Coming up,
The Windows 10 anniversary update
along with the new Windows Hello companion device framework
expands your options with the new factors of authentication.
Such as a phone, employee badge, and more.
Today, I'll walk you through the growing number of third-party devices available,
and the user and IT deployment experience.
Windows Hello takes away the hassle of remembering passwords
by instead using facial recognition or fingerprints
to sign into your Windows device.
With the Anniversary update,
we made the Windows Hello companion device framework available to our hardware partners
to provide authentication options spanning consumer
to highly regulated industries.
Windows Hello companion device framework
is built on top of the credential provider framework.
While we see supported credential provider framework
this is a new approach to customize the Windows logon experience
in ways that match the convenience of Windows Hello.
Let me show you an example.
The device I have here doesn't support facial recognition,
but it does support NFC via the external reader.
Let me show you how you can enroll an NFC companion device.
Note that all of these devices use Universal app platform also known as Windows store app.
Here i'm using an employee badge from HID,
and I'll walk you through the first run set of experience.
This PC, I've already downloaded the app from HID.
And I can go ahead and simply launch it.
Then I have to type in a pairing code that allows me to pair this card with this reader.
And when I do that and click OK, it asked me to tap the card.
I'm going to go ahead and simply tap the card
And at this point I'll be prompted to type in my Windows pin
to make sure it's me.
And once I'm done, I'm done with the registration.
And now I can simply lock my PC.
It will ask me to tap my card to the reader to sign in, which I will do right now.
And as soon as I tap, It will greet me and I'm in.
However, there's more.
Our partners are creating unique authentication experiences
using other identifiers
such as electro cardiogram, or ECG for short with this Nymi band.
For this demo, I've already authenticated to this Nymi band
by simply touching this bottom for a few seconds.
I only have to do this once as I put it on.
After that I can simply unlock my PC with it.
Let's see how.
I've already installed Nymi band on this PC and registered my bad with it.
As I hit the spacebar on this PC,
it will send a haptic feedback to my band
asking me to confirm my intent to unlock with a double tap.
If I do so, my PC will simply unlock.
Know that if someone else picks up the band and tries the same thing,
they won't succeed given that their ECG will not match my ECG.
There are much more solutions coming to market soon.
Things like headsets, sports wearables, phones, and others.
The framework is available to anyone.
But as a rule of thumb, we'll recommend you review the companion devices on our app store.
These apps have gone through Microsoft's special certification process
to sure that the app and the device implementation meet our security requirements.
As for deployment, end users can download the apps from the App Store
setup a pin, run the app to register the device
and start unlocking.
For IT admins,
you can use MDM, System Center Configuration Manager,
PowerShell or business store to distribute the companion device apps.
You can download application packages from the business store
or work with our partners to get the app packages.
Note, that this feature is turned off by default
on all enterprise devices.
And turned on, on consumer devices.
You can manage this using MDM as outlined here
on the MSDN page.
Or, by using group policy.
In this MSDN page, you can see the configuration required
for setting up the policy CSB.
And in here you can see the configuration required for group policy.
You have to navigate to computer configuration,
Administrative Templates, Windows Components.
And under that, you'll find a setting called Microsoft Secondary Authentication Factor
where you can turn on or off this feature.
You can also control which companion devices run in your environment
by restricting the apps that can run using AppLocker.
This is the beginning of a journey.
Our goal is to make signing in effortless for users with continuous authentication
for applications and browsers.
Leveraging biometric was a starting point.
And now with companion device framework, we have expanded the options.
We're looking forward to seeing other creative ideas from our partner community
for strong authentication.
To learn more, please visit the link below.
And, keep watching Microsoft Mechanics for the latest tech updates to Windows.
Thanks for watching.
Microsoft Mechanics
www.microsoft.com/mechanics