Policy CSP - Authentication


Authentication policies

Authentication/AllowAadPasswordReset
Authentication/AllowEAPCertSSO
Authentication/AllowFastReconnect
Authentication/AllowFidoDeviceSignon
Authentication/AllowSecondaryAuthenticationDevice

Authentication/AllowAadPasswordReset

Home Pro Business Enterprise Education Mobile Mobile Enterprise
cross mark check mark3 check mark3 check mark3 check mark3 cross mark cross mark

Scope:

  • Device

Added in Windows 10, version 1709. Specifies whether password reset is enabled for Azure Active Directory accounts. This policy allows the Azure AD tenant administrators to enable self service password reset feature on the windows logon screen.

The following list shows the supported values:

  • 0 (default) – Not allowed.
  • 1 – Allowed.

Authentication/AllowEAPCertSSO

Home Pro Business Enterprise Education Mobile Mobile Enterprise
cross mark check mark check mark check mark check mark cross mark cross mark

Scope:

  • User

Allows an EAP cert-based authentication for a single sign on (SSO) to access internal resources.

The following list shows the supported values:

  • 0 – Not allowed.
  • 1 (default) – Allowed.

Authentication/AllowFastReconnect

Home Pro Business Enterprise Education Mobile Mobile Enterprise
check mark check mark check mark check mark check mark check mark check mark

Scope:

  • Device

Allows EAP Fast Reconnect from being attempted for EAP Method TLS.

Most restricted value is 0.

The following list shows the supported values:

  • 0 – Not allowed.
  • 1 (default) – Allowed.

Authentication/AllowFidoDeviceSignon

Home Pro Business Enterprise Education Mobile Mobile Enterprise
cross mark check mark3 check mark3 check mark3 check mark3 cross mark cross mark

Scope:

  • Device

Preview release in Windows 10, version 1709. Supported in the next release. Specifies whether Fast Identity Online (FIDO) device can be used to sign on. This policy enables the Windows logon credential provider for FIDO 2.0

Value type is integer.

Here is an example scenario: At Contoso, there are a lot of shared devices and kiosks that employees throughout the day using as many as 20 different devices. To minimize the loss in productivity when employees have to login with username and password everytime they pick up a device, the IT admin deploys SharePC CSP and Authentication/AllowFidoDeviceSignon policy to shared devices. The IT admin provisions and distributes FIDO 2.0 devices to employees, which allows them to authenticate to various shared devices and PCs.

The following list shows the supported values:

  • 0 - Do not allow. The FIDO device credential provider disabled.
  • 1 - Allow. The FIDO device credential provider is enabled and allows usage of FIDO devices to sign into an Windows.

Authentication/AllowSecondaryAuthenticationDevice

Home Pro Business Enterprise Education Mobile Mobile Enterprise
check mark1 check mark1 check mark1 check mark1 check mark1 check mark1 check mark1

Scope:

  • Device

Added in Windows 10, version 1607. Allows secondary authentication devices to work with Windows.

The default for this policy must be on for consumer devices (defined as local or Microsoft account connected device) and off for enterprise devices (such as cloud domain-joined, cloud domain-joined in an on-premise only environment, cloud domain-joined in a hybrid environment, and BYOD).

ADMX Info:

  • GP English name: Allow companion device for secondary authentication
  • GP name: MSSecondaryAuthFactor_AllowSecondaryAuthenticationDevice
  • GP path: Windows Components/Microsoft Secondary Authentication Factor
  • GP ADMX file name: DeviceCredential.admx

The following list shows the supported values:

  • 0 – Not allowed.
  • 1 – Allowed.

Footnote:

  • 1 - Added in Windows 10, version 1607.
  • 2 - Added in Windows 10, version 1703.
  • 3 - Added in Windows 10, version 1709.
  • 4 - Added in Windows 10, version 1803.

Authentication policies supported by Windows Holographic for Business

Authentication policies supported by IoT Core