How to track Windows Hello for Business (WhfB) usage


Warning: Undefined array key "titleWrapper" in /home/vhosts/itexperience.net/httpdocs/wp-content/plugins/seo-by-rank-math/includes/modules/schema/blocks/toc/class-block-toc.php on line 103

Security officers were dancing on the table. Recently I enabled Windows Hello for Business (WHfB) for a client. Their environment had thousands of Intune devices, and all are Azure AD Joined. Due to the impact it would have on the service desk (we would expect a few calls 😉 ), the company didn’t want to force Hello for Business. Enabling Hello for Business without any research or consideration can really ruin your sysadmin day. It would force every user to a mandatory Hello for Business wizard. And it’s almost impossible to start your work day without configuring it

Instead of this black scenario on a Monday morning, I decided to make use of the DisablePostLogonProvisioning registry key to make Hello for Business optional. Users had to consciously go to Settings -> Sign in Options to configure a PIN, fingerprint or facial recognition.

A disadvantage of this approach is the uncertainty about how many people have actually configured Hello for Business. Yes, Hello for Business is a safer login method, eliminating the need to enter a password. But if you offer it as optional (not mandatory), then how do you find out how much safer your users and company are?

Track Windows Hello for Business Registration

Registration and reset events

To gain insight into how many users have configured Windows Hello for Business, we should use the Microsoft Entra ID portal (formerly known as Azure Active Directory). For these steps, you need to have at least one of the following roles assigned:

  • Reports Reader
  • Security Reader
  • Global Reader
  • Application Administrator
  • Cloud Application Administrator
  • Security Operator
  • Security Administrator
  • Global Administrator

To gain information about Hello for Business registration and usage, do the following:

  1. Navigate to portal.azure.com
  2. Click on Microsoft Entra ID.
  3. In the left bar, click Security
  4. In the left bar, click Authentication Methods
  5. In the left bar, click Registration and reset events. This page shows you all types of authentication registrations
  6. One way is to hit Download at the top to download a CSV. Then do some Excel magic and filter all Hello for Business registrations to get a good overview of last 30 days. Another way is to filter right away in the portal:
    a. Click Method: All
    b. Click the dropdown arrow
    c. Deselect all methods, except Windows Hello for Business
    d. Hit Apply (the button that is now hidden behind your dropdown box. Red card for the UX designer 🙂 ).
    Windows Hello for Business registration overview

Unfortunately, the download reports and onscreen reports only list a maximum of 30 days. No further historical data is available. In addition to that, it is also unknown on what device the user registered Hello for Business. As you probably know, Hello for Business is a security measure that only applies to that one device, and specific user. In the case a user owns 3 Windows devices, it’s unclear if and on how many devices she configured WHfB.

User Registration Details

To get knowledge on which users have configured Windows Hello for Business in the past, go to User Registration Details. This report gives you some insights

Activity Dashboard

And of course, there’s also a very general dashboard, showing you a lot but also nothing: The Activity Dashboard (also in “Authentication methods | Activity):

logins password vs hello for business WHfB
logins password vs hello for business WHfB

Conclusion

After you have enabled Windows Hello for Business in your company, it’s possible to get some knowledge of how many users have registered for WHfB. However, it’s still quite difficult to get precise information on how more secure your company is (assuming WHfB is most secure to log on to a Windows machine). It’s something. But it’s not ideal.

I’m still looking for a report that shows every device and its primary user (assigned user), combined with a Password/Hello for Business login ratio. When all statistics show 100% Hello for Business, my goal is accomplished.

For more information, take a look at https://learn.microsoft.com/en-us/entra/identity/authentication/howto-authentication-methods-activity

By the way, If you ever want to undo a Windows Hello for Business implementation, I wrote an article about that a while ago 🙂 And in case you’re stuck at a Just a Moment PIN screen, this article is for you

0 0 votes
Article Rating
Subscribe
Notify of
guest
0 Comments
Inline Feedbacks
View all comments
0
Would love your thoughts, please comment.x
()
x