Windows Hello for Business
Microsoft’s passwordless sign-in for Windows. Instead of passwords, users rely on biometrics (face, fingerprint) or a PIN, secured locally by the TPM. Phishing-resistant, GDPR-friendly, user-friendly — and currently the standard recommendation for the modern workplace.
What is Windows Hello for Business?
Windows Hello for Business (WHfB) is a passwordless authentication mechanism for Windows. Rather than sending passwords to services, WHfB uses:
- a private key stored in the device’s TPM chip (never transferable)
- a public key registered in Entra ID or AD
- an “unlock gesture” (biometrics or a PIN) that releases the private key for a challenge-response
The result: users never enter a password that could be stolen. The biometrics or PIN never leaves the device — it only unlocks the local key.
Wichtig: WHfB is not the same as consumer Windows Hello. The consumer version is merely a local convenience feature. WHfB, by contrast, is an enterprise-wide authentication infrastructure tied to Entra ID or AD.
WHfB is inherently multi-factor
A point often overlooked: WHfB is MFA by its nature — because it always combines two factors:
| Factor category | What? |
|---|---|
| Something you have | The device, with its TPM and registered key |
| Something you are (biometric mode) | Face or fingerprint |
| Something you know (PIN mode) | Der lokale PIN |
That is why Entra ID recognises WHfB as strong authentication and does not ask for additional MFA (in most CA policies).
The three WHfB deployment models
| Model | Identity backbone | Complexity |
|---|---|---|
| Cloud-only (Entra-Joined) | Entra ID only | Simple |
| Hybrid Cloud Kerberos Trust | AD on-prem + Entra | Medium |
| Hybrid Key Trust (deprecated) | AD on-prem + Entra | Komplex, legacy |
| Hybrid Certificate Trust (deprecated) | AD on-prem + Entra + ADFS | Very complex, legacy |
| On-Prem Only | AD only (no cloud tenant) | A special case |
Recommendation for new setups: cloud-only where possible. For hybrid scenarios: Cloud Kerberos Trust (the newest model, since 2022). The older trust models are being phased out.
Windows Hello in the AVD and Windows 365 context
WHfB works for Cloud PCs and AVD sessions — but only once you understand the mechanics.
WHfB on the device, not in the Cloud PC
The biometrics (face, fingerprint) are captured on the local device , not in the cloud session. That is a technical necessity: the TPM chips holding the keys are local.
How it still works seamlessly
- The user starts their device and unlocks it with Windows Hello (biometrics → TPM → local key)
- The Windows session on the device is open and an Entra token is present
- The user starts the AVD client or the Windows 365 app
- Single sign-on signs them into the Cloud PC automatically — the local Entra token is used
The user therefore never passes a password to the Cloud PC. The biometrics have stayed safely on the local device.
Single sign-on for RDP and AVD has been officially supported since 2023. With Entra-joined session hosts and single sign-on enabled in the provisioning policy, signing in to the Cloud PC goes through without a password prompt — the best passwordless DaaS experience available.
WHfB vs. FIDO2-Keys vs. Authenticator-App
| Method | Device-bound | Phishing-resistant | User comfort |
|---|---|---|---|
| WHfB | Yes (bound to the device) | Yes | Very good |
| FIDO2 Security Key | Yes (a physical USB or NFC key) | Yes | Good (when the key is to hand) |
| Microsoft Authenticator (Passwordless) | Yes (smartphone) | Yes | Very good |
| Password + SMS/TOTP MFA | No | No (SMS phishing) | Medium |
A combination is often ideal: WHfB as the standard for daily sign-ins, FIDO2-Key as a break-glass account backup, Authenticator for signing in from a smartphone.
Passwortlos in DaaS Maps
DaaS Maps shows Windows Hello integration for passwordless DaaS workflows. For architectural discussion of passwordless authentication, you will find me on LinkedIn.