Special characters in PIN – Allowed: same as for lowercase and uppercase, can be set to Required for complex PINs.Uppercase letters in PIN – allowed: same as for lowercase.Lowercase letters in PIN – allowed: if you want complex PINs you can also set this to Required.Maximum PIN length: 127 is the maximum number of PIN length.Minimum PIN length: you don’t want the end users to create too easy PINs, so we set a minimum to 6.If set to preferred, devices attempt to use a TPM, but if not available will provision using software. If set to required, only devices with an accessible TPM can provision Windows Hello for Business. Use a Trusted Platform Module (TMP) – Required: A Trusted Platform Module (TPM) provides an additional layer of data security.Navigate to Devices – Enroll devices – Windows Hello for Businessĭo take care though, these settings here apply to All Users, if you want to start enrolling this you should always work with a POC, you can also create a Configuration Profile for these settings and assign them at a group (Devices – Configuration Profiles – Create profile – Identity protection). Enable Windows Hello for Business in MEM (Intune) Azure AD Premium subscription – optional, needed for automatic MDM enrolment when the device joins Azure Active Directoryġ.Modern Management (Intune or supported third-party MDM), optional.Users can inadvertently expose their passwords due to phishing attacks.Passwords are subject to replay attacks.Server breaches can expose symmetric network credentials (passwords).Strong passwords can be difficult to remember, and users often reuse passwords on multiple sites.Windows Hello addresses the following problems with passwords: Windows Hello for Business lets user authenticate to an Active Directory or Azure Active Directory account. This authentication consists of a new type of user credential that is tied to a device and uses a bio metric or PIN. In Windows 10, Windows Hello for Business replaces passwords with strong two-factor authentication on PCs and mobile devices. Enabling multi factor unlock: face recognition + trusted device (smartphone) or PIN.Devices managed with MEM (Microsoft Endpoint Manager) – Intune.This article will describe how to setup Windows Hello for Business multi-factor unlock with Intune

Windows hello intune