NOTE: In case you’ve ignored my advice to read my previous blog first, please know we don’t implement the certificate-trust model. If you haven’t read my previous blog about enabling Windows Hello for Business I would strongly urge you to read it first to make sure you’ve completed all requirements. This blog will focus on enabling Windows Hello for Business hybrid based on the key-trust model for both Hybrid Azure AD Joined devices as Azure AD joined devices.

If you are using the latest Windows 10 / 11 builds (21H2) I would strongly recommend you to read this new blog to make use this new, simplified and improved Windows Hello for Business Hybrid cloud-trust model!Īs described in my previous blog, we have implemented Windows Hello for Business for Azure AD Joined devices without making sure you can use those same credentials to authenticate against on-premises Active Directory and access on-premise resources. Since 16-02-2022 a new Windows Hello for Business Hybrid deployment model has been made available called cloud-trust. If you do not select 'Do not start Windows Hello provisioning after sign-in', Windows Hello for Business automatically starts provisioning after the user has signed in.IMPORTANT NOTE: This blog post is referring to the Windows Hello for Business Hybrid key-trust model. If you select 'Do not start Windows Hello provisioning after sign-in', Windows Hello for Business does not automatically start provisioning after the user has signed in.

Select 'Do not start Windows Hello provisioning after sign-in' when you use a third-party solution to provision Windows Hello for Business. If you do not configure this policy setting, users can provision Windows Hello for Business as a convenience credential that encrypts their domain password. If you disable this policy setting, the device does not provision Windows Hello for Business for any user. If you enable this policy, the device provisions Windows Hello for Business using keys or certificates for all users. Windows Hello for Business is an alternative method for signing into Windows using your Active Directory or Azure Active Directory account that can replace passwords, Smart Cards, and Virtual Smart Cards.

Chinese (Traditional, Hong Kong S.A.R.).Español (España, alfabetización internacional)

Windows hello intune