My preferred method of working here is to move things to use modern authentication and as such the devices I use to test this are just Azure AD joined (and provisioned using Autopilot), so I won't be setting up the certificate for on-premise authentication. If configured correctly it can also be used to authenticate to on-premise resources such as from a domain-joined or hybrid-joined device.

Windows Hello for Business is the enterprise version of Windows Hello and can be configured using Group Policy or a modern MDM such as Intune. The private key and other biometric data is stored in the device, either in the TPM chip (if present) or in the file system. The default setting permits numbers, lower and upper case letters but does not allow special characters.Īt a basic level it works by using a public/private key pair or certificate based authentication. In this case a PIN is more like a password, as we can define the minimum and maximum length, and allow/forbid/require lower case, upper case and special characters. Azure AD) so is more secure than a password as an attacker would need the device as well as the face/finger/PIN of the person they are trying to impersonate. The data for these is stored on the device itself rather than transmitted to the authentication provider (i.e. Windows Hello is Windows 10's biometric authentication system which allows users to sign into their device using facial recognition (if the device has an IR camera), fingerprint (if the device has a fingerprint reader) and PIN. By Katy Nicholson, posted on 12 March, 2021

Microsoft hello