EIDAUTH-009: Windows Hello for Business Configuration
- Platform
- Entra ID / M365
- Category
- Entra ID Authentication Methods & MFA
- Severity
- Medium
- Zero Trust pillar
- Identity (weight 3)
- Golden fixtures
- 3
- Branch coverage
- Observed: fixtures prove the verdicts they exercise
- Provenance
- baseline
What it checks
Windows Hello for Business provides phishing-resistant, hardware-backed authentication using biometrics or PIN tied to the device TPM. Misconfigured WHfB deployments may fall back to weaker convenience PIN without proper TPM attestation, reducing security guarantees. The configuration should enforce TPM-backed keys and appropriate biometric policies.
Recommended value
Windows Hello for Business enabled with TPM requirement enforced and multi-factor unlock configured for sensitive roles
Remediation
Navigate to Entra ID > Protection > Authentication methods > Windows Hello for Business. Enable the method and configure key restrictions to require TPM-backed keys. Deploy WHfB configuration profiles via Intune to enforce TPM attestation and PIN complexity requirements across managed devices.
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| clean | PASS |
| known-bad | WARN |
| throttled | Not Assessed |
Framework mappings
- NIST SP 800-53
- IA-2(6)
- CIS M365 Benchmark
- 5.2.3