- Coming up we'll look at recent updates
to Windows Hello for Business.
We'll show you why it's even more secure than a password.
And new protections for when you are in a public place or
for when you are away from your device.
With Windows 10, we've introduced Windows Hello
as a convenient and more secure alternative to passwords.
For businesses, Windows Hello can be brought in the Cloud,
in a hybrid configuration and now on premises within
your own environment.
Hello enables authentication of your user accounts,
using active directory on premises,
or Azure Active Directory.
There are a number of advantages.
The first, is the additional security
that Windows Hello offers.
It has built in device base multifactor
authentication by default.
Hello relies on something you have,
such as the device itself combined
with a remote authenticator.
Like your phone, your PIN or unique identifier,
which could be biometrics like your face or fingerprint.
It importantly moves your organization beyond
the security pitfalls of passwords.
And here's how.
When you use a password to authenticate,
whatever is in your head has to be stored on the
corresponding host environment.
It's probably hashed, salted,
or encrypted, but it's there.
Now, there are a few issues with this.
First, if the server's breached it can be compromised,
releasing passwords into the wild.
Also on the user side, most of us reuse our passwords
across services.
Which increases our Tech Service if passwords are stolen.
And of course, a user can be tricked into giving away
their corporate passwords via phishing.
The way to solve for this is to ensure that what's stored
on the host environment and on the
side of the users, do not match.
This is called an asymmetric approach.
It works similarly to how certificates work today.
With an asymmatic or key pair, or private and public keys.
The public key sits on the host environment.
In this case Azure.
And a unique private key sits on the TPM Chip on the
users device and never leaves it.
During sign-in, your bio gesture meaning
your face or fingerprint unlocks the private key
to perform sign-in operation.
And that results in your device obtaining
an authentication token from Azure Active Directory
without sharing any secrets with the server.
Now once you're authenticated another advantage is
single seamless sign on to your apps and services.
First, let me show you the experience
without Windows Hello.
I'll sign-in to Windows using my traditional password.
Now, when I open my browser, navigate to office.com,
and I'll sign-in.
As you can see, I'm being prompted
for multifactor authentication.
In this case, my phone.
And send a text message with a code which I'll enter now.
Although it ends up being secure,
it's not very user friendly.
Especially, if I have to do this multiple times a day.
With Hello, on the other hand, I can use facial recognition
to authenticate.
Remember, it's multifactor authentication, by default.
We have the private key on the TPM,
which is unlocked with my bio gesture.
I'm going to authenticate with my face.
As you can see, it's almost instant.
Now let me open a browser.
And go to office.com, and as you can see,
I'm logged on directly.
Now, as an additional safeguard, if you are,
for example, in an un-trusted location.
Maybe you're working remotely or in a public space,
such as a coffee shop, when you sign-in.
For this we also added the ability to apply
an additional factor for unlocking the device.
In this case, I'm going to use a PIN to log onto my device.
But, because I'm in an unknown location,
Window's prompts me to authenticate with another factor.
First it will try to verify the network and then my phone.
In this case I've simulated that my phone is out of range
by disabling Bluetooth.
Now when I re-enable Bluetooth and log in again,
Windows will see my device and proximity and logs me in.
Completing authentication with an additional factor.
And since I have my phone paired with this device,
let me show you one more thing.
We've added a new capability called 'Dynamic Lock'
which automatically locks the device when your
paired Bluetooth device, such as your phone,
is away from your PC.
So if I walk away from my device,
with my phone in my possession, my computer is safe.
To demonstrate this, you'll see that my PC,
will automatically lock in a moment,
when I turn off Bluetooth.
This is a significant improvement over the standard,
15 minute, idle timeout.
And anyone can get this working.
Go to Start, Settings, Choose Accounts,
Sign-in options, scroll down and this is where you can
enable Dynamic Lock.
Which I've already enabled.
Lastly, I mentioned before that we've added a new option
to deploy Windows Hello in your own premises environment.
There are number of support ways for doing this
based on your specific configuration.
And you can learn more about these options,
at the link shown.
So that was a quick overview of Windows Hello for Business,
and the latest updates to give you a secure
and seamless authentication experience for your users.
As you move forward with Windows 10 in your organization,
we encourage you to take a look at Windows Hello
and to start your journey into a world without passwords.
An area that Microsoft is continuing to lead
as a key member of the industry FIDO Alliance.
You can learn more about Windows Hello for Business
at the link shown.
Thanks for watching.
(upbeat music)