Windows Hello - Centralize authentication

Question

Can we setup windows hello for business for Azure AD in such way that - if user created PIN with windows hello for his device, then that user can be login to another laptop with same windows hello PIN ?

Answer 1

Hello @Rishikesh Borawake

Thank you for reaching out. Unfortunately, what you are trying is not yet supported as Windows Hello for Business replaces passwords with strong two-factor authentication on devices. This authentication consists of a new type of user credential that is tied to a device and uses a biometric or PIN.

Windows Hello for Business =Windows Hello + the Asymmetric Authentication method (combines biometric and PKI mechanisms). It replaces passwords with strong two-factor authentication on PCs and mobile devices. And lets user authenticate to an Active Directory or Azure Active Directory account. This use of Windows Hello is unique to the device in which it’s setup. Basically, it means that if someone else knows the PIN you use to login to your Windows 10 device, that PIN is theoretically useless on another device, since that PIN is device specific and stored locally.

For more information you can review following articles:

• Windows Hello for Business Overview

• WHfB PIN is tied to the device

I hope this helps resolves your query.

----------

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.