Windows Hello for Business Policy is Configured and Assigned

Overview

If policies for Windows Hello for Business (WHfB) aren’t configured and assigned to all users and devices, threat actors can exploit weak authentication mechanisms—like passwords—to gain unauthorized access. This can lead to credential theft, privilege escalation, and lateral movement within the environment. Without strong, policy-driven authentication like WHfB, attackers can compromise devices and accounts, increasing the risk of widespread impact.

Enforcing WHfB disrupts this attack chain by requiring strong, multifactor authentication, which helps reduce the risk of credential-based attacks and unauthorized access.

Remediation

Deploy Windows Hello for Business in Intune to enforce strong, multifactor authentication:

• Configure a tenant-wide Windows Hello for Business policy that applies at the time a device enrolls with Intune.
• After enrollment, configure Account protection profiles and assign different configurations for Windows Hello for Business to different groups of users and devices.

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	High
Effort to fix	Medium
Impact on users	Medium
Pillar	Devices
Category	Device management
Product	Intune
Feature	Device enrollment
Area	Authentication
ATT&CK	T1110 Brute Force, T1078 Valid Accounts
Licence	Intune
Tenant	Workforce

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.