Windows Hello for Business
Windows Hello for Business is an enterprise authentication method that uses a device-associated cryptographic credential, unlocked through a PIN or biometric gesture, to authenticate a user.
Why a PIN can replace a password
The PIN unlocks a credential on that device. It never goes to the website as a reusable sign-in secret. Windows Hello for Business combines possession of the device’s credential with a PIN or biometric check, so a single visible gesture can satisfy two factors.
During provisioning, the user establishes the credential with their organization’s identity provider. Later sign-ins use that credential. Microsoft supports organizational accounts in Entra ID and Active Directory; the deployment determines how that trust works.
Keep enrollment separate from sign-in
Phishing-resistant sign-in helps protect an existing credential. It does not answer whether a newly enrolled credential belongs to the right person. After an account recovery, compare the device and credential records with the approved enrollment. An unfamiliar credential needs an explanation even if it uses a strong authentication method.
The recovery guide covers that handoff. The PRT introduction explains how Windows sign-in connects to single sign-on afterward.