Why a password on the laptop is a weak spot
A password is a secret that works everywhere: on the laptop, in the browser and on any other computer in the world. Anyone who sees it, steals it through a fake sign-in page or finds it in a leaked list can use it. That is why MFA matters so much. But on the laptop itself employees still type their password dozens of times a week. That invites short passwords, notes under the keyboard and colleagues looking over their shoulder on the train.
What Windows Hello for Business does differently
During setup Windows creates a key pair on the laptop. The private part stays in the laptop’s security chip, the TPM, and cannot be copied out. The PIN, fingerprint or face recognition only unlocks that key. The PIN therefore never travels over the internet and works on no other device. Someone who sees the PIN gains nothing without the laptop itself.
Because the sign-in combines something the employee has (the laptop) with something they know or are (the PIN or biometrics), Windows Hello for Business counts as strong verification. Microsoft classes it as a phishing-resistant method, just like passkeys. After signing in, Outlook, Teams and SharePoint work without another password, because Windows passes the sign-in on.
PIN, fingerprint or face?
A PIN works on any laptop with a TPM chip, which covers almost every business laptop of recent years. Fingerprint and face recognition need a fingerprint reader or an infrared camera, as found on many business models. A regular webcam is not enough for face recognition. Biometric data stays on the laptop itself and is not sent to Microsoft. Even employees who use biometrics always set a PIN as a fallback.
A Windows Hello PIN can be longer and more complex than four digits. In Intune you set the minimum length, for example six characters, and whether letters and special characters are allowed or required. After a number of wrong attempts the TPM blocks further tries.
How to turn it on with Intune
Windows Hello for Business works most simply on laptops joined to Microsoft Entra ID and managed in Intune, for example through Windows Autopilot. In Intune you turn on Windows Hello for Business for the whole organisation or with a policy for a group, and set the PIN rules. At the first sign-in Windows then asks the employee to confirm their identity with MFA and set a PIN. They can add biometrics afterwards.
Start with a small test group, such as management or your IT contact, and then roll out per department. Explain beforehand what employees will see, so the request for a PIN is not reported as phishing. Combine it with BitLocker: the disk is then encrypted and the sign-in is bound to the device. With Conditional Access you can later even require administrators to sign in only with a phishing-resistant method.
Forgotten PIN, new laptop or a server still in the office
If an employee forgets their PIN, they choose I forgot my PIN on the sign-in screen. After an MFA check they set a new PIN themselves, without calling the helpdesk. On a new or reset laptop the employee sets up Windows Hello again; the old key does not work on the new device. If a laptop is lost or stolen, the PIN is worthless to a finder without the right chip, and you block the device in Intune.
If you still have a server or NAS in the office running Active Directory, access to those files needs an extra link, known as cloud Kerberos trust. That is often a good moment to think about retiring that server.
How Floor ICT handles this
Floor ICT first checks whether your laptops are ready: TPM chip, Windows version, Entra ID join and Intune management. We then set the PIN rules and the use of biometrics, test with a small group and roll out Windows Hello for Business per department, with a short explanation for employees. We set up self-service PIN reset, include Windows Hello in the rollout of new laptops and, where needed, arrange the link with an existing server. That way employees sign in faster and more securely, without a password on a sticky note.