How to use Windows Hello

Windows Hello is a modern, passwordless authentication system built into recent versions of the Windows operating system. It includes facial recognition, fingerprint recognition, and PIN based options. You can use Windows Hello as one of your Duo authentication methods.

Note: Windows Hello is a platform authenticator, meaning that it must be on the same device you are using to access a system protected by Duo. Platform authenticators are only supported in browser-based applications. They can not be used in command-line or Windows login authentications.

How Windows Hello works

Windows Hello can only be used with browser-based applications. After you log in with your username and password, Duo prompts you to "Use your security key". Tap the button on your YubiKey device.

How to set up Windows Hello

1. First create a Windows Hello sign in option in Windows Settings on the device you want to use. This can be found in Settings > Accounts > Sign-in options. You may use either facial recognition, fingerprint recognition, or PIN.
2. Navigate to the Duo Device Management Portal.
3. Select "Add a device" then select "Windows Hello" and "Continue".
4. When prompted, complete the facial recognition, fingerprint recognition, or PIN verification.

How to authenticate using Windows Hello

1. Log in to a Duo-protected service using your username and password
2. Duo will prompt you to "Use Windows Hello", and will immediately open a Windows dialogue with the text "Making sure it's you". If you do not see the this prompt, Duo may have defaulted to a different authentication method. Click "Cancel" then "Other options" and then "Windows Hello" to manually select this option. If you do not see "Windows Hello" in the list of options, you have not set up this method yet. Refer to the instructions above.
3. Complete the facial recognition, fingerprint recognition, or PIN verification