Windows Hello for Business Hybrid with certificate, but without ADFS ???

Question

Hello!
There is a working model of Windows Hello for Business Hybrid keys, everything works fine! Kerberos via on-premises AD, PRT via Azure AD. But I really want pin-code authorization (SSO) and with RDP to work. Now everything is implemented through the beautiful Azure AD Connector. The main task is to provide WHfB users in the local network, i.e. Hybrid computers.
Question: How do I make the Windows Hello for Business infrastructure correctly without adding extra services (without ADFS)? Who in the local environment should issue clients the certificate (the CA itself)?) and how to configure it correctly?

There is an example of configuring a hybrid environment using ADFS certificates, but the presence of ADFS does not suit: hello-hybrid-cert-whfb-settings-pki
It looks like you need an Azure AD joined scheme based on certificates, but Intune and NDES are used here, and Intune is not available for hybrid computers, and NDES seems redundant hello-hybrid-aadj-sso-cert

Answer 1

The question can probably be considered closed
Windows Hello (Hybrid) + Key + RDP = Windows Defender Remote Credential Guard

This information is modestly mentioned in the article when planning Windows Hello
hello-planning-guide

Need it on every page Windows Hello (Hybrid) Key Trust remind about Windows Defender Remote Credential Guard :)
remote-credential-guard

Many thanks to @Pierre Audonnet - MSFT for his note about assigning rights - You just need regular RDP permissions (or example by being a member of the Remote Desktop Users local group of the target)

Answer 2

you can deploy Hybrid certificate trust without ADFS. But you need Intune and NDES as far as I know.

ADFS act as a Registration authority (RA) and NDES covers that.. however to get you enrolled into WHFB container. you need Intune SCEP connector

Which is defined in setup 11 on below doc
https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert

--> 11. Select Enroll to Windows Hello for Business, otherwise fail (Windows 10 and later) from the Key storage provider (KSP) list.

I don't know if any other way to skip that part without Intune.

Answer 3

So I fought this for the past three years, and 6 months ago or so I found the answer. I don't know why Microsoft feels the need to bury this stuff when its completely unnecessary. Key trust creates a simple key pair, but that private key in TPM(hw) or software can sign CSR's, which is how cert trust is really just an enlightened state of key trust. The problem is for most folks its a pretty ridiculous burden to add all this extra stuff, nevermind how active they are discouraging federation. Anyways your solution template can be found by looking at the code here (https://www.powershellgallery.com/packages/Generate-CertificateRequest/1.0) I have used it to essentially enlighten a .req with the appropriate template (the only reason you cant request certificate with same key in gui mmc is because it has no template on it) and pull directly from CEP/ADCS. Works on a pure AAD device too :). There is the smallest little snippet in the docs that lead me to this, they publish it under the guise of if you have a 3rd party CA, but its just goofy. https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-deployment-rdp-certs#using-non-microsoft-enterprise-certificate-authorities