--- title: Identity - Windows Hello for Business slug: identity-windows-hello-for-business docTags: createdAt: 2026-10-14T21:47:06.181Z --- # Enterprise *** ## ESM Security Setting - Pin Recovery Device Policy **Description**: If the user forgets their PIN, it can be changed to a new PIN using the Windows Hello for Business PIN recovery service. This cloud service encrypts a recovery secret which is stored locally on the client, but which can only be decrypted by the cloud service. If you enable this policy setting, the PIN recovery secret will be stored on the device and the user will be able to change to a new PIN in case their PIN is forgotten. If you disable or do not configure this policy setting, the PIN recovery secret will not be created or stored. If the user's PIN is forgotten, the only way to get a new PIN is by deleting the existing PIN and creating a new one, which will require the user to re-register with any services the old PIN provided access to. **Why It's Important**: If a user forgets their PIN, it can be frustrating and disruptive—especially if they need to re-register with services or lose access to their device. This setting allows users to securely recover their PIN using a cloud-based recovery service, without needing to reset everything. SHIELD enables this policy to improve user experience and reduce support overhead. It’s like having a secure backup key stored safely—ready to use if someone misplaces their main one, without compromising security. **Learn More** - [PassportForWork CSP | Microsoft Learn](https://learn.microsoft.com/en-us/windows/client-management/mdm/passportforwork-csp?WT.mc_id=Portal-fx#devicetenantidpoliciesenablepinrecovery) *** ## ESM Security Setting - Facial Features Policy **Description**: This setting determines whether enhanced anti-spoofing is required for Windows Hello face authentication. If you enable this setting, Windows requires all users on managed devices to use enhanced anti-spoofing for Windows Hello face authentication. This disables Windows Hello face authentication on devices that do not support enhanced anti-spoofing. If you disable or do not configure this setting, Windows doesn't require enhanced anti-spoofing for Windows Hello face authentication. Note that enhanced anti-spoofing for Windows Hello face authentication is not required on unmanaged devices. **Why It's Important**: Face recognition is a convenient way to sign in, but it can be tricked by photos, videos, or masks if not properly secured. This setting makes sure Windows Hello uses enhanced anti-spoofing technology to detect and block those fake attempts. SHIELD enables this policy to ensure that only real, live users can unlock their devices—especially in managed environments where security is critical. It’s like upgrading from a basic ID check to a live verification system—more secure, more reliable, and harder to fool. **Learn More** - [PassportForWork CSP | Microsoft Learn](https://learn.microsoft.com/en-us/windows/client-management/mdm/passportforwork-csp?WT.mc_id=Portal-fx#devicebiometricsfacialfeaturesuseenhancedantispoofing) *** ## ESM Security Setting - Lowercase Letters in PIN Device Policy **Description**: Use this policy setting to configure the use of lowercase letters in the Windows Hello for Business PIN. A value of 1 corresponds to “Required.” If you configure this policy setting to 1, Windows Hello for Business requires users to include at least one lowercase letter in their PIN. A value of 2 corresponds to “Disallow.” If you configure this policy setting to 2, Windows Hello for Business prevents users from using lowercase letters in their PIN. If you do not configure this policy setting, Windows Hello for Business does not allow users to use lowercase letters in their PIN. **Why It's Important**: Allowing lowercase letters in a Windows Hello PIN gives users more flexibility and can make PINs easier to remember while still maintaining security. It also supports stronger PIN complexity when combined with other character types like uppercase letters, numbers, or symbols. SHIELD enables this policy to balance usability and security—making it easier for users to create memorable PINs without compromising protection. It’s like allowing a mix of characters in a password to keep it secure but user-friendly. **Learn More** - [PassportForWork CSP | Microsoft Learn](https://learn.microsoft.com/en-us/windows/client-management/mdm/passportforwork-csp?WT.mc_id=Portal-fx#devicetenantidpoliciespincomplexitylowercaseletters) *** ## ESM Security Setting - Minimum Pin Length Device Policy **Description**: Minimum PIN length configures the minimum number of characters required for the PIN. The lowest number you can configure for this policy setting is 4. The largest number you can configure must be less than the number configured in the Maximum PIN length policy setting or the number 127, whichever is the lowest. If you configure this policy setting, the PIN length must be greater than or equal to this number. If you do not configure this policy setting, the PIN length must be greater than or equal to 4. NOTE: If the above specified conditions for the minimum PIN length are not met, default values will be used for both the maximum and minimum PIN lengths. **Why It's Important**: Short PINs are easier to guess or crack, especially if someone tries to break into a device. This setting makes sure users create PINs that are at least six characters long, which adds an extra layer of security. SHIELD enables this policy to reduce the risk of unauthorized access by enforcing stronger PINs. It’s like requiring a longer combination on a lock—making it harder for someone to figure out and helping keep devices and data safe. **Learn More** - [PassportForWork CSP | Microsoft Learn](https://learn.microsoft.com/en-us/windows/client-management/mdm/passportforwork-csp?WT.mc_id=Portal-fx#devicetenantidpoliciespincomplexityminimumpinlength) *** ## ESM Security Setting - Require Security Device Policy **Description**: A Trusted Platform Module (TPM) provides additional security benefits over software because data stored within it cannot be used on other devices. If you enable this policy setting, only devices with a usable TPM provision Windows Hello for Business. If you disable or do not configure this policy setting, the TPM is still preferred, but all devices provision Windows Hello for Business using software if the TPM is non-functional or unavailable. **Why It's Important**: A Trusted Platform Module (TPM) is a secure hardware chip that protects sensitive data like PINs and encryption keys. Unlike software-based protection, data stored in a TPM can’t be copied or used on another device—making it much harder for attackers to steal credentials. This setting ensures that Windows Hello for Business only works on devices with a usable TPM, adding a strong layer of hardware-backed security. SHIELD enables this policy to prevent weaker, software-only setups and enforce enterprise-grade protection. It’s like requiring a vault with a physical lock instead of just a password—more secure and harder to bypass. **Learn More** - [PassportForWork CSP | Microsoft Learn](https://learn.microsoft.com/en-us/windows/client-management/mdm/passportforwork-csp?WT.mc_id=Portal-fx#devicetenantidpoliciesrequiresecuritydevice) *** ## ESM Security Setting - Special Characters Device Policy **Description**: Use this policy setting to configure the use of special characters in the Windows Hello for Business PIN gesture. Valid special characters for Windows Hello for Business PIN gestures include: ! " # $ % & ' ( ) \* + , - . / : ; \< = > ? @ \[ \ ] ^ \_ \` \{ | } \~ . A value of 1 corresponds to “Required.” If you configure this policy setting to 1, Windows Hello for Business requires users to include at least one special character in their PIN. A value of 2 corresponds to “Disallow.” If you configure this policy setting to 2, Windows Hello for Business prevents users from using special characters in their PIN. If you do not configure this policy setting, Windows Hello for Business does not allow users to use special characters in their PIN. **Why It's Important**: Special characters like !, @, or # make PINs harder to guess and more secure. Allowing users to include them adds complexity and strengthens protection against brute-force attacks. SHIELD enables this policy to give users the option to create stronger, more secure PINs while maintaining flexibility. It’s like adding symbols to a combination lock—making it tougher for intruders to crack, without making it harder for trusted users to remember. **Learn More** - [PassportForWork CSP | Microsoft Learn](https://learn.microsoft.com/en-us/windows/client-management/mdm/passportforwork-csp?WT.mc_id=Portal-fx#devicetenantidpoliciespincomplexityspecialcharacters) *** ## ESM Security Setting - Uppercase Letters Device Policy **Description**: Use this policy setting to configure the use of uppercase letters in the Windows Hello for Business PIN. A value of 1 corresponds to “Required.” If you configure this policy setting to 1, Windows Hello for Business requires users to include at least one uppercase letter in their PIN. A value of 2 corresponds to “Disallow.” If you configure this policy setting to 2, Windows Hello for Business prevents users from using uppercase letters in their PIN. If you do not configure this policy setting, Windows Hello for Business does not allow users to use uppercase letters in their PIN. **Why It's Important**: Allowing uppercase letters in a Windows Hello PIN gives users more flexibility and helps strengthen security. When combined with lowercase letters, numbers, and special characters, uppercase letters increase the number of possible combinations—making the PIN harder to guess or crack. SHIELD enables this policy to support stronger, more secure PINs while keeping them user-friendly. It’s like adding capital letters to a password—simple, familiar, and effective for boosting protection. **Learn More** - [PassportForWork CSP | Microsoft Learn](https://learn.microsoft.com/en-us/windows/client-management/mdm/passportforwork-csp?WT.mc_id=Portal-fx#devicetenantidpoliciespincomplexityuppercaseletters) *** ## ESM Security Setting - WHfB Device Policy **Description**: Windows Hello for Business is an alternative method for signing into Windows using your Active Directory or Azure Active Directory account that can replace passwords, Smart Cards, and Virtual Smart Cards. If you enable or do not configure this policy setting, the device provisions Windows Hello for Business for all users. If you disable this policy setting, the device does not provision Windows Hello for Business for any user. **Why It's Important**: Windows Hello for Business replaces traditional passwords with more secure sign-in methods like biometrics (face, fingerprint) or PINs tied to the device. These methods are harder to steal or reuse across systems, making them much safer than passwords. SHIELD enables this policy to strengthen identity protection and reduce the risk of phishing or credential theft. It’s like upgrading from a shared key to a personalized, secure badge—easier for users, harder for attackers. **Learn More** - [PassportForWork CSP | Microsoft Learn](https://learn.microsoft.com/en-us/windows/client-management/mdm/passportforwork-csp?WT.mc_id=Portal-fx) *** ## ESM Security Setting - Pin Recovery User Policy **Description**: If the user forgets their PIN, it can be changed to a new PIN using the Windows Hello for Business PIN recovery service. This cloud service encrypts a recovery secret which is stored locally on the client, but which can only be decrypted by the cloud service. If you enable this policy setting, the PIN recovery secret will be stored on the device and the user will be able to change to a new PIN in case their PIN is forgotten. If you disable or do not configure this policy setting, the PIN recovery secret will not be created or stored. If the user's PIN is forgotten, the only way to get a new PIN is by deleting the existing PIN and creating a new one, which will require the user to re-register with any services the old PIN provided access to. **Why It's Important**: If a user forgets their PIN, it can disrupt access to their device and services. This setting allows users to securely recover their PIN using a cloud-based recovery service, without needing to reset everything or re-register with apps and services. SHIELD enables this policy to reduce downtime and support requests while maintaining strong security. It’s like having a secure backup method for unlocking your device—quick, safe, and user-friendly. **Learn More** - [PassportForWork CSP | Microsoft Learn](https://learn.microsoft.com/en-us/windows/client-management/mdm/passportforwork-csp?WT.mc_id=Portal-fx#usertenantidpoliciesenablepinrecovery) *** ## ESM Security Setting - Lowercase Letters User Policy **Description**: Use this policy setting to configure the use of lowercase letters in the Windows Hello for Business PIN. A value of 1 corresponds to “Required.” If you configure this policy setting to 1, Windows Hello for Business requires users to include at least one lowercase letter in their PIN. A value of 2 corresponds to “Disallow.” If you configure this policy setting to 2, Windows Hello for Business prevents users from using lowercase letters in their PIN. If you do not configure this policy setting, Windows Hello for Business does not allow users to use lowercase letters in their PIN. **Why It's Important**: Allowing lowercase letters in a user’s PIN gives them more flexibility and helps strengthen security. When combined with other character types like uppercase letters, numbers, and symbols, lowercase letters increase the number of possible combinations—making the PIN harder to guess or crack. SHIELD enables this policy to support stronger, more secure PINs while keeping them easy to remember. It’s like allowing a mix of characters in a password—simple, familiar, and effective for boosting protection without adding complexity for the user. **Learn More** - [PassportForWork CSP | Microsoft Learn](https://learn.microsoft.com/en-us/windows/client-management/mdm/passportforwork-csp?WT.mc_id=Portal-fx#usertenantidpoliciespincomplexitylowercaseletters) *** ## ESM Security Setting - Minimum PIN Length User Policy **Description**: Minimum PIN length configures the minimum number of characters required for the PIN. The lowest number you can configure for this policy setting is 4. The largest number you can configure must be less than the number configured in the Maximum PIN length policy setting or the number 127, whichever is the lowest. If you configure this policy setting, the PIN length must be greater than or equal to this number. If you do not configure this policy setting, the PIN length must be greater than or equal to 4. NOTE: If the above specified conditions for the minimum PIN length are not met, default values will be used for both the maximum and minimum PIN lengths. **Why It's Important**: Short PINs are easier to guess or crack, especially if someone tries to break into a device using brute-force methods. By requiring a minimum of six characters, this setting helps ensure that users create PINs that are long enough to be secure. SHIELD enables this policy to strengthen user authentication without making PINs too complex to remember. It’s like requiring a longer combination on a lock—making it harder for someone to figure out and helping keep devices and data safe. **Learn More** - [PassportForWork CSP | Microsoft Learn](https://learn.microsoft.com/en-us/windows/client-management/mdm/passportforwork-csp?WT.mc_id=Portal-fx#usertenantidpoliciespincomplexityminimumpinlength) *** ## ESM Security Setting - Require Security Device User Policy **Description**: A Trusted Platform Module (TPM) provides additional security benefits over software because data stored within it cannot be used on other devices. If you enable this policy setting, only devices with a usable TPM provision Windows Hello for Business. If you disable or do not configure this policy setting, the TPM is still preferred, but all devices provision Windows Hello for Business using software if the TPM is non-functional or unavailable. **Why It's Important**: A Trusted Platform Module (TPM) is a secure hardware component that protects sensitive data like PINs and encryption keys. Unlike software-based protection, data stored in a TPM is tied to the physical device and can't be copied or reused elsewhere. This setting ensures that Windows Hello for Business only works on devices with a usable TPM, adding a strong layer of hardware-backed security for user credentials. SHIELD enables this policy to enforce enterprise-grade protection and prevent weaker, software-only setups. It’s like requiring a physical key that can’t be duplicated—keeping user authentication secure and device-bound. **Learn More** - [PassportForWork CSP | Microsoft Learn](https://learn.microsoft.com/en-us/windows/client-management/mdm/passportforwork-csp?WT.mc_id=Portal-fx#usertenantidpoliciesrequiresecuritydevice) *** ## ESM Security Setting - Special Characters User Policy **Description**: Use this policy setting to configure the use of special characters in the Windows Hello for Business PIN gesture. Valid special characters for Windows Hello for Business PIN gestures include: ! " # $ % & ' ( ) \* + , - . / : ; \< = > ? @ \[ \ ] ^ \_ \` \{ | } \~ . A value of 1 corresponds to “Required.” If you configure this policy setting to 1, Windows Hello for Business requires users to include at least one special character in their PIN. A value of 2 corresponds to “Disallow.” If you configure this policy setting to 2, Windows Hello for Business prevents users from using special characters in their PIN. If you do not configure this policy setting, Windows Hello for Business does not allow users to use special characters in their PIN. **Why It's Important**: Special characters like @, #, or ! make PINs more complex and harder to guess. Allowing users to include them increases the number of possible combinations, which strengthens security against brute-force attacks. SHIELD enables this policy to give users the flexibility to create stronger, more secure PINs without making them difficult to remember. It’s like adding symbols to a lock combination—simple, familiar, and effective for boosting protection. **Learn More** - [PassportForWork CSP | Microsoft Learn](https://learn.microsoft.com/en-us/windows/client-management/mdm/passportforwork-csp?WT.mc_id=Portal-fx#usertenantidpoliciespincomplexityspecialcharacters) *** ## ESM Security Setting - Uppercase Letters User Policy **Description**: Use this policy setting to configure the use of uppercase letters in the Windows Hello for Business PIN. A value of 1 corresponds to “Required.” If you configure this policy setting to 1, Windows Hello for Business requires users to include at least one uppercase letter in their PIN. A value of 2 corresponds to “Disallow.” If you configure this policy setting to 2, Windows Hello for Business prevents users from using uppercase letters in their PIN. If you do not configure this policy setting, Windows Hello for Business does not allow users to use uppercase letters in their PIN. **Why It's Important**: Allowing uppercase letters in a user’s PIN increases the number of possible combinations, making it harder for attackers to guess. It also gives users more flexibility to create secure and memorable PINs by mixing character types. SHIELD enables this policy to support stronger PIN complexity without making it harder for users to remember. It’s like adding capital letters to a password—simple, familiar, and effective for boosting protection. **Learn More** - [PassportForWork CSP | Microsoft Learn](https://learn.microsoft.com/en-us/windows/client-management/mdm/passportforwork-csp?WT.mc_id=Portal-fx#usertenantidpoliciespincomplexityuppercaseletters) *** ## ESM Security Setting - WHfB User Policy **Description**: Windows Hello for Business is an alternative method for signing into Windows using your Active Directory or Azure Active Directory account that can replace passwords, Smart Cards, and Virtual Smart Cards. If you enable or do not configure this policy setting, the device provisions Windows Hello for Business for all users. If you disable this policy setting, the device does not provision Windows Hello for Business for any user. **Why It's Important**: Windows Hello for Business replaces passwords with more secure sign-in options like biometrics or PINs tied to the device. These methods are harder to steal or reuse, reducing the risk of phishing and credential theft. This setting ensures that all users on the device are provisioned with Windows Hello for Business, giving them access to modern, secure authentication. SHIELD enables this policy to strengthen identity protection across the organization. It’s like upgrading from a shared password to a personalized, secure key—more convenient for users and much safer for the system. **Learn More** - [PassportForWork CSP | Microsoft Learn](https://learn.microsoft.com/en-us/windows/client-management/mdm/passportforwork-csp?WT.mc_id=Portal-fx) *** # Privileged *** ## PSM Security Setting - Device-scoped settings - Enable Pin Recovery Policy **Description**: If the user forgets their PIN, it can be changed to a new PIN using the Windows Hello for Business PIN recovery service. This cloud service encrypts a recovery secret which is stored locally on the client, but which can only be decrypted by the cloud service. If you enable this policy setting, the PIN recovery secret will be stored on the device and the user will be able to change to a new PIN in case their PIN is forgotten. If you disable or do not configure this policy setting, the PIN recovery secret will not be created or stored. If the user's PIN is forgotten, the only way to get a new PIN is by deleting the existing PIN and creating a new one, which will require the user to re-register with any services the old PIN provided access to. **Why It's Important**: This policy enables secure PIN recovery in Windows Hello for Business, helping users regain access quickly while maintaining protection through encrypted recovery secrets. **Learn More** - \[coming soon] *** ## PSM Security Setting - Facial Features Use Enhanced Anti Spoofing **Description**: This setting determines whether enhanced anti-spoofing is required for Windows Hello face authentication. If you enable this setting, Windows requires all users on managed devices to use enhanced anti-spoofing for Windows Hello face authentication. This disables Windows Hello face authentication on devices that do not support enhanced anti-spoofing. If you disable or do not configure this setting, Windows doesn't require enhanced anti-spoofing for Windows Hello face authentication. Note that enhanced anti-spoofing for Windows Hello face authentication is not required on unmanaged devices. **Why It's Important**: This policy requires enhanced anti-spoofing for Windows Hello face authentication, protecting against attempts to bypass biometric login with photos or other spoofing methods. **Learn More** - \[coming soon] *** ## PSM Security Setting - Device-scoped settings - Lowercase Letters Policy **Description**: Use this policy setting to configure the use of lowercase letters in the Windows Hello for Business PIN. A value of 1 corresponds to “Required.” If you configure this policy setting to 1, Windows Hello for Business requires users to include at least one lowercase letter in their PIN. A value of 2 corresponds to “Disallow.” If you configure this policy setting to 2, Windows Hello for Business prevents users from using lowercase letters in their PIN. If you do not configure this policy setting, Windows Hello for Business does not allow users to use lowercase letters in their PIN. **Why It's Important**: This policy allows the use of lowercase letters in Windows Hello for Business PINs, supporting stronger authentication by enabling greater character complexity. **Learn More** - [PassportForWork CSP | Microsoft Learn](https://learn.microsoft.com/en-us/windows/client-management/mdm/passportforwork-csp?WT.mc_id=Portal-fx#devicetenantidpoliciespincomplexitylowercaseletters) *** ## PSM Security Setting - Device-scoped settings - Minimum PIN Length Policy **Description**: Minimum PIN length configures the minimum number of characters required for the PIN. The lowest number you can configure for this policy setting is 4. The largest number you can configure must be less than the number configured in the Maximum PIN length policy setting or the number 127, whichever is the lowest. If you configure this policy setting, the PIN length must be greater than or equal to this number. If you do not configure this policy setting, the PIN length must be greater than or equal to 4. NOTE: If the above specified conditions for the minimum PIN length are not met, default values will be used for both the maximum and minimum PIN lengths. **Why It's Important**: This policy enforces a minimum PIN length in Windows Hello for Business, strengthening authentication by reducing the risk of short, easily guessed PINs. **Learn More** - [PassportForWork CSP | Microsoft Learn](https://learn.microsoft.com/en-us/windows/client-management/mdm/passportforwork-csp?WT.mc_id=Portal-fx#devicetenantidpoliciespincomplexityminimumpinlength) *** ## PSM Security Setting - Device-scoped settings - Require Security Device **Description**: A Trusted Platform Module (TPM) provides additional security benefits over software because data stored within it cannot be used on other devices. If you enable this policy setting, only devices with a usable TPM provision Windows Hello for Business. If you disable or do not configure this policy setting, the TPM is still preferred, but all devices provision Windows Hello for Business using software if the TPM is non-functional or unavailable. **Why It's Important**: This policy enforces the use of a TPM for Windows Hello for Business, ensuring credential keys are hardware-protected and bound to the device for stronger security. **Learn More** - [PassportForWork CSP | Microsoft Learn](https://learn.microsoft.com/en-us/windows/client-management/mdm/passportforwork-csp?WT.mc_id=Portal-fx#devicetenantidpoliciesrequiresecuritydevice) *** ## PSM Security Setting - Device-scoped settings - Special Characters Policy **Description**: Use this policy setting to configure the use of special characters in the Windows Hello for Business PIN gesture. Valid special characters for Windows Hello for Business PIN gestures include: ! " # $ % & ' ( ) \* + , - . / : ; \< = > ? @ \[ \ ] ^ \_ \` \{ | } \~ . A value of 1 corresponds to “Required.” If you configure this policy setting to 1, Windows Hello for Business requires users to include at least one special character in their PIN. A value of 2 corresponds to “Disallow.” If you configure this policy setting to 2, Windows Hello for Business prevents users from using special characters in their PIN. If you do not configure this policy setting, Windows Hello for Business does not allow users to use special characters in their PIN. **Why It's Important**: This policy allows the use of special characters in Windows Hello for Business PINs, increasing complexity and strengthening protection against brute-force attacks. **Learn More** - [PassportForWork CSP | Microsoft Learn](https://learn.microsoft.com/en-us/windows/client-management/mdm/passportforwork-csp?WT.mc_id=Portal-fx#devicetenantidpoliciespincomplexityspecialcharacters) *** ## PSM Security Setting - Device-scoped settings - Uppercase Letters Policy **Description**: Use this policy setting to configure the use of uppercase letters in the Windows Hello for Business PIN. A value of 1 corresponds to “Required.” If you configure this policy setting to 1, Windows Hello for Business requires users to include at least one uppercase letter in their PIN. A value of 2 corresponds to “Disallow.” If you configure this policy setting to 2, Windows Hello for Business prevents users from using uppercase letters in their PIN. If you do not configure this policy setting, Windows Hello for Business does not allow users to use uppercase letters in their PIN. **Why It's Important**: This policy allows the use of uppercase letters in Windows Hello for Business PINs, increasing flexibility while supporting stronger authentication through greater character complexity. **Learn More** - [PassportForWork CSP | Microsoft Learn](https://learn.microsoft.com/en-us/windows/client-management/mdm/passportforwork-csp?WT.mc_id=Portal-fx#devicetenantidpoliciespincomplexityuppercaseletters) *** ## PSM Security Setting - Use Windows Hello For Business (Device) Policy **Description**: Windows Hello for Business is an alternative method for signing into Windows using your Active Directory or Azure Active Directory account that can replace passwords, Smart Cards, and Virtual Smart Cards. If you enable or do not configure this policy setting, the device provisions Windows Hello for Business for all users. If you disable this policy setting, the device does not provision Windows Hello for Business for any user. **Why It's Important**: This policy provisions Windows Hello for Business at the device level, replacing passwords with strong, multifactor authentication to reduce the risk of credential compromise. **Learn More** - [PassportForWork CSP | Microsoft Learn](https://learn.microsoft.com/en-us/windows/client-management/mdm/passportforwork-csp?WT.mc_id=Portal-fx) *** ## PSM Security Setting - Enable Pin Recovery (User) Policy **Description**: If the user forgets their PIN, it can be changed to a new PIN using the Windows Hello for Business PIN recovery service. This cloud service encrypts a recovery secret which is stored locally on the client, but which can only be decrypted by the cloud service. If you enable this policy setting, the PIN recovery secret will be stored on the device and the user will be able to change to a new PIN in case their PIN is forgotten. If you disable or do not configure this policy setting, the PIN recovery secret will not be created or stored. If the user's PIN is forgotten, the only way to get a new PIN is by deleting the existing PIN and creating a new one, which will require the user to re-register with any services the old PIN provided access to. **Why It's Important**: This policy enables secure PIN recovery for Windows Hello for Business, reducing downtime and support overhead while maintaining protection through encrypted recovery secrets. **Learn More** - [PassportForWork CSP | Microsoft Learn](https://learn.microsoft.com/en-us/windows/client-management/mdm/passportforwork-csp?WT.mc_id=Portal-fx#usertenantidpoliciesenablepinrecovery) *** ## PSM Security Setting - Lowercase Letters (User) Policy **Description**: Use this policy setting to configure the use of lowercase letters in the Windows Hello for Business PIN. A value of 1 corresponds to “Required.” If you configure this policy setting to 1, Windows Hello for Business requires users to include at least one lowercase letter in their PIN. A value of 2 corresponds to “Disallow.” If you configure this policy setting to 2, Windows Hello for Business prevents users from using lowercase letters in their PIN. If you do not configure this policy setting, Windows Hello for Business does not allow users to use lowercase letters in their PIN. **Why It's Important**: This policy allows the use of lowercase letters in Windows Hello for Business PINs, giving flexibility to meet complexity requirements and support stronger authentication. **Learn More** - [PassportForWork CSP | Microsoft Learn](https://learn.microsoft.com/en-us/windows/client-management/mdm/passportforwork-csp?WT.mc_id=Portal-fx#usertenantidpoliciespincomplexitylowercaseletters) *** ## PSM Security Setting - Minimum PIN Length (User) Policy **Description**: Minimum PIN length configures the minimum number of characters required for the PIN. The lowest number you can configure for this policy setting is 4. The largest number you can configure must be less than the number configured in the Maximum PIN length policy setting or the number 127, whichever is the lowest. If you configure this policy setting, the PIN length must be greater than or equal to this number. If you do not configure this policy setting, the PIN length must be greater than or equal to 4. NOTE: If the above specified conditions for the minimum PIN length are not met, default values will be used for both the maximum and minimum PIN lengths. **Why It's Important**: This policy enforces a minimum PIN length for Windows Hello for Business, ensuring stronger authentication by reducing the risk of simple or easily guessed PINs. **Learn More** - [PassportForWork CSP | Microsoft Learn](https://learn.microsoft.com/en-us/windows/client-management/mdm/passportforwork-csp?WT.mc_id=Portal-fx#usertenantidpoliciespincomplexityminimumpinlength) *** ## PSM Security Setting - Require Security Device (User) Policy **Description**: A Trusted Platform Module (TPM) provides additional security benefits over software because data stored within it cannot be used on other devices. If you enable this policy setting, only devices with a usable TPM provision Windows Hello for Business. If you disable or do not configure this policy setting, the TPM is still preferred, but all devices provision Windows Hello for Business using software if the TPM is non-functional or unavailable. **Why It's Important**: This policy enforces the use of a hardware-based TPM for Windows Hello for Business, ensuring credential keys are protected against theft and cannot be moved between devices. **Learn More** - [PassportForWork CSP | Microsoft Learn](https://learn.microsoft.com/en-us/windows/client-management/mdm/passportforwork-csp?WT.mc_id=Portal-fx#usertenantidpoliciesrequiresecuritydevice) *** ## PSM Security Setting - Special Characters (User) Policy **Description**: Use this policy setting to configure the use of special characters in the Windows Hello for Business PIN gesture. Valid special characters for Windows Hello for Business PIN gestures include: ! " # $ % & ' ( ) \* + , - . / : ; \< = > ? @ \[ \ ] ^ \_ \` \{ | } \~ . A value of 1 corresponds to “Required.” If you configure this policy setting to 1, Windows Hello for Business requires users to include at least one special character in their PIN. A value of 2 corresponds to “Disallow.” If you configure this policy setting to 2, Windows Hello for Business prevents users from using special characters in their PIN. If you do not configure this policy setting, Windows Hello for Business does not allow users to use special characters in their PIN. **Why It's Important**: This policy allows the use of special characters in Windows Hello for Business PINs, increasing complexity options and strengthening resistance against brute-force attacks. **Learn More** - [PassportForWork CSP | Microsoft Learn](https://learn.microsoft.com/en-us/windows/client-management/mdm/passportforwork-csp?WT.mc_id=Portal-fx#usertenantidpoliciespincomplexityspecialcharacters) *** ## PSM Security Setting - Uppercase Letters (User) Policy **Description**: Use this policy setting to configure the use of uppercase letters in the Windows Hello for Business PIN. A value of 1 corresponds to “Required.” If you configure this policy setting to 1, Windows Hello for Business requires users to include at least one uppercase letter in their PIN. A value of 2 corresponds to “Disallow.” If you configure this policy setting to 2, Windows Hello for Business prevents users from using uppercase letters in their PIN. If you do not configure this policy setting, Windows Hello for Business does not allow users to use uppercase letters in their PIN. **Why It's Important**: This policy allows the use of uppercase letters in Windows Hello for Business PINs, providing flexibility in meeting complexity requirements without restricting secure configurations. **Learn More** - [PassportForWork CSP | Microsoft Learn](https://learn.microsoft.com/en-us/windows/client-management/mdm/passportforwork-csp?WT.mc_id=Portal-fx#usertenantidpoliciespincomplexityuppercaseletters) *** ## PSM Security Setting - Use WHfB(User) Policy **Description**: Windows Hello for Business is an alternative method for signing into Windows using your Active Directory or Azure Active Directory account that can replace passwords, Smart Cards, and Virtual Smart Cards. If you enable or do not configure this policy setting, the device provisions Windows Hello for Business for all users. If you disable this policy setting, the device does not provision Windows Hello for Business for any user. **Why It's Important**: This policy enables Windows Hello for Business to replace passwords with strong, multifactor authentication tied to the device, reducing the risk of credential theft. **Learn More** - [PassportForWork CSP | Microsoft Learn](https://learn.microsoft.com/en-us/windows/client-management/mdm/passportforwork-csp?WT.mc_id=Portal-fx)