{"id":11111,"date":"2016-07-07T12:07:51","date_gmt":"2016-07-07T19:07:51","guid":{"rendered":"https:\/\/www.microsoft.com\/insidetrack\/blog\/?p=11111"},"modified":"2023-06-16T16:00:29","modified_gmt":"2023-06-16T23:00:29","slug":"enabling-remote-access-with-windows-hello-for-business-in-windows-10","status":"publish","type":"post","link":"https:\/\/www.microsoft.com\/insidetrack\/blog\/enabling-remote-access-with-windows-hello-for-business-in-windows-10\/","title":{"rendered":"Enabling remote access with Windows Hello for Business in Windows 10"},"content":{"rendered":"<div class=\"m-alert f-error\" role=\"alert\">\n<div>\n<div class=\"c-glyph glyph-incident-triangle\" aria-label=\"Error message\"><\/div>\n<p class=\"c-paragraph\">This content has been archived, and while it was correct at time of publication, it may no longer be accurate or reflect the current situation at Microsoft.<\/p>\n<\/div>\n<\/div>\n<p>During the internal deployment of Windows 10 November update, Microsoft Digital implemented a new credential, Windows Hello, for strong authentication. We were able to easily incorporate the new credential for use within our existing VPN infrastructure, creating a streamlined sign-in experience for remote access among Windows 10 users.<\/p>\n<p>With the Windows 10 November update, Microsoft IT enabled Windows Hello as an enterprise credential for our users. Our security policies already enforced secure remote sign in using multi-factor authentication, with smart card or phone verification as the second factor, to connect to corporate resources using VPN (virtual private network).<\/p>\n<p>On any given weekday at Microsoft, there are roughly 35,000 to 45,000 users connected to the corporate network using VPN. There are 25,000 to 35,000 users connected on the weekends and during non-peak hours. We needed to easily incorporate Windows Hello for Business and enable:<\/p>\n<ul class=\"c-list\">\n<li>A single VPN solution to support our 180,000 global users.<\/li>\n<li>A preferred credential backed by certificate-based authentication, providing a seamless sign in experience and connection to resources from outside the corporate network.<\/li>\n<li>The ability to &#8220;just work&#8221;with our existing VPN solution as machines upgrade to Windows 10 November update.<\/li>\n<li>Compliance with corporate policies using our preferred device management solution.<\/li>\n<\/ul>\n<p>Windows Hello for Business is a private\/public key or certificate-based authentication approach for organizations and consumers that goes beyond passwords. This form of authentication relies on key pair credentials that can replace passwords and are resistant to breaches, thefts, and phishing. With Windows Hello, biometric authentication and recognition is easy with a face or fingerprint. PCs with fingerprint readers are ready to use Windows Hello now, and more devices that can recognize faces are coming soon.<\/p>\n<p>Microsoft IT integrated Windows Hello for Business with our existing VPN infrastructure and enabled secure remote access with certificate-backed credentials. In addition, Windows Hello provides a unified VPN connection experience for all modern devices, with fewer user touch points. It also sets the foundation for ongoing enforcement of corporate policies and enables AutoConnect for VPN.<\/p>\n<p>For more information about how we enabled Windows Hello for Business as a credential, read\u00a0<a class=\"c-hyperlink\" href=\"https:\/\/www.microsoft.com\/en-us\/insidetrack\/Implementing-strong-user-authentication-with-Windows-Hello-for-Business\" target=\"_self\" rel=\"noopener\" aria-label=\"Read more about Implementing strong user authentication with Windows Hello for Business\">Implementing strong user authentication with Windows Hello for Business<\/a><\/p>\n<h3>Supported authentication methods<\/h3>\n<p>We have a single VPN solution in place for use with all of the supported client operating systems in our environment. We support several strong authentication methods specific to the operating system that is being used. Our preferred credential is backed by certificate-based authentication (public key infrastructure, or PKI) and multi-factor authentication solutions.<\/p>\n<h4>Windows 10 November update with Windows Hello for Business<\/h4>\n<p>Windows 10 users that have installed the Windows 10 November update can use VPN with Windows Hello for Business. Windows Hello credentials address many of the inherent problems with passwords. Passwords can be difficult to remember, can be reused on multiple sites, and can sometimes be easy to guess. Server breaches can expose symmetric network credentials, or users can inadvertently divulge their passwords to phishing attacks. Because PINs are tied to the device and are stored locally, they are more secure than a password. The PIN is backed by a Trusted Platform Module chip, a requirement in our environment, and includes multiple physical security mechanisms to make it tamper resistant.<\/p>\n<h4>Windows 10 with multi-factor authentication<\/h4>\n<p>Windows 10 users that have installed the November update and have not set up Windows Hello for Business, or that are running an earlier version of Windows 10 can use VPN with multi-factor authentication with phone verification.<\/p>\n<p>Multi-factor authentication with phone verification as a second form of strong authentication helped expand the types of devices that can access the corporate network through VPN. While cloud-based services can be accessed any time and from any device using federated identities and multi-factor authentication, VPN at Microsoft was limited to mostly domain-joined machines, which we manage using Microsoft System Center Configuration Manager. Before multi-factor authentication with phone verification and software-based certificates, VPN was cumbersome for users on non-domain joined machines. We can install the same policies that we use in Configuration Manager to provide client certificates to non-domain-joined devices that are managed through Microsoft Intune. Also note that multi-factor authentication with phone verification requires users to either join a Microsoft domain or enroll in Microsoft Intune to enable device management.<\/p>\n<h4>Remote access for earlier versions of Windows<\/h4>\n<p>Users that are running Windows 8.1, Windows 8, or Windows 7 and have installed the Microsoft IT VPN client can authenticate with a physical or virtual smart card or register and configure VPN to use multi-factor authentication with phone verification when connecting. We are still enforcing the Network Access Protection system health check and quarantine for these client machines.<\/p>\n<h4>Windows Mobile<\/h4>\n<p>On Windows Phone 8\/8.1 and Windows Mobile 10, VPN profiles are deployed via Microsoft Intune. The VPN profiles are set to connect automatically using the Always On functionality and are configured to route only corporate data through the tunnel (using split tunneling). In Windows 10 Mobile, there is greater flexibility for secure authentication with new features such as Windows Hello for Business, and additional security features such as Conditional Access and Enterprise Data Protection.<\/p>\n<h3>VPN client connection manager application<\/h3>\n<p>The Microsoft IT VPN client, based on Connection Manager is required on all devices to connect using remote access. It is included as part of the corporate operating system deployment image, or is available for our users to download from the Microsoft IT remote access SharePoint portal. This allows a single client to be available for all devices and machines, which can connect remotely and access corporate resources.<\/p>\n<h3>Securely accessing corporate on managed devices<\/h3>\n<p>We use Configuration Manager to manage all of our domain-joined computers, and Microsoft Intune provides enterprise mobility management support for non-domain-joined computers and mobile devices that have enrolled in the service. In our hybrid configuration, VPN policies, including certificate issuance that we create in Configuration Manager for Windows 10 devices, are loaded into Microsoft Intune and applied to enrolled devices.<\/p>\n<p>For more information about how we use Microsoft Intune as part of our mobile device management strategy, read\u00a0<a class=\"c-hyperlink\" href=\"https:\/\/www.microsoft.com\/en-us\/insidetrack\/Mobile-device-management-at-Microsoft\" target=\"_self\" rel=\"noopener\" aria-label=\"Read more about Mobile device management at Microsoft\">Mobile device management at Microsoft<\/a>.<\/p>\n<h3>Remote access infrastructure<\/h3>\n<p>The infrastructure for providing remote access to all of the supported operating systems at Microsoft is shared, with the exception of a few key pieces that were included to issue certificates and manage the non-domain-joined systems. We chose to make our certificates for Windows Hello for Business work the same as our smart card certificates so that we would have a seamless integration with our existing, geographically distributed Windows Server infrastructure.<\/p>\n<ul class=\"c-list\">\n<li>From the client side, we did not have to make any changes to the connection manager application that is used to connect to our VPN.<\/li>\n<li>From the server side, we only had to configure Windows Hello for Business as an accepted authentication credential on the Network Policy Server (NPS).<\/li>\n<\/ul>\n<p>This illustration shows our remote access infrastructure.<\/p>\n<div><\/div>\n<div class=\"m-image\">\n<figure id=\"attachment_11113\" aria-describedby=\"caption-attachment-11113\" style=\"width: 930px\" class=\"wp-caption alignnone\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-11113 size-full\" src=\"https:\/\/www.microsoft.com\/insidetrack\/blog\/uploads\/prod\/2023\/05\/3685-img001.png\" alt=\"This illustration shows the flow of traffic from the Internet, to the perimiter network, to the corporate network.,\" width=\"930\" height=\"434\" srcset=\"https:\/\/www.microsoft.com\/insidetrack\/blog\/uploads\/prod\/2023\/05\/3685-img001.png 930w, https:\/\/www.microsoft.com\/insidetrack\/blog\/uploads\/prod\/2023\/05\/3685-img001-300x140.png 300w, https:\/\/www.microsoft.com\/insidetrack\/blog\/uploads\/prod\/2023\/05\/3685-img001-768x358.png 768w\" sizes=\"(max-width: 930px) 100vw, 930px\" \/><figcaption id=\"caption-attachment-11113\" class=\"wp-caption-text\">Figure 1. Microsoft remote access<\/figcaption><\/figure>\n<\/div>\n<h4>Certificate and device enrollment<\/h4>\n<p>Simple Certificate Enrollment Protocol (SCEP) and Network Device Enrollment Service (NDES) are the mechanisms we currently use to deploy certificates to our mobile devices via Microsoft Intune and Configuration Manager. NDES allows software on routers and other network devices running without domain credentials to obtain certificates based on the SCEP.<\/p>\n<p>NDES performs the following functions:<\/p>\n<ul class=\"c-list\">\n<li>Generates and provides one-time enrollment passwords to administrators.<\/li>\n<li>Submits enrollment requests to the certificate authority (CA).<\/li>\n<li>Retrieves enrolled certificates from the CA and forwards them to the network device.<\/li>\n<\/ul>\n<p>For more information about deploying NDES, including best practices, see\u00a0<a class=\"c-hyperlink\" href=\"http:\/\/social.technet.microsoft.com\/wiki\/contents\/articles\/9063.network-device-enrollment-service-ndes-in-active-directory-certificate-services-ad-cs.aspx#Deploying_the_Network_Device_Enrollment_Servicehttp:\/\/social.technet.microsoft.com\/wiki\/contents\/articles\/9063.network-device-enrollment-service-ndes-in-active-directory-certificate-services-ad-cs.aspx\" target=\"_blank\" rel=\"noopener\" aria-label=\"Read more about Network Device Enrollment Service (NDES) in Active Directory Certificate Services (AD CS)\">Network Device Enrollment Service (NDES) in Active Directory Certificate Services (AD CS)<\/a>. Also, see\u00a0<a class=\"c-hyperlink\" href=\"https:\/\/www.microsoft.com\/en-us\/download\/details.aspx?id=46406\" target=\"_blank\" rel=\"noopener\" aria-label=\"Read more about Securing and Hardening Network Device Enrollment Service for Microsoft Intune and System Center Configuration Manager\">Securing and Hardening Network Device Enrollment Service for Microsoft Intune and System Center Configuration Manager<\/a>.<\/p>\n<h4>RADIUS server<\/h4>\n<p>Remote Authentication Dial-In User Service (RADIUS) servers, or Network Policy Server, perform authentication, authorization, and accounting for RADIUS clients. A RADIUS client can be an access server, such as a dial-up server or wireless access point, or a RADIUS proxy. When NPS is used as a RADIUS server, it provides authentication, authorization, and accounting services for network access servers.<\/p>\n<p>For more information, see\u00a0<a class=\"c-hyperlink\" href=\"https:\/\/technet.microsoft.com\/en-us\/library\/hh831683(v=ws.11).aspx\" target=\"_blank\" rel=\"noopener\" aria-label=\"Read more about Network Policy and Access Services Overview\">Network Policy and Access Services Overview<\/a>.<\/p>\n<p>To enable Windows Hello for Business, the NPS server was configured to include a new condition in our network policy as shown in figure 2 EAP Types. Appropriate policies were set to ensure the new condition was processed before the auto-denial policies. The condition, in this case, was to accept a specific Windows Hello certificate.<\/p>\n<div><\/div>\n<div class=\"m-image\">\n<figure id=\"attachment_11114\" aria-describedby=\"caption-attachment-11114\" style=\"width: 936px\" class=\"wp-caption alignnone\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-11114 size-full\" src=\"https:\/\/www.microsoft.com\/insidetrack\/blog\/uploads\/prod\/2023\/05\/3685-img002.png\" alt=\"This screen shot shows how to get to the Network Policy Properties dialog box.,\" width=\"936\" height=\"743\" srcset=\"https:\/\/www.microsoft.com\/insidetrack\/blog\/uploads\/prod\/2023\/05\/3685-img002.png 936w, https:\/\/www.microsoft.com\/insidetrack\/blog\/uploads\/prod\/2023\/05\/3685-img002-300x238.png 300w, https:\/\/www.microsoft.com\/insidetrack\/blog\/uploads\/prod\/2023\/05\/3685-img002-768x610.png 768w\" sizes=\"(max-width: 936px) 100vw, 936px\" \/><figcaption id=\"caption-attachment-11114\" class=\"wp-caption-text\">Figure 2. Network Policy Properties dialog box<\/figcaption><\/figure>\n<\/div>\n<h4>RRAS<\/h4>\n<p>We use Routing and Remote Access Service (RRAS) to deploy VPN, dial-up remote access services, multiprotocol LAN-to-LAN, LAN-to-WAN, and network address translation (NAT) routing services.<\/p>\n<p>For more information about deploying VPN using RRAS, see\u00a0<a class=\"c-hyperlink\" href=\"https:\/\/technet.microsoft.com\/en-us\/library\/dn614140(v=ws.11).aspx\" target=\"_blank\" rel=\"noopener\" aria-label=\"Read more about Routing and Remote Access Service (RRAS)\">Routing and Remote Access Service (RRAS)<\/a>.<\/p>\n<h4>VPN tunnel types<\/h4>\n<p>Our VPN solution supports the following tunnel types:<\/p>\n<ul class=\"c-list\">\n<li>IKEv2: This tunnel type is preferred and is set as the default. IKEv2 is more resilient to changing network connectivity, making it a good choice for mobile users who move between access points and even switch between wired and wireless connections.<\/li>\n<li>SSTP: The default tunnel fail-over strategy for Microsoft IT VPN. Secure Socket Tunneling Protocol (SSTP) provides firewall traversal capability. This means mobile users who are trying to access corporate network resources from behind customer firewalls, airport hotspots, hotels, and other public Wi-Fi hotspots can successfully use VPN.<\/li>\n<\/ul>\n<h5>Split tunneling<\/h5>\n<p>Split tunneling allows only the traffic destined for the Microsoft corporate network to be routed through the VPN tunnel, and all Internet traffic goes directly through the Internet without traversing the VPN tunnel. In Microsoft IT VPN, split tunneling is enabled by default.<\/p>\n<h2>Applying policies<\/h2>\n<p>We use Group Policy in Windows Server Active Directory to configure our Windows 10 domain-joined devices to provision Windows Hello credentials when a user signs in. We also use Group Policy Objects to define the complexity and length of the PIN that our users generate and to control Windows Hello use. For non-domain joined and mobile devices, the same policies are managed and applied by Microsoft Intune.<\/p>\n<h4>Policy enforcement<\/h4>\n<p>Configuration Manager and Intune handle policy enforcement as well as certificate enrollment and deployment on behalf of the client.<\/p>\n<h4>Providing exceptions<\/h4>\n<p>We have a process to provide time-bound exceptions for users if they are unable to connect. We give users time to troubleshoot and resolve their connection issue by giving them access for 24 hours\u2014or 7 days in rare instances. Those exceptions are routed through the helpdesk and managed with certificates.<\/p>\n<h4>Compliance checks<\/h4>\n<p>Remote computers and devices that use VPN to connect to the corporate network have to be checked for compliance. For Windows 8.1 and earlier, we still use a separate compliance check that would quarantine a system, limiting its access to corporate resources while it performed a system health check and installed required updates.<\/p>\n<p>We require certificates from Configuration Manager on Windows 10 domain-joined computers, or from Microsoft Intune for computers that are enrolled to be managed. That certificate implies that because the computer is managed, it should be able to pass a system health check. If a computer does not have all of the system and security requirements installed, Configuration Manager or Intune will install them\u2014or the certificate that is needed to connect will not be issued.<\/p>\n<h2>Managing the service<\/h2>\n<p>We rolled out Windows 10 November update to a group of about 15,000 early adopters a few months before release. Early adopters validated the new credential functionality and used remote access connection scenarios to provide valuable feedback that we could take back to the product development team. Using early adopters helped validate and improve features and functionality, influenced how we prepared for the broader deployment across Microsoft, and helped us prepare support channels for the types of issues that users might experience.<\/p>\n<h3>Encouraging adoption<\/h3>\n<p>After enterprise release of Windows 10 November update, we required users to install the update on all domain-joined Windows 10 computers and to use the new connection methods when they connect using VPN. Users were notified that they had three weeks to voluntarily install the update and begin using the new credentials. We enforced this by using a version check policy in Configuration Manager that installed the update in the background and prompted the user to create their Windows Hello for Business sign-in.<\/p>\n<p>Most of our users on corporate-provisioned devices are running Windows 10 with November update. Our remote access infrastructure supports next-generation credentials as well as the multi-factor authentication methods used by earlier operating system versions and non-domain-joined running Windows 10.<\/p>\n<h3>Measuring service health<\/h3>\n<p>We measure connection rates as well as response times to monitor the service and report on the number of unique users that connect every month, the number of daily users, and the duration of connections. By measuring connection events, we know who has connected and who has failed to connect.<\/p>\n<h2>What&#8217;s next<\/h2>\n<p>Upcoming releases include new features that will improve both the service and the user experience.<\/p>\n<ul class=\"c-list\">\n<li><strong>Conditional access.<\/strong>\u00a0Conditional access is scheduled to be released in an upcoming update for Windows 10. Rather than just relying on the managed device certificate for a &#8220;pass&#8221;or &#8220;fail&#8221;for VPN connection, conditional access places machines in a quarantined state while checking for the latest required security updates and antivirus definitions to help ensure that the system is not introducing risk.<\/li>\n<li><strong>Auto-connect VPN client.<\/strong>\u00a0To enable mobile productivity and improve the user experience, users will have the option to stay connected to VPN without additional interaction after they sign in.<\/li>\n<li><strong>VPN profiles.<\/strong>\u00a0VPN profiles from Microsoft Intune and\/or Configuration Manager will replace the Connection Manager client that we currently use. The profiles will automatically configure connection and authentication types.<\/li>\n<\/ul>\n<h2>Benefits<\/h2>\n<p>We saw benefits during the rollout of Windows Hello for Business when our users started using the new credential to connect. Specific benefits include:<\/p>\n<ul class=\"c-list\">\n<li><strong>Integration with existing infrastructure.<\/strong>\u00a0Our remote access infrastructure was set up to use smart cards and virtual smart card credentials and we already had a PKI infrastructure, which made it easy to enable Windows Hello for Business. The Network Policy Server updates enabled us to use the new credential for remote access as well.<\/li>\n<li><strong>Minimize user touch points.<\/strong>\u00a0When connecting via VPN, the user can input their PIN to gain a secure connection, with a consistent and simple connection experience.<\/li>\n<li><strong>No bandwidth or administration overhead.<\/strong>\u00a0Adding a new credential type did not affect our existing connectivity or bandwidth. Using existing infrastructure has also enabled us to extend our service monitoring capabilities to include Windows Hello for Business and provide a unified view of our service health.<\/li>\n<li><strong>Making IT future ready.<\/strong>\u00a0Our corporate polices require that devices must be compliant and enrolled in a device management service. With Windows 10, we can enforce ongoing compliance without additional scripts to connect remotely.<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>This content has been archived, and while it was correct at time of publication, it may no longer be accurate or reflect the current situation at Microsoft. During the internal deployment of Windows 10 November update, Microsoft Digital implemented a new credential, Windows Hello, for strong authentication. We were able to easily incorporate the new [&hellip;]<\/p>\n","protected":false},"author":146,"featured_media":11112,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"_hide_featured_on_single":false,"_show_featured_caption_on_single":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","enabled":false},"version":2}},"categories":[1],"tags":[],"coauthors":[674],"class_list":["post-11111","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","m-blog-post"],"jetpack_publicize_connections":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v23.7 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Enabling remote access with Windows Hello for Business in Windows 10 - Inside Track Blog<\/title>\n<meta name=\"description\" content=\"During the internal deployment of Windows 10 November update, Microsoft Digital implemented a new credential, Windows Hello, for strong authentication. We were able to easily incorporate the new credential for use within our existing VPN infrastructure, creating a streamlined sign-in experience for remote access among Windows 10 users.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.microsoft.com\/insidetrack\/blog\/enabling-remote-access-with-windows-hello-for-business-in-windows-10\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Enabling remote access with Windows Hello for Business in Windows 10 - Inside Track Blog\" \/>\n<meta property=\"og:description\" content=\"During the internal deployment of Windows 10 November update, Microsoft Digital implemented a new credential, Windows Hello, for strong authentication. We were able to easily incorporate the new credential for use within our existing VPN infrastructure, creating a streamlined sign-in experience for remote access among Windows 10 users.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.microsoft.com\/insidetrack\/blog\/enabling-remote-access-with-windows-hello-for-business-in-windows-10\/\" \/>\n<meta property=\"og:site_name\" content=\"Inside Track Blog\" \/>\n<meta property=\"article:published_time\" content=\"2016-07-07T19:07:51+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2023-06-16T23:00:29+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.microsoft.com\/insidetrack\/blog\/uploads\/prod\/2023\/05\/3685-hero.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1040\" \/>\n\t<meta property=\"og:image:height\" content=\"585\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Inside Track \u2013 retired stories\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Inside Track \u2013 retired stories\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"12 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.microsoft.com\/insidetrack\/blog\/enabling-remote-access-with-windows-hello-for-business-in-windows-10\/\",\"url\":\"https:\/\/www.microsoft.com\/insidetrack\/blog\/enabling-remote-access-with-windows-hello-for-business-in-windows-10\/\",\"name\":\"Enabling remote access with Windows Hello for Business in Windows 10 - Inside Track Blog\",\"isPartOf\":{\"@id\":\"https:\/\/www.microsoft.com\/insidetrack\/blog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.microsoft.com\/insidetrack\/blog\/enabling-remote-access-with-windows-hello-for-business-in-windows-10\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.microsoft.com\/insidetrack\/blog\/enabling-remote-access-with-windows-hello-for-business-in-windows-10\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.microsoft.com\/insidetrack\/blog\/uploads\/prod\/2023\/05\/3685-hero.jpg\",\"datePublished\":\"2016-07-07T19:07:51+00:00\",\"dateModified\":\"2023-06-16T23:00:29+00:00\",\"author\":{\"@id\":\"https:\/\/www.microsoft.com\/insidetrack\/blog\/#\/schema\/person\/59e5f7b07dae629412c990cc1a63b575\"},\"description\":\"During the internal deployment of Windows 10 November update, Microsoft Digital implemented a new credential, Windows Hello, for strong authentication. We were able to easily incorporate the new credential for use within our existing VPN infrastructure, creating a streamlined sign-in experience for remote access among Windows 10 users.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.microsoft.com\/insidetrack\/blog\/enabling-remote-access-with-windows-hello-for-business-in-windows-10\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.microsoft.com\/insidetrack\/blog\/enabling-remote-access-with-windows-hello-for-business-in-windows-10\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.microsoft.com\/insidetrack\/blog\/enabling-remote-access-with-windows-hello-for-business-in-windows-10\/#primaryimage\",\"url\":\"https:\/\/www.microsoft.com\/insidetrack\/blog\/uploads\/prod\/2023\/05\/3685-hero.jpg\",\"contentUrl\":\"https:\/\/www.microsoft.com\/insidetrack\/blog\/uploads\/prod\/2023\/05\/3685-hero.jpg\",\"width\":1040,\"height\":585,\"caption\":\"Frontline worker in mobile office using Surface.\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.microsoft.com\/insidetrack\/blog\/enabling-remote-access-with-windows-hello-for-business-in-windows-10\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.microsoft.com\/insidetrack\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Enabling remote access with Windows Hello for Business in Windows 10\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.microsoft.com\/insidetrack\/blog\/#website\",\"url\":\"https:\/\/www.microsoft.com\/insidetrack\/blog\/\",\"name\":\"Inside Track Blog\",\"description\":\"How Microsoft does IT\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.microsoft.com\/insidetrack\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.microsoft.com\/insidetrack\/blog\/#\/schema\/person\/59e5f7b07dae629412c990cc1a63b575\",\"name\":\"Inside Track \u2013 retired stories\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.microsoft.com\/insidetrack\/blog\/#\/schema\/person\/image\/ee0de87c339052d5d84852473bd7f213\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/24a8c329ab32afd1bc23fd1658d1acc2?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/24a8c329ab32afd1bc23fd1658d1acc2?s=96&d=mm&r=g\",\"caption\":\"Inside Track \u2013 retired stories\"},\"description\":\"The content on this page was crafted to highlight a specific moment in time or the solutions that have led us to where we are today. It offers valuable insights into our journey and the progress made over the years. Check out the Inside Track blog page for our up-to-date stories around Microsoft.\",\"url\":\"https:\/\/www.microsoft.com\/insidetrack\/blog\/author\/insidetrackarchive\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Enabling remote access with Windows Hello for Business in Windows 10 - Inside Track Blog","description":"During the internal deployment of Windows 10 November update, Microsoft Digital implemented a new credential, Windows Hello, for strong authentication. We were able to easily incorporate the new credential for use within our existing VPN infrastructure, creating a streamlined sign-in experience for remote access among Windows 10 users.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.microsoft.com\/insidetrack\/blog\/enabling-remote-access-with-windows-hello-for-business-in-windows-10\/","og_locale":"en_US","og_type":"article","og_title":"Enabling remote access with Windows Hello for Business in Windows 10 - Inside Track Blog","og_description":"During the internal deployment of Windows 10 November update, Microsoft Digital implemented a new credential, Windows Hello, for strong authentication. We were able to easily incorporate the new credential for use within our existing VPN infrastructure, creating a streamlined sign-in experience for remote access among Windows 10 users.","og_url":"https:\/\/www.microsoft.com\/insidetrack\/blog\/enabling-remote-access-with-windows-hello-for-business-in-windows-10\/","og_site_name":"Inside Track Blog","article_published_time":"2016-07-07T19:07:51+00:00","article_modified_time":"2023-06-16T23:00:29+00:00","og_image":[{"width":1040,"height":585,"url":"https:\/\/www.microsoft.com\/insidetrack\/blog\/uploads\/prod\/2023\/05\/3685-hero.jpg","type":"image\/jpeg"}],"author":"Inside Track \u2013 retired stories","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Inside Track \u2013 retired stories","Est. reading time":"12 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.microsoft.com\/insidetrack\/blog\/enabling-remote-access-with-windows-hello-for-business-in-windows-10\/","url":"https:\/\/www.microsoft.com\/insidetrack\/blog\/enabling-remote-access-with-windows-hello-for-business-in-windows-10\/","name":"Enabling remote access with Windows Hello for Business in Windows 10 - Inside Track Blog","isPartOf":{"@id":"https:\/\/www.microsoft.com\/insidetrack\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.microsoft.com\/insidetrack\/blog\/enabling-remote-access-with-windows-hello-for-business-in-windows-10\/#primaryimage"},"image":{"@id":"https:\/\/www.microsoft.com\/insidetrack\/blog\/enabling-remote-access-with-windows-hello-for-business-in-windows-10\/#primaryimage"},"thumbnailUrl":"https:\/\/www.microsoft.com\/insidetrack\/blog\/uploads\/prod\/2023\/05\/3685-hero.jpg","datePublished":"2016-07-07T19:07:51+00:00","dateModified":"2023-06-16T23:00:29+00:00","author":{"@id":"https:\/\/www.microsoft.com\/insidetrack\/blog\/#\/schema\/person\/59e5f7b07dae629412c990cc1a63b575"},"description":"During the internal deployment of Windows 10 November update, Microsoft Digital implemented a new credential, Windows Hello, for strong authentication. We were able to easily incorporate the new credential for use within our existing VPN infrastructure, creating a streamlined sign-in experience for remote access among Windows 10 users.","breadcrumb":{"@id":"https:\/\/www.microsoft.com\/insidetrack\/blog\/enabling-remote-access-with-windows-hello-for-business-in-windows-10\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.microsoft.com\/insidetrack\/blog\/enabling-remote-access-with-windows-hello-for-business-in-windows-10\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.microsoft.com\/insidetrack\/blog\/enabling-remote-access-with-windows-hello-for-business-in-windows-10\/#primaryimage","url":"https:\/\/www.microsoft.com\/insidetrack\/blog\/uploads\/prod\/2023\/05\/3685-hero.jpg","contentUrl":"https:\/\/www.microsoft.com\/insidetrack\/blog\/uploads\/prod\/2023\/05\/3685-hero.jpg","width":1040,"height":585,"caption":"Frontline worker in mobile office using Surface."},{"@type":"BreadcrumbList","@id":"https:\/\/www.microsoft.com\/insidetrack\/blog\/enabling-remote-access-with-windows-hello-for-business-in-windows-10\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.microsoft.com\/insidetrack\/blog\/"},{"@type":"ListItem","position":2,"name":"Enabling remote access with Windows Hello for Business in Windows 10"}]},{"@type":"WebSite","@id":"https:\/\/www.microsoft.com\/insidetrack\/blog\/#website","url":"https:\/\/www.microsoft.com\/insidetrack\/blog\/","name":"Inside Track Blog","description":"How Microsoft does IT","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.microsoft.com\/insidetrack\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/www.microsoft.com\/insidetrack\/blog\/#\/schema\/person\/59e5f7b07dae629412c990cc1a63b575","name":"Inside Track \u2013 retired stories","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.microsoft.com\/insidetrack\/blog\/#\/schema\/person\/image\/ee0de87c339052d5d84852473bd7f213","url":"https:\/\/secure.gravatar.com\/avatar\/24a8c329ab32afd1bc23fd1658d1acc2?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/24a8c329ab32afd1bc23fd1658d1acc2?s=96&d=mm&r=g","caption":"Inside Track \u2013 retired stories"},"description":"The content on this page was crafted to highlight a specific moment in time or the solutions that have led us to where we are today. It offers valuable insights into our journey and the progress made over the years. Check out the Inside Track blog page for our up-to-date stories around Microsoft.","url":"https:\/\/www.microsoft.com\/insidetrack\/blog\/author\/insidetrackarchive\/"}]}},"jetpack_featured_media_url":"https:\/\/www.microsoft.com\/insidetrack\/blog\/uploads\/prod\/2023\/05\/3685-hero.jpg","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p9hcZA-2Td","_links":{"self":[{"href":"https:\/\/www.microsoft.com\/insidetrack\/blog\/wp-json\/wp\/v2\/posts\/11111"}],"collection":[{"href":"https:\/\/www.microsoft.com\/insidetrack\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.microsoft.com\/insidetrack\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.microsoft.com\/insidetrack\/blog\/wp-json\/wp\/v2\/users\/146"}],"replies":[{"embeddable":true,"href":"https:\/\/www.microsoft.com\/insidetrack\/blog\/wp-json\/wp\/v2\/comments?post=11111"}],"version-history":[{"count":3,"href":"https:\/\/www.microsoft.com\/insidetrack\/blog\/wp-json\/wp\/v2\/posts\/11111\/revisions"}],"predecessor-version":[{"id":11116,"href":"https:\/\/www.microsoft.com\/insidetrack\/blog\/wp-json\/wp\/v2\/posts\/11111\/revisions\/11116"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.microsoft.com\/insidetrack\/blog\/wp-json\/wp\/v2\/media\/11112"}],"wp:attachment":[{"href":"https:\/\/www.microsoft.com\/insidetrack\/blog\/wp-json\/wp\/v2\/media?parent=11111"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.microsoft.com\/insidetrack\/blog\/wp-json\/wp\/v2\/categories?post=11111"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.microsoft.com\/insidetrack\/blog\/wp-json\/wp\/v2\/tags?post=11111"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.microsoft.com\/insidetrack\/blog\/wp-json\/wp\/v2\/coauthors?post=11111"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}