MFA Misconceptions: Building a Truly Robust Authentication Process
Organizations must constantly re-evaluate and reinforce their cybersecurity strategies, ensuring that every aspect, including MFA, is as strong as the overall security posture.
Benchmark Your Organization's AD Management Against Like Organizations
Take our industry survey on Active Directory Management for a chance to win a $500 Amazon gift card.
Zero Trust and Enterprise Data Backup
Learn more about Zero Trust and how it applies to backup & recovery infrastructure, Zero Trust Data Resilience principles & architecture.
From Tech to Tactics: 6 Steps for IT Pros to Streamline Marketing Brand Initiatives
The power of email signatures—a critical marketing and sales tool—is often overlooked, leaving employees to manually update their own, risking brand inconsistency.

How to Enable Windows Hello for Business

Last Update: Sep 04, 2024 | Published: Sep 16, 2021

In this article, I’m going to show you how to enable Windows Hello for Business.

You should enable Windows Hello for Business to reduce the risk associated with passwords. Even if your users’ devices don’t have hardware that supports Windows Hello, like a fingerprint reader, you can still have them use a PIN to login.

Enabling Windows Hello for Business involves 3 steps. First you turn on Windows Hello for Business in Microsoft Endpoint Manager (MEM). Then you can configure any additional settings, like requiring devices to have a Trusted Platform Module (TPM). Finally, you assign the Windows Hello policy to a configuration profile.

What is Windows Hello for Business

Windows Hello for Business is a solution in modern versions of Windows. It lets users securely log into Windows and websites using a PIN or biometric gesture, like a fingerprint or facial recognition.

Microsoft says that PINs are more secure than passwords. Because the PIN is associated with the device only. And unlike passwords, Windows Hello PINs cannot be used on other devices. So, the PIN is useless to a hacker should it be discovered.

You can enable Windows Hello for all users from the Endpoint Manager Admin Center as shown here.

Click on Devices and under Device enrollment, click Enroll devices.
On the next window, select Windows Hello for Business.

3. On the Windows enrollment screen, set the value of Configure Windows Hello for Business to Enabled. You can also set the other options as per your organization’s needs, like requiring a TPM or setting PIN requirements.

You can also enable Windows Hello for specific users or groups. To assign your Windows Hello policy to specific users or groups:

Go to the Endpoint Manager Admin Center and going to Devices > Configuration Policies > Create Profile.
In the profile options, select the values as needed. Here, we have created a policy to be applied on Windows 10 and later OSes, and the template is ‘Identity protection’.

3. On the next window, select the users or groups to which this policy will be applied. And you must also select the conditions which will trigger this policy.

And that is it! Now you have enabled Windows Hello for Business for the users and groups you selected in your configuration profile.

Related Article: