Windows Hello Enhanced Sign-In Security Now Supports External Fingerprint Readers
New support allows desktop PCs and docked laptops to use TPM-protected biometric authentication.
Key Takeaways:
- External fingerprint readers can now work with Windows Hello Enhanced Sign-In Security.
- ESS protects biometric authentication using TPM and Virtualization-Based Security.
- This update is rolling out to Windows 11 versions 24H2 and 25H2.
Microsoft is making passwordless sign-ins more secure and accessible for desktop users by extending Windows Hello Enhanced Sign-in Security (ESS) to compatible external fingerprint readers. This update enables hardware-backed biometric authentication on more Windows 11 devices, which helps protect sensitive data from sophisticated cyberattacks.
Windows Hello Enhanced Sign-in Security (ESS) is an advanced security feature in Windows 11 that strengthens biometric sign-ins by creating a protected pathway between users’ fingerprint reader or facial recognition camera and the operating system. ESS uses hardware-backed protections, such as the Trusted Platform Module (TPM) and Virtualization-Based Security (VBS), to isolate sensitive biometric data and authentication processes from potential malware and unauthorized access. This capability makes it harder for an attacker with elevated privileges to intercept, manipulate, or spoof biometric credentials.
Previously, devices with built-in fingerprint sensors could take advantage of enhanced Sign-in Security (ESS). However, users with external USB fingerprint readers often couldn’t access the same level of protection. Consequently, desktop users and those with docked laptops had to choose between the convenience of biometric sign-in and the stronger security safeguards provided by ESS.
How does Enhanced Sign-in Security protect biometric authentication?
Microsoft’s latest update (KB5101684) addresses this gap by allowing compatible external fingerprint readers to work within the ESS framework. This release brings secure, passwordless authentication to a much wider range of Windows 11 devices.
“Windows Hello Enhanced Sign-in Security (ESS) now supports external fingerprint sensors. With this update, this secure sign-in option extends beyond devices with integrated fingerprint sensors to desktop PCs and other Windows 11 PCs, including Copilot+ PCs. To get started, connect a supported ESS fingerprint reader,” Microsoft explained.
What this update means for IT administrators
Microsoft has started rolling out this optional update to PCs running Windows 11 versions 25H2 and 24H2. Users can get started with fingerprint authentication by connecting a reader that supports Enhanced Sign-in Security and configuring it under Settings > Accounts > Sign-in options.
For IT administrators, this update simplifies the task of balancing security and user convenience. With support for ESS-certified external fingerprint readers, IT teams can now deploy passwordless authentication more broadly without weakening security policies. It helps organizations improve user experience while maintaining stronger protection against credential theft and biometric-related attacks.
Rabia has a master's degree in Software Engineering and she has years of experience writing professionally about Microsoft products and other technologies. Rabia has also written for OnMSFT.com as well as Windows Report. She is always up to date on t...
