Relution Signet Customer Hub

Windows Hello

Relution allows Windows Hello for Business to be configured in a policy for Windows devices. Windows Hello allows users to sign in with a PIN, facial recognition, or a fingerprint instead of a password.

Configuration

  • Tenant ID – ID of the Entra ID tenant in GUID format, required field.
  • Use a Trusted Platform Module (TPM) – restricts provisioning to devices with a usable TPM. Enabled by default.

PIN Policy

  • Minimum PIN length and Maximum PIN length (4–127 characters each, default: 4) – the maximum length must not be smaller than the minimum length. Without changes, this results in a fixed PIN length of 4 characters.
  • Lowercase letters in PIN, Uppercase letters in PIN, Special characters in PIN – each Allowed (default), Required or Not allowed
  • PIN expiration and PIN expiration (days) – enforces a PIN change after 1–730 days (starting with Windows 1511). The toggle is disabled by default, in which case the PIN does not expire; when enabled, 5 days are preset.
  • Remember PIN history and Size of PIN history – prevents reuse of the last 1–50 PINs (starting with Windows 1511). Enabled by default with 5 PINs; if the toggle is disabled, no PIN history is kept.

Biometrics and Recovery

  • Allow biometric authentication – enables sign-in via face or fingerprint (starting with Windows 1511). Enabled by default.
  • Use enhanced anti-spoofing, when available – additional protection for facial recognition (starting with Windows 1511). Enabled by default.
  • Enable PIN recovery – allows resetting a forgotten PIN (starting with Windows 1703). Enabled by default.
  • Certificate for on-premise resources – Windows Hello for Business uses a certificate to sign in to on-premises resources. When enabled, Windows Hello provisions the PIN only after the device has received a certificate from the management server, e.g. via the Certificates → configuration with the Certificate Key Location Windows Hello for Business. Enabled by default. Without such a certificate deployment, no PIN is provisioned; in this case, the option has to be disabled.

Options with a version note are only transferred to devices running the respective Windows version or later.