Set up Windows Hello

Go to the Microsoft Azure portal.

Go to Devices > Device settings. Turn on Users may join devices to Microsoft Entra ID (Azure AD).

Go to https://endpoint.microsoft.com to open the Microsoft Endpoint Manager admin center.

Alternatively, in the Azure Portal, you can go to Devices > Overview > Feature Highlights, click Intune, and follow the link to Microsoft Endpoint Manager.

In Microsoft Endpoint Manager, select Devices.

Select Windows Enrollment and click Windows Hello for Business.

In Configure Windows Hello for Business, select Enabled.

Configure the authentication method you want to use.

Go to Devices > Device settings. Turn on Users may join devices to Microsoft Entra ID (Azure AD).

Go to https://endpoint.microsoft.com to open the Microsoft Endpoint Manager admin center.

Alternatively, in the Azure Portal, you can go to Devices > Overview > Feature Highlights, click Intune, and follow the link to Microsoft Endpoint Manager.

In Microsoft Endpoint Manager, select Devices.

Go to Configuration profiles > Create profile.

Enter the properties as follows:

1. In Platform, select Windows 10 and later.
2. In Profile, click Templates > Identity protection.
3. Click Create.

In Basics, enter a Name and Description. Click Next.

In Configuration settings, do as follows:

1. In Configure Windows Hello for Business, select Enabled.
2. Configure the authentication method you want to use. For details of all settings, see Identity protection profile settings.
3. Click Next.

In Assignments, add user groups to the Included groups. These groups will use Windows Hello. Click Next.

In Review + create, review your settings and click Create.