🎯 Purpose
✅ Enable Windows Hello for Business so users sign in to Windows with a TPM‑backed PIN or biometrics instead of a password.
➡️ Required for the phishing‑resistant MFA used by the E8-MFA-M2 and M3 Conditional Access policies.
👥 Who is affected
✅ Devices: All Windows 10 / 11 devices
🚫 Exclusions: None
☁️ What is protected
✅ Windows sign‑in and Entra ID authentication from the device
✅ Type: Settings catalog › Windows Hello for Business (device scope)
🔐 How Windows Hello is enforced
Setting | Value |
Use Windows Hello For Business | True |
Require Security Device | True (keys stored in the TPM) |
Minimum / Maximum PIN Length | 6 / 127 characters |
Enable Pin Recovery | True (users can reset a forgotten PIN) |
Use Cloud Trust For On Prem Auth | Enabled (cloud Kerberos trust) |
Allow Use of Biometrics | True |
Facial Features Use Enhanced Anti Spoofing | True |
➡️ Credentials are bound to the device's TPM and cannot be phished or replayed from another device.
⚙️ What this policy does NOT enforce
🚫 PIN complexity (digits, upper/lower case, special characters)
🚫 PIN expiry or history
🚫 Conditional Access authentication strength (handled by the E8‑MFA policies)
🟢 Policy status
✅ Enabled
✅ Assigned to all devices
📘 Essential Eight Alignment
✅ Provides a phishing‑resistant MFA method for Essential Eight – Multi‑factor Authentication at Maturity Levels 2 and 3
ℹ️ Inforcer Best Practice control applied at all maturity levels
📘 Practical Interpretation (Executive‑Friendly)
This policy ensures that:
✅ Users sign in with a PIN, face or fingerprint
✅ Sign‑in keys never leave the device
✅ Stolen passwords can't be used to sign in
This is the foundation for passwordless, phishing‑resistant sign‑in on Windows.