The table shows the minimum requirements for each deployment.

Reset above lock screen - Windows 10, version 1709, Professional.

Reset from settings - Windows 10, version 1703, Professional.

On-premises deployments support destructive PIN reset that works with both the certificate trust and the key trust models.

Reset above lock screen ( I forgot my PIN link) - Windows 10, version 1903.

There is no licensing requirement for this service since version 1903

Microsoft PIN Reset Service - Windows 10, versions 1709 to 1809, Enterprise Edition.

Hybrid deployments support non-destructive PIN reset that works with both the certificate trust and key trust models. Windows Server 2012 or later Network Device Enrollment ServiceĪzure AD Premium, needed for device write-backĪzure AD Premium, optional for automatic MDM enrollment Windows Server 2012 or later Network Device Enrollment Service (Azure AD joined) Windows Server 2016 AD FS with KB4088889 update (hybrid Azure AD joined clients), Windows Server 2012 or later Certificate Authority Windows Server 2008 R2 or later Domain Controllers Windows Server 2016 or later Domain Controllers Windows Server 2008 R2 Domain/Forest functional level Key trustīest experience: Windows 10, version 1709 or later (supports synchronous certificate enrollment). More information will be available on Windows Hello for Business cloud trust once it is generally available. This trust model will enable deployment of Windows Hello for Business using the infrastructure introduced for supporting security key sign-in on Hybrid Azure AD joined devices and on-premises resource access on Azure AD Joined devices. Windows Hello for Business is introducing a new trust model called cloud trust in early 2022. For key trust in a multi-domain/multi-forest deployment, the following requirements are applicable for each domain/forest that hosts Windows Hello for business components or is involved in the Kerberos referral process.

Azure AD Premium subscription - optional, needed for automatic MDM enrollment when the device joins Azure Active Directory.

Modern Management (Intune or supported third-party MDM), optional.

Windows 10, version 1511 or later, or Windows 11.

This article lists the infrastructure requirements for the different deployment models for Windows Hello for Business.

Windows Hello for Business Deployment Prerequisite Overview

Verify identity windows 10