OIT Office of Information Technology
| Menu

Microsoft 365 Multi-Factor Authentication - Set up Windows Hello for Business

Use these instructions to set up Windows Hello for Business (WHfB). To access and update your current Microsoft MFA settings, use the Find and Update Security Info tutorial. Learn more about Microsoft MFA.

Before you get started:

  • These instructions are for a Windows 11 Secure Computing device.
  • If you have multiple computers, you will need to setup WHfB separately on each of them.
  • Do NOT use your IdentiKey password as your PIN. Doing so significantly weakens the added security of using WHfB instead of a password to log into your computer.
  • Once you have set up WHfB, you will use your PIN, Face, or Fingerprint to log in. You will not need to use your IdentiKey password to log in anymore.
OS:
Layout:

Step 1

Open your Settings, click the Accounts section then Sign-in options. 

Step 2

The options available to you will depend on your device. In this tutorial we'll cover the following options: 

  • PIN allows you to sign in with a PIN number you create.
  • Facial recognition requires an infrared camera, which includes most modern laptop webcams. 
  • Fingerprint recognition will require a fingerprint sensor 

All options require a TPM – a microchip in your PC dedicated to creating and storing encryption keys – which all university-purchased Windows devices include. Setting up either Facial or Fingerprint recognition will also require you to set up a PIN as a backup method.

Step 3

PIN Set Up 

Expand PIN (Windows Hello) and click Set up. 

Step 4

Click OK to use Windows Hello with your account. 

Step 5

You will be prompted to verify your user credentials via your configured MFA method (in this example, with the Microsoft Authenticator app).

Step 6

Set and confirm a unique PIN. It must be at least an 8-digit number, but you can choose to include letters and symbols for complexity if you'd like.

This PIN is only valid on the device it is created on and will not be useable on any other device, and it is never sent to OIT or Microsoft. 

Click OK to confirm your PIN.

Step 7

You will get a confirmation that the PIN is set up. Click OK to exit.

Step 8

Facial Recognition Set Up

Expand Facial recognition (Windows Hello) and click Set Up. 

Step 9

Click Get started to begin the facial recognition scan. 

Step 10

Follow the on-screen instructions for distance, orientation, and lighting as it builds the algorithmic representation of your face. 

No image of your face is ever stored on the device or sent to OIT or Microsoft – it is only a mathematical representation that will be compared against future attempts.

Step 11

Before Facial recognition is enabled, you'll be asked to set up a PIN as a backup authentication method if you haven't already (for assistance, follow the PIN Set Up instructions above, starting with step 3). 

Step 12

Fingerprint Recognition Set Up

Fingerprint recognition setup is similar to Facial recognition. 

Click the Fingerprint recognition (Windows Hello) option then use the fingerprint sensor on your device to build an algorithmic representation of your finger that will be compared against future login attempts. 

As with facial recognition, no images of your fingerprint are stored on the device or sent to OIT or Microsoft.