Windows Hello for Business

How it works

At provisioning, the device creates a key pair. The private key stays in the TPM 2.0 chip, non-exportable; the public key is registered against the user's account in Microsoft Entra ID or Active Directory. Sign-in is a challenge signed by that private key. The PIN or the fingerprint does not authenticate you to anything remote, it unlocks the TPM locally, which is why a four-digit Hello PIN is stronger than a twelve-character password despite looking weaker.

That design gives two factors without a second device: something you have (this laptop, this TPM) and something you know or are. Biometric templates for face recognition, which needs an infrared camera, and for fingerprint stay on the device. Enhanced Sign-in Security isolates the biometric path in virtualization-based security on hardware that supports it.

Deployment model matters. Cloud Kerberos trust is the one Microsoft recommends and the one you should pick for new rollouts: the device gets a Kerberos ticket for on-premises file shares and print servers from Entra ID itself, using an Entra Kerberos server object published into Active Directory. No per-user certificates, no PKI to build. Key trust and certificate trust still exist and still require more infrastructure.

Hello is also the local authenticator behind passkeys and FIDO2 on Windows, which is how the same gesture now signs users into web apps.

Why it matters for a fleet

Credential theft is where most intrusions actually start, and a password hash replayed from another continent is the classic path. A Hello credential is bound to one piece of hardware, so the same attack needs physical possession of the laptop.

The operational catch: Hello is per-device. A user with a laptop, a desktop and a shared machine enrolls three times. Plan the fallback too, because a machine with no TPM or a broken camera falls back to a password, and if you have not set a policy it will do so quietly.

How Appaloosa handles it

An MDM provisions Hello through the Windows policy channel: turn it on for enrolled devices, require a TPM rather than allowing software keys, set PIN length and complexity, allow or block biometrics, and then report which machines have actually completed enrollment. Appaloosa manages Windows devices through that native channel alongside Autopilot enrollment, encryption checks and app delivery, all described on the Windows MDM page. Compliance rules can then treat a device as a real security signal instead of a name in an inventory.