Deploying Windows Hello for Business: choosing the right trust model and planning recovery
Windows Hello for Business is often the simplest way to roll out phishing-resistant authentication across Windows devices. Yet we regularly come across half-finished deployments: a trust model that does not suit the hybrid environment, a weak PIN, no reset procedure. These are the decisions to make before switching it on.
Why Windows Hello for Business is phishing-resistant
Windows Hello for Business relies on an asymmetric key pair generated on the device, whose private key is protected by the TPM and never leaves the machine. The PIN or biometric gesture is not sent over the network: it only unlocks local use of that key. There is therefore no reusable secret that a phishing site could capture and replay.
This is why Entra ID classes it as a phishing-resistant method, alongside FIDO2 security keys and certificate-based authentication, and why it can satisfy an authentication strength requiring that level in Conditional Access. A short PIN does not contradict this: it is only meaningful on one specific device, and the TPM limits guessing through its anti-hammering protection.
Choosing a trust model
For devices joined only to Entra ID with no need to reach on-premises resources, the question does not arise. As soon as users need Kerberos tickets from Active Directory, a model has to be chosen:
- Cloud Kerberos trust: Entra ID issues a partial ticket that domain controllers exchange for a full one. No public key infrastructure is required and there is no key synchronisation delay. It is Microsoft's recommended model for new hybrid deployments; it requires creating an Entra Kerberos server object in each domain and up-to-date domain controllers.
- Key trust: the public key is synchronised to Active Directory by Entra Connect. Domain controllers need suitable certificates, and a synchronisation delay separates enrolment from the first possible sign-in.
- Certificate trust: a user certificate is issued based on the Windows Hello key. Heavier to run, it is mainly justified by specific needs such as certificate-based authentication over Remote Desktop.
One point to watch. The Entra Kerberos server object holds sensitive keys, comparable to those of the krbtgt account. Their rotation must be planned, and the accounts able to manage them must be treated as Tier 0.
PIN policy and biometrics
Settings are defined in Intune, either tenant-wide at enrolment or through targeted policies, which are preferable for keeping control. Decide on: minimum length (six digits is a reasonable minimum), optional complexity, blocking simple sequences, and requiring a hardware TPM. For biometrics, Enhanced Sign-in Security, available on compatible hardware, isolates the processing of biometric data. Avoid allowing Windows Hello without a TPM: key protection then relies on software.
The rollout works best in waves: a pilot group made up of the IT team, then volunteer departments, before going organisation-wide. The pilot surfaces the usual surprises: older devices without TPM 2.0, cameras that do not support facial recognition, business apps that still prompt for a password, file share access failing because Kerberos is not configured correctly. A short message to users explaining that the PIN is not a password and only works on their own device noticeably reduces helpdesk calls.
Reset and recovery
A forgotten PIN should not mean a helpdesk ticket every time. The Microsoft PIN reset service allows a non-destructive reset after strong user authentication; it must be enabled and consented in the tenant. Without it, the reset is destructive and the user must re-enrol. Also plan for users changing devices or receiving a rebuilt machine: a Temporary Access Pass allows passwordless enrolment on the new device.
Limits to be aware of
Windows Hello for Business does not remove the password: it still exists and remains usable unless something restricts it. The next step is to reduce password use, for example by enabling the Windows passwordless experience and requiring phishing-resistant methods in Conditional Access. Remote Desktop also needs particular attention depending on the chosen model; check the current documentation before deciding.
What an audit checks
- The trust model deployed and its consistency with the hybrid environment.
- Management of the Entra Kerberos server object: presence in each domain, key rotation, administrative rights.
- The PIN policy, the hardware TPM requirement and biometric configuration.
- Whether the PIN reset service is enabled, and the re-enrolment procedures.
- The share of sign-ins actually performed with Windows Hello, and lingering password sign-ins.