Glossary
Windows Hello for Business
A passwordless sign-in method that replaces passwords with a device-bound, TPM-protected key unlocked by a PIN or biometric gesture.
Windows Hello for Business replaces the password at Windows sign-in with an asymmetric key pair created on the device during enrollment. The private key is stored in the TPM where available and is unlocked locally by a PIN or a biometric gesture; the public key is registered with Microsoft Entra ID or Active Directory. Because the PIN never leaves the device and the key is bound to that hardware, a stolen PIN is useless on another machine and there is no reusable password for phishing kits to capture. For on-premises resources it uses one of several trust models: cloud Kerberos trust (the recommended option for hybrid deployments), key trust or certificate trust.
It matters because passwords remain the main input to phishing, spraying and credential reuse. Deploy it with Intune or Group Policy, require a hardware TPM, set sensible PIN complexity and anti-hammering, and pair it with Conditional Access so phishing-resistant sign-in is actually required. Keep a recovery process for lost devices and PIN resets.