Manage Windows Hello for Business in your organization

Applies to

  • Windows 10
  • Windows 10 Mobile

You can create a Group Policy or mobile device management (MDM) policy that will implement Windows Hello on devices running Windows 10.

Important

The Group Policy setting Turn on PIN sign-in does not apply to Windows Hello for Business. It still prevents or enables the creation of a convenience PIN for Windows 10, version 1507 and 1511.

Beginning in version 1607, Windows Hello as a convenience PIN is disabled by default on all domain-joined computers. To enable a convenience PIN for Windows 10, version 1607, enable the Group Policy setting Turn on convenience PIN sign-in.

Use PIN Complexity policy settings to manage PINs for Windows Hello for Business.

Group Policy settings for Windows Hello for Business

The following table lists the Group Policy settings that you can configure for Windows Hello use in your workplace. These policy settings are available in both User configuration and Computer Configuration under Policies > Administrative Templates > Windows Components > Windows Hello for Business.

Policy Options
Use Windows Hello for Business

Not configured: Users can provision Windows Hello for Business, which encrypts their domain password.

Enabled: Device provisions Windows Hello for Business using keys or certificates for all users.

Disabled: Device does not provision Windows Hello for Business for any user.

Use a hardware security device

Not configured: Windows Hello for Business will be provisioned using TPM if available, and will be provisioned using software if TPM is not available.

Enabled: Windows Hello for Business will only be provisioned using TPM.

Disabled: Windows Hello for Business will be provisioned using TPM if available, and will be provisioned using software if TPM is not available.

Use biometrics

Not configured: Biometrics can be used as a gesture in place of a PIN.

Enabled: Biometrics can be used as a gesture in place of a PIN.

Disabled: Only a PIN can be used as a gesture.

PIN Complexity Require digits

Not configured: Users must include a digit in their PIN.

Enabled: Users must include a digit in their PIN.

Disabled: Users cannot use digits in their PIN.

Require lowercase letters

Not configured: Users cannot use lowercase letters in their PIN.

Enabled: Users must include at least one lowercase letter in their PIN.

Disabled: Users cannot use lowercase letters in their PIN.

Maximum PIN length

Not configured: PIN length must be less than or equal to 127.

Enabled: PIN length must be less than or equal to the number you specify.

Disabled: PIN length must be less than or equal to 127.

Minimum PIN length

Not configured: PIN length must be greater than or equal to 4.

Enabled: PIN length must be greater than or equal to the number you specify.

Disabled: PIN length must be greater than or equal to 4.

Expiration

Not configured: PIN does not expire.

Enabled: PIN can be set to expire after any number of days between 1 and 730, or PIN can be set to never expire by setting policy to 0.

Disabled: PIN does not expire.

History

Not configured: Previous PINs are not stored.

Enabled: Specify the number of previous PINs that can be associated to a user account that can't be reused.

Disabled: Previous PINs are not stored.

Note Current PIN is included in PIN history.
Require special characters

Not configured: Users cannot include a special character in their PIN.

Enabled: Users must include at least one special character in their PIN.

Disabled: Users cannot include a special character in their PIN.

Require uppercase letters

Not configured: Users cannot include an uppercase letter in their PIN.

Enabled: Users must include at least one uppercase letter in their PIN.

Disabled: Users cannot include an uppercase letter in their PIN.

>Phone Sign-in

Use Phone Sign-in

Not currently supported.

MDM policy settings for Windows Hello for Business

The following table lists the MDM policy settings that you can configure for Windows Hello for Business use in your workplace. These MDM policy settings use the PassportForWork configuration service provider (CSP).

Important

Starting in Windows 10, version 1607, all devices only have one PIN associated with Windows Hello for Business. This means that any PIN on a device will be subject to the policies specified in the PassportForWork CSP. The values specified take precedence over any complexity rules set via Exchange ActiveSync (EAS) or the DeviceLock CSP.

Policy Scope Default Options
UsePassportForWork Device True

True: Windows Hello for Business will be provisioned for all users on the device.

False: Users will not be able to provision Windows Hello for Business.

Note If Windows Hello for Business is enabled, and then the policy is changed to False, users who previously set up Windows Hello for Business can continue to use it, but will not be able to set up Windows Hello for Business on other devices.
RequireSecurityDevice Device False

True: Windows Hello for Business will only be provisioned using TPM.

False: Windows Hello for Business will be provisioned using TPM if available, and will be provisioned using software if TPM is not available.

Biometrics

UseBiometrics

Device False

True: Biometrics can be used as a gesture in place of a PIN for domain sign-in.

False: Only a PIN can be used as a gesture for domain sign-in.

FacialFeaturesUser

EnhancedAntiSpoofing

Device Not configured

Not configured: users can choose whether to turn on enhanced anti-spoofing.

True: Enhanced anti-spoofing is required on devices which support it.

False: Users cannot turn on enhanced anti-spoofing.

PINComplexity
Digits Device or user 2

1: Numbers are not allowed.

2: At least one number is required.

Lowercase letters Device or user 1

1: Lowercase letters are not allowed.

2: At least one lowercase letter is required.

Maximum PIN length Device or user 127

Maximum length that can be set is 127. Maximum length cannot be less than minimum setting.

Minimum PIN length Device or user 4

Minimum length that can be set is 4. Minimum length cannot be greater than maximum setting.

Expiration Device or user 0

Integer value specifies the period of time (in days) that a PIN can be used before the system requires the user to change it. The largest number you can configure for this policy setting is 730. The lowest number you can configure for this policy setting is 0. If this policy is set to 0, then the user’s PIN will never expire.

History Device or user 0

Integer value that specifies the number of past PINs that can be associated to a user account that can’t be reused. The largest number you can configure for this policy setting is 50. The lowest number you can configure for this policy setting is 0. If this policy is set to 0, then storage of previous PINs is not required.

Special characters Device or user 1

1: Special characters are not allowed.

2: At least one special character is required.

Uppercase letters Device or user 1

1: Uppercase letters are not allowed

2: At least one uppercase letter is required

Remote

UseRemotePassport

Device or user False

Not currently supported.

Note

If policy is not configured to explicitly require letters or special characters, users will be restricted to creating a numeric PIN.

How to use Windows Hello for Business with Azure Active Directory

There are three scenarios for using Windows Hello for Business in Azure AD–only organizations:

  • Organizations that use the version of Azure AD included with Office 365. For these organizations, no additional work is necessary. When Windows 10 was released to general availability, Microsoft changed the behavior of the Office 365 Azure AD stack. When a user selects the option to join a work or school network, the device is automatically joined to the Office 365 tenant’s directory partition, a certificate is issued for the device, and it becomes eligible for Office 365 MDM if the tenant has subscribed to that feature. In addition, the user will be prompted to log on and, if MFA is enabled, to enter an MFA proof that Azure AD sends to his or her phone.
  • Organizations that use the free tier of Azure AD. For these organizations, Microsoft has not enabled automatic domain join to Azure AD. Organizations that have signed up for the free tier have the option to enable or disable this feature, so automatic domain join won’t be enabled unless and until the organization’s administrators decide to enable it. When that feature is enabled, devices that join the Azure AD domain by using the Connect to work or school dialog box will be automatically registered with Windows Hello for Business support, but previously joined devices will not be registered.
  • Organizations that have subscribed to Azure AD Premium have access to the full set of Azure AD MDM features. These features include controls to manage Windows Hello for Business. You can set policies to disable or force the use of Windows Hello for Business, require the use of a TPM, and control the length and strength of PINs set on the device.

If you want to use Windows Hello for Business with certificates, you’ll need a device registration system. That means that you set up Configuration Manager Technical Preview, Intune, or a compatible non-Microsoft MDM system and enable it to enroll devices. This is a prerequisite step to use Windows Hello for Business with certificates, no matter the IDP, because the enrollment system is responsible for provisioning the devices with the necessary certificates.