Deployment of Windows Hello for Business through Intune

Tom Wrigglesworth 125

Hello everyone,

My firm is looking deploying WHfB and we have been reading about it and have some questions...

We have a DC 2012 & a DC 2016, running a 2012 schema.

The domain is sync'd with AAD and the devices are within Intune.

This is how we're planning to push it out, through a config profile rather than firm wide.

Do we need to change anything on-prem or in the cloud? The schema is a little old at this point

Do we need to have Cloud Kerberos?

What kind of WHfB does intune push out? Key/Cert When we turned the test users on, we got the error 'Your credentials could not be verified' for both pin & facial. We think we've missed a step but everything online says it's setup correctly.

1 answer

Crystal-MSFT 49,426 Reputation points Microsoft Vendor

2023-10-26T02:23:07.68+00:00

@Tom Wrigglesworth, Thanks for posting in Q&A. To deploy Windows Hello for Business through Intune, you need to configure a Windows Hello for Business policy and deploy it to the devices.

The Active Directory portion of the planning guide should be complete. Most of the conditions are baseline prerequisites except for your domain controllers. The domain controllers used in your deployment are decided by the chosen trust type.

https://video2.skills-academy.com/en-us/windows/security/identity-protection/hello-for-business/hello-planning-guide#using-this-guide

Meanwhile please ensure that your devices meet the minimum client requirements.

Windows Hello for Business can use either key trust or certificate trust, depending on your deployment's trust type.

https://video2.skills-academy.com/en-us/windows/security/identity-protection/hello-for-business/hello-hybrid-cloud-kerberos-trust-provision?tabs=intune#configure-windows-hello-for-business-policy

If you want to configure Windows Hello for Business settings with PIN, you can configure it via Identity protection policy or Settings catalog policy. Here is a link list the detailed settings for your reference:

https://video2.skills-academy.com/en-us/mem/intune/protect/identity-protection-windows-settings

Hope the above information can help.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Please sign in to rate this answer.
Tom Wrigglesworth 125 Reputation points

2023-10-26T07:09:39.8233333+00:00

@Crystal-MSFT We're wanting to use WHfB to sign in to laptops & desktops that are hybrid domain joined - would we need to setup hybrid deployment for this to work?

All our end user devices are running the latest version of Windows 10, the only compatability concerns is the schema and the 2012 DC.

We have setup the identity policy in Intune and the machines used for testing, are giving the error...

Something went wrong and your pin isn't available.

I've been reading online and some people say that cloud Kerberos is needed and some say it's not necessary - is there a preference for doing WHfB?

Crystal-MSFT 49,426 Reputation points Microsoft Vendor

2023-10-26T08:04:02.19+00:00

@Tom Wrigglesworth, Thanks for the reply. Based on my researching, to set up Windows Hello for Business for Hybrid Azure AD joined devices by using the key trust model or cloud Kerberos trust.

https://video2.skills-academy.com/en-us/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-provision?tabs=intune

https://video2.skills-academy.com/en-us/windows/security/identity-protection/hello-for-business/hello-hybrid-cloud-kerberos-trust-provision?tabs=intune

The key trust type doesn't require issuing authentication certificates to end users. Users authenticate using a hardware-bound key created during the built-in provisioning experience. This requires an adequate distribution of Windows Server 2016 or later domain controllers relative to your existing authentication and the number of users included in your Windows Hello for Business deployment. Read the Planning an adequate number of Windows Server 2016 or later Domain Controllers for Windows Hello for Business deployments to learn more.

The certificate trust type issues authentication certificates to end users. Users authenticate using a certificate requested using a hardware-bound key created during the built-in provisioning experience. Unlike key trust, certificate trust does not require Windows Server 2016 domain controllers (but still requires Windows Server 2016 or later Active Directory schema). Users can use their certificate to authenticate to any Windows Server 2008 R2, or later, domain controller.

From your description, I know we have windows server 2012 and windows server 2016 Domain controller. But AD schema is 2012. If we choose to set up Windows Hello for Business for Hybrid Azure AD joined devices by using the key trust model, then Cloud Kerberos is not necessary. But please upgrade the Domian Controller to windows server 2016

Before configuring, please also ensure all the prerequisites are met:

https://video2.skills-academy.com/en-us/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust#prerequisites

You can determine the status of the prerequisite checks by viewing the User Device Registration admin log under Applications and Services Logs > Microsoft > Windows.

https://video2.skills-academy.com/en-us/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-provision?tabs=intune#enroll-in-windows-hello-for-business

For the error, please check if it still exists after we upgrade all the domain controller to windows server 2016.

Crystal-MSFT 49,426 Reputation points Microsoft Vendor

2023-10-30T02:44:14.2566667+00:00

@Tom Wrigglesworth, Hope things are going well. if there's any update, feel free to let us know.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Deployment of Windows Hello for Business through Intune

1 answer

Your answer