Windows Hello for Business

• 05/05/2018
• 3 minutes to read
• Contributors
  • 
  • 
  • 
  • 
  • 
  • all

In Windows 10, Windows Hello for Business replaces passwords with strong two-factor authentication on PCs and mobile devices. This authentication consists of a new type of user credential that is tied to a device and uses a biometric or PIN.
Windows Hello for Business lets user authenticate to an Active Directory or Azure Active Directory account.

Windows Hello addresses the following problems with passwords:

• Strong passwords can be difficult to remember, and users often reuse passwords on multiple sites.
• Server breaches can expose symmetric network credentials (passwords).
• Passwords are subject to replay attacks.
• Users can inadvertently expose their passwords due to phishing attacks.

Overview	Why PIN is better than a password	Manage Windows Hello in your Organization

Prerequisites

Cloud Only Deployment

• Windows 10, version 1511 or later
• Microsoft Azure Account
• Azure Active Directory
• Azure Multi-factor authentication
• Modern Management (Intune or supported third-party MDM), optional
• Azure AD Premium subscription - optional, needed for automatic MDM enrollment when the device joins Azure Active Directory

Hybrid Deployments

The table shows the minimum requirements for each deployment. For key trust in a multi-domain/multi-forest deployment, the following requirements are applicable for each domain/forest that hosts Windows Hello for business components or is involved in the Kerberos referral process.

On-premises Deployments

The table shows the minimum requirements for each deployment.