Architektur & Endpoint · Glossar

Windows Hello for Business

Microsoft’s passwordless sign-in for Windows. Instead of passwords, users rely on biometrics (face, fingerprint) or a PIN, secured locally by the TPM. Phishing-resistant, GDPR-friendly, user-friendly — and currently the standard recommendation for the modern workplace.

At a glance
2015
Introduced with Windows 10
TPM 2.0
Hardware-backed
Phishing-resistant
Never transmitted
FIDO2
Compatible

What is Windows Hello for Business?

Windows Hello for Business (WHfB) is a passwordless authentication mechanism for Windows. Rather than sending passwords to services, WHfB uses:

  • a private key stored in the device’s TPM chip (never transferable)
  • a public key registered in Entra ID or AD
  • an “unlock gesture” (biometrics or a PIN) that releases the private key for a challenge-response

The result: users never enter a password that could be stolen. The biometrics or PIN never leaves the device — it only unlocks the local key.

Wichtig: WHfB is not the same as consumer Windows Hello. The consumer version is merely a local convenience feature. WHfB, by contrast, is an enterprise-wide authentication infrastructure tied to Entra ID or AD.

WHfB is inherently multi-factor

A point often overlooked: WHfB is MFA by its nature — because it always combines two factors:

Factor categoryWhat?
Something you haveThe device, with its TPM and registered key
Something you are (biometric mode)Face or fingerprint
Something you know (PIN mode)Der lokale PIN

That is why Entra ID recognises WHfB as strong authentication and does not ask for additional MFA (in most CA policies).

The three WHfB deployment models

ModelIdentity backboneComplexity
Cloud-only (Entra-Joined)Entra ID onlySimple
Hybrid Cloud Kerberos TrustAD on-prem + EntraMedium
Hybrid Key Trust (deprecated)AD on-prem + EntraKomplex, legacy
Hybrid Certificate Trust (deprecated)AD on-prem + Entra + ADFSVery complex, legacy
On-Prem OnlyAD only (no cloud tenant)A special case

Recommendation for new setups: cloud-only where possible. For hybrid scenarios: Cloud Kerberos Trust (the newest model, since 2022). The older trust models are being phased out.

Windows Hello in the AVD and Windows 365 context

WHfB works for Cloud PCs and AVD sessions — but only once you understand the mechanics.

WHfB on the device, not in the Cloud PC

The biometrics (face, fingerprint) are captured on the local device , not in the cloud session. That is a technical necessity: the TPM chips holding the keys are local.

How it still works seamlessly

  1. The user starts their device and unlocks it with Windows Hello (biometrics → TPM → local key)
  2. The Windows session on the device is open and an Entra token is present
  3. The user starts the AVD client or the Windows 365 app
  4. Single sign-on signs them into the Cloud PC automatically — the local Entra token is used

The user therefore never passes a password to the Cloud PC. The biometrics have stayed safely on the local device.

Single sign-on for RDP and AVD has been officially supported since 2023. With Entra-joined session hosts and single sign-on enabled in the provisioning policy, signing in to the Cloud PC goes through without a password prompt — the best passwordless DaaS experience available.

WHfB vs. FIDO2-Keys vs. Authenticator-App

MethodDevice-boundPhishing-resistantUser comfort
WHfBYes (bound to the device)YesVery good
FIDO2 Security KeyYes (a physical USB or NFC key)YesGood (when the key is to hand)
Microsoft Authenticator (Passwordless)Yes (smartphone)YesVery good
Password + SMS/TOTP MFANoNo (SMS phishing)Medium

A combination is often ideal: WHfB as the standard for daily sign-ins, FIDO2-Key as a break-glass account backup, Authenticator for signing in from a smartphone.

Passwortlos in DaaS Maps

DaaS Maps shows Windows Hello integration for passwordless DaaS workflows. For architectural discussion of passwordless authentication, you will find me on LinkedIn.