Use cloud trust for on-premises authentication

Supported OS tags: Windows10, Windows10RT

Use this policy setting to configure Windows Hello for Business to use Azure AD Kerberos for on-premises authentication. If you enable this policy setting, Windows Hello for Business will use a Kerberos ticket retrieved from authenticating to Azure for on-premises authentication. If you disable or do not configure this policy setting, Windows Hello for Business will use a key or certificate (depending on other policy settings) for on-premises authentication. NOTE: An environment that enables both this policy setting, and the "Use Windows Hello for Business" policy setting requires one or more Windows Server 2016 domain controllers. Otherwise, Windows Hello for Business authentication will fail.

This policy has no additional user input fields.

• Computer
  Allow enumeration of emulated smart card for all users

  At least Windows 10
• Computer
  Configure device unlock factors

  At least Windows 10
• Computer
  Configure dynamic lock factors

  At least Windows 10
• Computer
  Enable ESS with Supported Peripherals

  At least Windows 11 Version 22H2
• Computer
  Turn off smart card emulation

  At least Windows 10
• Computer
  Use a hardware security device

  At least Windows 10
• Computer
  Use biometrics

  At least Windows 10
• Computer
  Use certificate for on-premises authentication

  At least Windows 10
• User
  Use certificate for on-premises authentication

  At least Windows 10
• Computer
  Use PIN Recovery

  At least Windows 10
• User
  Use Windows Hello for Business

  At least Windows 10
• Computer
  Use Windows Hello for Business

  At least Windows 10