#Microsoft intune windows 10 laptop how to

Note: Multifactor unlock does not support third-party credential providers or credential providers not listed in the above table.” That makes for example FIDO2 not supported as unlock factor. The credential providers included in the default policy settings are: Credential Provider

Signal rules for device unlock (defines second unlock credential provider).

Second unlock factor credential provider (second factor authentication).

First unlock factor credential provider (primary authentication).

The Multifactor Device Unlock policy consists of three components: Windows Hello for Business Supported Factors With the policy setting enabled, users unlock the device using at least one credential provider from each category before Windows allows the user to proceed to their desktop. Each of these components contains a globally unique identifier (GUID) that represents a different Windows credential provider.

You can configure Windows 10 to request a combination of factors and trusted signals to unlock your Windows 10 devices.įirst unlock factor credential provider and Second unlock credential provider are responsible for the bulk of the configuration. Since Windows 10 (1709) Windows offers Multifactor device unlock by extending Windows Hello with trusted signals. Windows, today, natively only supports the use of a single credential (password, PIN, fingerprint, face, etc.) for login or unlocking a device. Therefore, if any of those credentials are compromised (shoulder surfed), an attacker could gain access to your local device only. Because PINs are tied to the device and are stored locally, they are more secure than a password. Server breaches can expose symmetric network credentials, or users can inadvertently divulge their passwords to phishing attacks. Passwords can be difficult to remember, can be reused on multiple sites, and can sometimes be easy to guess.

Windows Hello credentials address many of the inherent problems with passwords. With Windows Hello, biometric authentication and recognition is easy with a face or fingerprint. This form of authentication relies on key pair credentials that can replace passwords and are resistant to breaches, thefts, and phishing. Windows Hello for Business is a private/public key or certificate-based authentication approach for organizations and consumers that goes beyond passwords. Windows Hello Multifactor Device Unlock provides multifactor device authentication for login or unlocking Windows 10 devices.

#Microsoft intune windows 10 laptop how to

In this blog post I’ll explain how to configure and enable Windows Hello Multifactor Device Unlock using Microsoft Intune.