Implementing an authentication solution based on Windows Hello for Business

In the previous section on passwordless authentication, we discussed how Windows Hello can be used by Windows 10 users for authentication by utilizing facial recognition. Windows Hello for Business allows the company to require users of Windows 10 devices to use this as the required authentication and monitor users. In this section, you will learn how to implement Windows Hello for Business as the authentication solution. Windows Hello for Business is configured within the Windows Active Directory domain controller, not Azure AD.

To implement Windows Hello for Business, multiple security groups are required. These security groups are the KeyCredential Admins security group and the Windows Hello for Business Users security group. If you are in a hybrid architecture with Windows Server 2016 domain controllers, the KeyCredential Admins group is created when you install the domain controller.

If your hybrid...