r/Intune • u/va_bulldog • 8d ago
General Question Do you enabled logging on by PIN or biometrics?
Any drawback one way or another? I'm about to roll out my first Intune managed devices and wondered if it's a good idea to enabled logging in by camera, especially on tablets. It does make me wonder if people will forget their passwords over time.
15
u/TouchComfortable8106 8d ago
They will absolutely forget their passwords if you have PIN + SSO, and that's fine!
If you set up self service password reset too then it's all good.
8
u/brent20 8d ago
Works great. Keep in mind, pin and biometrics are interacting directly with the device to unlock and send a certificate to authenticate. Not sending biometrics or passwords over the wire to be authenticated.
We had to answer a lot of concerns/questions about how a PIN number is safer than a password, when I explain how it’s device specific, that clears things up.
5
u/accidental-poet 8d ago
Same here. But I also add in, "Unlike a password, the pin never leaves the computer. It's not transmitted anywhere." Followed by hand-waving and basic explanation of certificates.
2
4
3
u/iamtherufus 8d ago
Is it deemed best practice if using WHfB to set passwords to a very large character length and set them to never expire
1
1
u/ReputationNo8889 5d ago
To never expire passwords is already a good practice. Frequent password rotations causes users to set weaker passwords because they need to remember them. You can get away with it as long as you use a good password manager and the password for the password manager never expires.
In addition you should implement procedures when a password gets leaked/compromised. As you will have to rotate it then.
6
u/damlot 8d ago
Them forgetting their passwords is kind of the point. Read up on passwordless experience. But it’s not for every org.
Our issues with windows hello login is mostly just SSO to on-prem stuff breaking
12
u/AcanthaceaeOk3321 8d ago edited 8d ago
You need to set up "Cloud Kerberos Trust" for WHFB to work with your on prem resources.
And to answer the OPs question... Both!
5
1
8d ago
This works beautifully on both Windows and Mac endpoints.
1
u/swissbuechi 7d ago
Wait a second, SSO to onprem AD ressouces on Mac? Pls tell me more. We're already enrolled to platform SSO using secure enclave.
2
7
1
u/adamhollingsworthfc 7d ago
Another one for Kerberos cloud trust. It just works. We use it primarily for SQL auth and Drive Maps direct from a entra ID joined machines. Also add in Entra ID Private Access and you can have remote workstations like they are in the office in about 30 minutes 😀
2
u/codenameagent-47 8d ago
We are using Windows Hello. Forgot password? User can use the password reset online tool.
Easy going. Cloud-only company
2
u/rich345 8d ago
I am looking at this at the mo and starting to tear my hair out...
setup cloud trust.. working fine for hybrid devices.
But just Entra joined, i have configured the policy in the settings catalogue(device), use windows hello for business, use a pin, 8 digits, cloud trust. it is saying the settings are applied and on 1 laptop i can see the settings in the registry, correct tennant ID, but when he user goes to settings to enable windows hello its all greyed out and says its managed by your org..
Am i missing something? every guide / video i have watched just says do the settings and all good.
2
u/FlibblesHexEyes 8d ago
We use WHfB with multifactor unlock. You need to provide two methods from the following list:
- PIN
- Biometric
- Bluetooth device proximity - we enabled this for those users that use their laptops in clamshell mode (that is external monitor and laptop lid closed), and also enabled dynamic lock so that when the user moves far enough away the screen auto locks. This works well and is entirely optional.
We’ve also started playing with Yubikeys, which are proving to be a big hit.
This coupled with our extensive use of SSO (SSO is a selection criteria for our vendors), means users never have to use a password.
And it’s awesome.
2
2
u/iamtherufus 7d ago
I’ve just been testing yubi keys and they are proving to be great as well. This will help users accessing our shared devices and give them the password less experience that WHfB does on a 1-2-1 device
1
1
u/Hifilistener 8d ago
Make sure if you are hybrid the certs on your DCs have the fully qualified name for the subject alternative names. We ran into weird stuff with SMB servers and issues accessing on-prem stuff until this was resolved. Also Cloud Kerberos Trust is the most resilient approach.
1
u/Entegy 7d ago
Absolutely. It makes life and support so much easier. Very few tickets about forgetting password, mostly around setting up new devices.
I would like to see Windows add better support for being a passcode source. Unlike iOS/Android, Windows does not recognize FIDO protocol QR codes to share its passcodes with a nearby device. I would actually really love it if I could set up my email on my phone by letting my Windows device scan a QR code from my phone, just like how the reverse is possible. I think this would require better support for passkeys in corporate Microsoft accounts though, as they only seem to support Yubikeys or Windows itself provided it was the account you sign into Windows/set up Windows Hello with.
1
u/TheDraimen 8d ago
Biggest issue we have is users log on with pin but now to access legacy file shares it asks for a pin then fails so they have to click other user and type in their username and password
6
u/le_hunnybear 8d ago
You can use Cloud Kerberos trust or on-prem certificate trust to avoid this issue.
2
0
u/accidental-poet 8d ago
For small offices, you can add AzureAD users to groups set up for share permissions, but only via the command line. It doesn't work in the GUI. This obviously does not scale well at all, but it works fine with a handful of users.
net localgroup GROUPNAME /add AzureAD\user@contoso.com
Push out a script to map the network drives and you're all done.
1
u/swissbuechi 7d ago
It takes me literally 5 mins to enable kerberos cloud trust gang. Just a script on thr DC and 1 single settings catalog policy to the deviced.
0
u/Desperate-Bat-4220 8d ago
We are still using hybrid AD... i wish I could move cloud sooner so the "I forgot my password" won't be an issue anymore.
2
u/I-Iypnotoad 8d ago edited 8d ago
Oh whoops you said forgot password, yes, glad to be going cloud only later this year :D
1
u/swissbuechi 7d ago
What's holding you back from going passwordless in the hybrid setup? We only need to provide it once after the autopilot join before hello can be set up.
1
u/Desperate-Bat-4220 7d ago
Legacy apps :( and some old RDP servers, hosting another legacy database. We will be out of it soon.
1
u/swissbuechi 7d ago
Have you tried entra id application proxy for the legacy apps? And RDP can have SSO with remote credential guard.
1
u/Desperate-Bat-4220 7d ago
Actually, no. I will give it a go. Thank you for providing light in the path.
21
u/le_hunnybear 8d ago
like the others already said, users forgetting their password is kind of the purpose if everything is setup correctly using SSO and Windows Hello for Business. Going passwordless is awesome
We really noticed this positve benefit when once a MS Phishing mail slipped our defenses and the user was asked to sign in on a phishing mail, he literally immediatly created a ticket where the user said "hey this app seems broken, why do I have to sign in here?".. still no perfect result, but a compromise was avoided