Support for MFA with Windows Hello

Question

Support for MFA with Windows Hello

heeizi 0

With the configuration described below, a multi-factor authentication (MFA) setup requiring both PIN and facial recognition for Windows sign-in worked.

Is this configuration currently officially supported?

Device: Surface Pro 12 inch
OS: Windows 11 Pro 25H2 (26200.9168)
Domain or workgroup: workgroup
GPO:
- Computer Configuration > Administrative Templates > Windows Components > Windows Hello for Business > Configure device unlock factors: Enabled
- First unlock factor credential providers: PIN {D6886603-9D2F-4EB2-B667-1971041FA96B}
- Second unlock factor credential providers: Facial Recognition {8AF662BF-65A0-4D0A-A540-A338A999D36F}
- Signal rules for device unlock: default (<rule schemaVersion="1.0"> <signal type="bluetooth" scenario="Authentication" classOfDevice="512" rssiMin="-10" rssiMaxDelta="-10"/> </rule> )

0 comments

Answer accepted by question author

Alex-L 11,745 Microsoft External Staff Moderator

Hi heeizi

While Microsoft documentation only supports Trusted Signal as the second unlock factor, your test demonstrates that other credential provider combinations may still work in current builds. However, behavior outside the documented Trusted Signal Unlock configuration is considered unsupported and may change without notice in future Windows releases. The fact that PIN + Facial Recognition currently functions does not imply Microsoft support or a supported security boundary. Administrators should rely on documented configurations when designing production deployments.

0 comments

1 additional answer

Your answer

Answer 1

No. That configuration is not officially supported.

For trusted signal unlock, the supported credential providers are limited to:

First unlock factor: PIN, Fingerprint scan, Facial Recognition
Second unlock factor: Trusted Signal only

Microsoft explicitly states:

Trusted Signal is required as the second unlock factor.
Trusted Signal is not supported as the first unlock factor.
Any other credential provider configured as the first or second unlock factor is not supported and can have unexpected results.

In the described policy, Facial Recognition is configured as the second unlock factor. That is outside the supported configuration. Even if it worked in testing, it is not an officially supported setup.

A supported design would be:

First unlock factor: PIN and/or biometric providers such as Facial Recognition or Fingerprint
Second unlock factor: Trusted Signal

Also note:

If the DontDisplayLastUserName security policy is enabled, it is known to interfere with trusted signal unlock.
If a trusted factor is not configured, users can experience sign-in failures and may be locked out of the device.