This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(121.6, 56.00000000000001%, 21%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EMA%3C/text%3E%3C/svg%3E)
Hi ,
I am going to implement Windows hello for business in Intune. Please consider the below environment. Based on this, please let me know how can we perform end to end windows hello for business implementations? Please highlight the authentication method for Hybrid AAD whether this should be Key trust or PKI cert or cloud kerberos?
Devices - Co-Managed.
Domain- Hybrid Entra ID joined
Current Co-Manage Workload managed by Intune- Compliance
Thanks & Regards,
Muhammad Adeeb
There is no single correct answer for the authentication requirements. While the recommendation is to use cloud Kerberos tgt to minimise the complexities involved in implementing WHfB SSO for Entra Hybrid joined devices, however, if your organisation uses pki certificates for authentication as a security policy, then you may have to setup the same for WHfB as well.
Okay, Sure Rahul. Will check and configure accordingly. Will post query again if required.
Thanks Again
I would use Account Protection under Endpoint Security in Intune. You then would need to transfer the Configuration Control workload to Intune. If you don't want to do it, then go with Group Policies to enable Windows Hello for Business.
Thanks Pavel. Appreciate your response !!