🧱🪟💻ES - Windows Hello for Business
A PIN that looks weaker than a password and is dramatically stronger, because it never leaves the device and is useless to anyone who is not holding it.
What this policy is about 🔑
Every argument about Windows Hello starts the same way. Someone looks at a six-digit PIN, looks at the sixteen-character password policy they spent a year enforcing, and asks the obvious question: how is that an upgrade?
Because the two things are not the same kind of secret. A password is a claim you can make from anywhere: type it in Bratislava, type it in a phishing page, type it into a fake Teams login, and it works, because the password is the credential. A Hello PIN unlocks a private key that lives in the TPM of one specific laptop and cannot be copied out of it. Steal the PIN and you have a number. You also need the laptop, physically, in your hands.
That is the whole trick. Hello moves authentication from something you can say to something you must be holding, and the PIN is only the key to the lock on the box.
A Hello PIN never travels to Entra ID and never authenticates anything except the credential sitting in the TPM of that device. It cannot be phished, replayed, or sprayed, because there is nowhere to replay it to. Ten wrong guesses and the TPM locks out on its own.
Why this matters 🕵️
Password attacks have stopped being clever. Nobody brute-forces anything: they phish a credential, or they buy one, or they spray last summer's leak against your tenant and see who reused it. Every one of those attacks depends on the credential being portable. Hello breaks that assumption at the endpoint, and it does it without asking users to be better at security than they are going to be.
The user experience does most of the selling for you. People stop typing passwords a dozen times a day and start glancing at a camera, which means they stop resenting the security team, which means the next control you roll out gets less pushback. Security that people quietly like is rare enough to be worth deploying on those grounds alone. 😌
It is also the foundation the rest of the identity baseline stands on. Phishing-resistant sign-in on the device makes the Conditional Access story coherent: a compliant device, a credential bound to that device, and an MFA requirement that is satisfied by hardware instead of a code somebody can be talked into reading out over the phone.
🛠️ Configuration
Windows Hello has two front doors in Intune and they behave differently.
The tenant-wide default: Intune admin center → Devices → Enrollment → Windows → Windows Hello for Business. This one applies during enrollment, to everything, with no group targeting.
The targeted policy (use this one): Endpoint security → Account protection → Create policy → Windows → Windows Hello for Business. Group-targetable, which is what you need if kiosks and shared devices are in the fleet.
Set the tenant-wide default to Not configured and drive the behaviour from the targeted policy. One control plane, one place to look when something is off.
| Setting | Value |
|---|---|
| Configure Windows Hello for Business | Enabled |
| Use a Trusted Platform Module (TPM) | Required |
| Minimum PIN length | 6 |
| Maximum PIN length | 127 |
| Lowercase letters in PIN | Not allowed |
| Uppercase letters in PIN | Not allowed |
| Special characters in PIN | Not allowed |
| PIN expiration (days) | Not configured (never expires) |
| Remember PIN history | Not configured |
| Enable PIN recovery | Yes |
| Use biometrics | Yes |
| Use enhanced anti-spoofing, when available | Yes |
| Use security keys for sign-in | Enabled |
| Assignment, include | 🛡️🪟💻⛓️Group - Windows Devices |
| Assignment, exclude | 🛡️🪟💻⛓️Group - Autopilot Devices - Kiosk, 🛡️🪟💻⛓️Group - Autopilot Devices - Shared, 🛡️🪟💻⛓️Group - Autopilot Devices - IoT |
Six digits, and no letters. Every character class you demand pushes users toward a PIN they have to write down, and a PIN on a sticky note under the laptop is worse than a short one in someone's head. The TPM already caps guessing at a handful of attempts, so length is not doing the work you think it is. Six is Microsoft's default and it is the right default.
PIN expiry stays off. Forced rotation is a password-era reflex that made sense when credentials leaked in bulk dumps. A device-bound credential does not leak in bulk, and every rotation is a fresh chance for the user to pick something memorable-and-terrible or call the helpdesk. Leave it alone.
Enhanced anti-spoofing matters more than it sounds. It is the setting that stops facial recognition being satisfied by a photograph. On hardware without a supporting camera it is simply ignored, so there is no downside to leaving it on.
Turn on PIN recovery before you need it. Without it, a forgotten PIN is a reset performed by an administrator. With it, the user recovers from the lock screen after authenticating. It depends on the Microsoft PIN reset service being consented to in the tenant, which is a one-time admin consent for two Microsoft first-party applications; check Entra ID → Enterprise applications for Microsoft Pin Reset Service Production and Microsoft Pin Reset Client Production and grant consent if they are missing.
Caveats ⚠️
Cloud Kerberos trust is only for tenants with on-prem AD. If any user needs to reach a domain-joined file server, print server or line-of-business app with their Hello credential, you also need Use cloud trust for on-premises authentication = Enabled plus an Entra Kerberos server object created in the on-prem directory. A cloud-only tenant should leave this off: switching it on without the directory object produces confusing failures for exactly nothing in return.
Shared devices are excluded on purpose. Hello provisions a credential per user per device and the TPM has finite room. On a laptop that ten people sign in to over a month, you will eventually hit the ceiling and start getting provisioning failures that look like a bug and are actually arithmetic. Shared and kiosk scenarios keep their own sign-in model.
Provisioning is not instant and users notice. After enrolment the device prompts for Hello setup at first sign-in, and if the tenant requires MFA the user gets asked for it right there, on a machine they just unboxed. Warn the helpdesk before a rollout wave, or spend the week explaining that "the new laptop is asking me for a code" is the system working correctly.
Windows 11 Pro is enough. No Enterprise edition requirement, no add-on. Business Premium covers the Intune and Entra ID P1 side, and Hello itself is a Windows feature. What it does need is a TPM 2.0, which every business-class machine of the last several years has.
Reversibility is conditional. Unassign the policy and Windows stops requiring Hello, but credentials already provisioned in the TPM stay provisioned and users keep signing in with them. Genuinely removing the credential is a per-device action. Treat enabling Hello as a decision you make once, not a setting you toggle while you think about it.
FIDO2 keys need their own switch. Setting Use security keys for sign-in here lights up the credential provider on the device; the key still has to be enabled as an authentication method in Entra ID before anyone can register one. Two settings, two places, both required.
👥 Assignment scope
Baseline for every 1:1 Windows device, including Cloud PCs. Kiosk, shared and IoT builds are excluded by design and are covered by their own sign-in configuration.
There is no exception group here and that is deliberate: "this user does not want Hello" is not a scenario, it is a preference. Users who genuinely cannot use biometrics fall back to the PIN, which is the same credential either way.
Worth verifying at tenant takeover: whether the enrollment-level Windows Hello setting is already set to something opinionated by a previous administrator, because it will quietly fight this policy until you set it back to Not configured.
🔗 Related
- 🔐🧑💼AMP - Authentication Methods: where FIDO2 and passkeys are enabled tenant-side.
- 🧱🪟💻ES - Windows LAPS: the local administrator half of account protection.
- 🚦🟢💻CA - Require Compliant Device 🪟: the access side of the same story.
The strongest thing you can do to a password is stop having one. Everything else is damage control. 🔑