Passwordless - Cloud Kerberos Trust benefits in Hybrid Join Devices

Question

Hi all,

I cannot understand the real benefits of using Cloud Kerberos Trust on Hybrid Joined devices.

In a device hybrid joined, I'm already able to access both Entra ID and Active Directory resources (for the last one, with a Kerberos ticket released by a Domain Controller). Which benefits can give me the Cloud Kerberos Trust?

Thank you in advantage.

Best regards,

Emanuele

Answer 1

Lower administration for one:

https://techcommunity.microsoft.com/t5/windows-it-pro-blog/windows-hello-for-business-hybrid-cloud-kerberos-trust-is-now/ba-p/3651049

Answer 2

You dont need to configure it , though IMO the biggest advantage is described here:

https://learn.microsoft.com/en-us/entra/identity/authentication/howto-authentication-passwordless-security-key-on-premises

Answer 3

Hello

Cloud Kerberos Trust mainly provides the advantage of simplifying the deployment of Windows Hello for Business and supporting password -free login experience. This trust model uses the security keys to support Hybrid Azure AD to support Hybrid Azure AD and the infrastructure introduced by local resource access, reducing additional deployment requirements. Specifically, Cloud Kerberos Trust allows users to use Azure Ad Kerberos to synchronize the access of local resources in the mixed environment without complicated public key infrastructure (PKI) and Azure Ad Connect.

 

In addition, Cloud Kerberos Trust also provides the following benefits:

 

Simplified deployment: Compared with traditional key trust and certificate trust deployment model, Cloud Kerberos Trust does not need to maintain complex PKI or wait for Azure Adnect to synchronize.

Password -free security: By using Cloud Kerberos Trust, it can achieve a safer non -password authentication method, which is safer than traditional passwords.

Modern identity verification: Cloud Kerberos Trust supports modern and powerful two -factor authentication methods that use at least two unique factors, such as what users know (PIN) or the biological characteristics of users, combined with what they have (physical visits to the equipment (physical access to the equipment To.

Improve user experience: Users can log in more conveniently to device and cloud services.

Reduce the dependence on the regional controller: Through Cloud Kerberos Trust, Azure AD can generate some Kerberos tickets to grant tickets (TGT), thereby reducing dependence on regional controllers.

Best Regards,

Yanhong Liu

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.