Windows Hello for Business

Question

Windows Hello for Business

Michael Peralta 251

Looking at my options in deploying WHFB,

https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-identity-verification

it states that cloud kerberos has optional P1 license. My requirement is that I need WHFB with 2FA. Under what circumstances do I need P1, because putting it there as optional makes me worried if I choose this approach, and suddenly i miss something out.

0 comments

Answer accepted by question author

0 additional answers

Your answer

Answer 1

Nagappan Veerappan 656 Microsoft Employee

WHFB certificate trust has hard dependency on premium license as it need device writeback.

All other WHFB doesn't have any license dependency, As long as users can perform MFA to provision the WHFB credentials.
https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-licensing#azure-ad-free-tier

If you want to use CA, IDP ..etc you need P1 license to start with.

Hope this helps. Feel free to let me know if you have any questions.

Please remember to "Accept Answer" if answer helped, so that others in the community facing similar issues can easily find the solution.

Thanks
Nagappan V

Michael Peralta 251 Reputation points

2023-08-30T15:45:37.5766667+00:00

I understand that if CA is reqired, Premium license is required. I thought so that Cloud Kerberos don't need this. But still, they put it as optional. I was hoping to find out, what are the optional features typically used with WHFB with CA?
Givary-MSFT 35,786 Reputation points Microsoft Employee Moderator

2023-08-30T16:14:25.9633333+00:00

@Michael Peralta Thank you for raising this query, will work with my team to correct the document, so that deployment part with respect to license is clearly understood.

Share via

Windows Hello for Business

0 additional answers

Your answer