Passwordless authentication using Windows Hello For Business (WHFB) with Microsoft product group

Deep Dive livestream on going passwordless using Windows Hello For Business (WHFB) and learn about cloud Kerberos. As organizations move toward passwordless authentication for better security and user experience, learn more details from the questions and answere shared in this livestream with the Microsoft product groups.

00:00 Introduction
04:10 Background (AuthN methods, WHfB)
05:48 Where to start
06:52 WHfB trust types and deployment models
13:04 Cloud Trust deployment steps
21:48 How cloud Kerberos trust works
27:33 In depth Demo (All the magic behind)
52:48 Recap!

[KylePMoore]

This video just saved our implementation of WHfB. I was able to Wireshark the domain controller thanks to JJs walkthrough and found that Windows Hello was only trying certificate authentication, even through the relevant setting was 'not configured'! I forced it to Disabled and we're off to the races. Can't thank you enough!

[hasanreza]

Amazing, So nice, I luv the guy with the French bread

[vaibhavmane]

Awesome Demo @JJ and thanks for the Microsoft YT channel. Would like to see more CKT videos like this.😇

[yassinesouabni]

Great presentation - all clear - thank you !

[testhschredl]

Great video, would love to see a video on how toToubleshoot the PRT!

[csmith]

@ 15:18, you talk about TAP not working for enrollment while on hybrid-joined devices; is that shortcoming going to be addressed, or should we still be looking to migrate to just AADJ?

[infoseccloud]

Great video and presentation, it's really helpful. Is it possible to share the PPT? Thanks guys!

[Beni]

Is Offline login possible too?
I mean after the first login with LoS with DC, let's say I take my laptop somewhere i don't have internet connection, will I be able to login with PIN/Fingerprint...

[MrMarcLaflamme]

Is there a way to enable WHfB but not force users to register (was looking for an option in Intune but I think it's only in a GPO - Do not start provisioning after sign-in?)? In the pilot I'm working on any user who is added to the config profile to enable WHfB is automatically prompted to setup Hello the next time they log in. We want to enable the feature but give users the choice in the beginning. Any new device they receive is AAD joined and automatically enabled but for the hybrid users we don't want that due to the DC LoS requirement.

[prathapkalluri]

Hello @JJ, I have configured the GPO for Hybrid deployment but it is taking the fingerprint and asking for the second factor authentication. Second Factor Auth is not working in my case giving the below error, can you please give some insights on this.

[tedzhang]

When running set-AzureADKerberosServe, I am getting error set-AzureADKerberosServer r : Failed to read secrets from the domain "my_domain". There is a computer object created on-prem but Clouddisplayname, clouddomaindnsname, etc are all empty when running get-AzureADKerberosServer. Any ideas?

[gabrielbigger]

How does RDP work with WHfB? is the only option certificate trust to go passwordless?