Browse docs

Windows Hello

Introduction

Relution lets you configure Windows Hello for Business in a policy for Windows devices. Windows Hello allows users to sign in with a PIN, facial recognition, or a fingerprint instead of a password.

Configuration

  • Tenant ID – Entra ID tenant ID, required field.
  • A Trusted Platform Module (TPM) is used – restricts provisioning to devices with a usable TPM. Enabled by default.

PIN Policy

  • Minimum PIN length and Maximum PIN length (4–127 characters each)
  • Lowercase letters in PIN, Uppercase letters in PIN, Special characters in PIN – each Allowed/Required/Not allowed
  • PIN expiration and PIN expiration (days) – enforces a regular PIN change (starting with Windows 1511)
  • Remember PIN history and Number of remembered PINs – prevents reuse of old PINs (starting with Windows 1511)

Biometrics and Recovery

  • Allow biometric authentication – enables sign-in via face or fingerprint (starting with Windows 1511)
  • Use enhanced anti-spoofing when available – additional protection for facial recognition (starting with Windows 1511)
  • Enable PIN recovery – allows resetting a forgotten PIN (starting with Windows 1703)
  • Use certificate for authentication to on-premises resources – enables certificate-based sign-in to local resources.

Windows Hello for Business requires an Entra ID connection. Check the Microsoft documentation for the exact hardware (TPM version) and Windows version requirements.