The Cloud AP provider receives the encrypted PRT with session key.

When the nonce is validated, Azure AD creates a primary refresh token (PRT) with session key that is encrypted to the device's transport key and returns it to the Cloud AP provider. Azure AD validates the signature and then validates the returned signed nonce.

Azure AD validates the signed nonce using the user's securely registered public key against the nonce signature.The Cloud AP provider signs the nonce using the user's private key and returns the signed nonce to the Azure AD.Azure AD returns a nonce that's valid for 5 minutes.The Cloud AP provider requests a nonce (a random arbitrary number that can be used just once) from Azure AD.The gesture unlocks the Windows Hello for Business private key and is sent to the Cloud Authentication security support provider, referred to as the Cloud AP provider. A user signs into Windows using biometric or PIN gesture.The following steps show how the sign-in process works with Azure AD: With public key infrastructure (PKI) integration and built-in support for single sign-on (SSO), Windows Hello for Business provides a convenient method for seamlessly accessing corporate resources on-premises and in the cloud. The biometric and PIN credentials are directly tied to the user's PC, which prevents access from anyone other than the owner. Windows Hello for Business is ideal for information workers that have their own designated Windows PC. Microsoft global Azure and Azure Government offer the following three passwordless authentication options that integrate with Azure Active Directory (Azure AD):

Windows 10 Device, phone, or security keyĮach organization has different needs when it comes to authentication. Passwordless authentication methods are more convenient because the password is removed and replaced with something you have, plus something you are or something you know. Features like multifactor authentication (MFA) are a great way to secure your organization, but users often get frustrated with the additional security layer on top of having to remember their passwords.

Passwordless sign in