableFastFirstSignIn**
|
||
|
||
<!--SupportedSKUs-->
|
||
<table>
|
||
<tr>
|
||
<th>Home</th>
|
||
<th>Pro</th>
|
||
<th>Business</th>
|
||
<th>Enterprise</th>
|
||
<th>Education</th>
|
||
<th>Mobile</th>
|
||
<th>Mobile Enterprise</th>
|
||
</tr>
|
||
<tr>
|
||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||
<td><img src="images/checkmark.png" alt="check mark" /><sup>5</sup></td>
|
||
<td><img src="images/checkmark.png" alt="check mark" /><sup>5</sup></td>
|
||
<td><img src="images/checkmark.png" alt="check mark" /><sup>5</sup></td>
|
||
<td><img src="images/checkmark.png" alt="check mark" /><sup>5</sup></td>
|
||
<td></td>
|
||
<td></td>
|
||
</tr>
|
||
</table>
|
||
|
||
<!--/SupportedSKUs-->
|
||
<!--Scope-->
|
||
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||
|
||
> [!div class = "checklist"]
|
||
> * Device
|
||
|
||
<hr/>
|
||
|
||
<!--/Scope-->
|
||
<!--Description-->
|
||
This policy is intended for use on Shared PCs to enable a quick first sign-in experience for a user. It works by automatically connecting new non-admin Azure Active Directory (Azure AD) accounts to the pre-configured candidate local accounts.
|
||
|
||
Value type is integer. Supported values:
|
||
|
||
- 0 - (default) The feature defaults to the existing SKU and device capabilities.
|
||
- 1 - Enabled. Auto connect new non-admin AZure AD accounts to pre-configured candidate local accounts
|
||
- 2 - Disabled. Do not auto connect new non-admin Azure AD accounts to pre-configured local accounts
|
||
|
||
<!--/Description-->
|
||
<!--SupportedValues-->
|
||
|
||
<!--/SupportedValues-->
|
||
<!--Example-->
|
||
|
||
<!--/Example-->
|
||
<!--Validation-->
|
||
|
||
<!--/Validation-->
|
||
<!--/Policy-->
|
||
|
||
<hr/>
|
||
|
||
<!--Policy-->
|
||
<a href="" id="authentication-enablewebsignin"></a>**Authentication/EnableWebSignIn**
|
||
|
||
<!--SupportedSKUs-->
|
||
<table>
|
||
<tr>
|
||
<th>Home</th>
|
||
<th>Pro</th>
|
||
<th>Business</th>
|
||
<th>Enterprise</th>
|
||
<th>Education</th>
|
||
<th>Mobile</th>
|
||
<th>Mobile Enterprise</th>
|
||
</tr>
|
||
<tr>
|
||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||
<td><img src="images/checkmark.png" alt="check mark" /><sup>5</sup></td>
|
||
<td><img src="images/checkmark.png" alt="check mark" /><sup>5</sup></td>
|
||
<td><img src="images/checkmark.png" alt="check mark" /><sup>5</sup></td>
|
||
<td><img src="images/checkmark.png" alt="check mark" /><sup>5</sup></td>
|
||
<td></td>
|
||
<td></td>
|
||
</tr>
|
||
</table>
|
||
|
||
<!--/SupportedSKUs-->
|
||
<!--Scope-->
|
||
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||
|
||
> [!div class = "checklist"]
|
||
> * Device
|
||
|
||
<hr/>
|
||
|
||
<!--/Scope-->
|
||
<!--Description-->
|
||
"Web Sign-in" is a new way of signing into a Windows PC. It enables Windows logon support for non-ADFS federated providers (e.g. SAML).
|
||
|
||
> [!Note]
|
||
> Web Sign-in is only supported on Azure AD Joined PCs.
|
||
|
||
Value type is integer. Supported values:
|
||
|
||
- 0 - (default) The feature defaults to the existing SKU and device capabilities.
|
||
- 1 - Enabled. Web Credential Provider will be enabled for Sign In
|
||
- 2 - Disabled. Web Credential Provider will not be enabled for Sign In
|
||
|
||
<!--/Description-->
|
||
<!--SupportedValues-->
|
||
|
||
<!--/SupportedValues-->
|
||
<!--Example-->
|
||
|
||
<!--/Example-->
|
||
<!--Validation-->
|
||
|
||
<!--/Validation-->
|
||
<!--/Policy-->
|
||
|
||
<hr/>
|
||
|
||
<!--Policy-->
|
||
<a href="" id="authentication-preferredaadtenantdomainname"></a>**Authentication/PreferredAadTenantDomainName**
|
||
|
||
<!--SupportedSKUs-->
|
||
<table>
|
||
<tr>
|
||
<th>Home</th>
|
||
<th>Pro</th>
|
||
<th>Business</th>
|
||
<th>Enterprise</th>
|
||
<th>Education</th>
|
||
<th>Mobile</th>
|
||
<th>Mobile Enterprise</th>
|
||
</tr>
|
||
<tr>
|
||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||
<td><img src="images/checkmark.png" alt="check mark" /><sup>5</sup></td>
|
||
<td><img src="images/checkmark.png" alt="check mark" /><sup>5</sup></td>
|
||
<td><img src="images/checkmark.png" alt="check mark" /><sup>5</sup></td>
|
||
<td><img src="images/checkmark.png" alt="check mark" /><sup>5</sup></td>
|
||
<td></td>
|
||
<td></td>
|
||
</tr>
|
||
</table>
|
||
|
||
<!--/SupportedSKUs-->
|
||
<!--Scope-->
|
||
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||
|
||
> [!div class = "checklist"]
|
||
> * Device
|
||
|
||
<hr/>
|
||
|
||
<!--/Scope-->
|
||
<!--Description-->
|
||
Specifies the preferred domain among available domains in the Azure AD tenant.
|
||
|
||
Example: If your organization is using the "@contoso.com" tenant domain name, the policy value should be "contoso.com". For the user "abby@constoso.com", she would then be able to sign in using "abby" in the username field instead of "abby@contoso.com".
|
||
|
||
|
||
Value type is string.
|
||
|
||
<!--/Description-->
|
||
<!--SupportedValues-->
|
||
|
||
<!--/SupportedValues-->
|
||
<!--Example-->
|
||
|
||
<!--/Example-->
|
||
<!--Validation-->
|
||
|
||
<!--/Validation-->
|
||
<!--/Policy-->
|
||
<hr/>
|
||
|
||
Footnote:
|
||
|
||
- 1 - Added in Windows 10, version 1607.
|
||
- 2 - Added in Windows 10, version 1703.
|
||
- 3 - Added in Windows 10, version 1709.
|
||
- 4 - Added in Windows 10, version 1803.
|
||
- 5 - Added in Windows 10, version 1809.
|
||
- 6 - Added in the next major release of Windows 10.
|
||
|
||
<!--/Policies-->
|