Windows Hello on MiWorkspace Computers

Environment

MiWorkspace, Windows 11

Issue

What is Windows Hello, what is required to enable it, and how to configure it?

Resolution

Windows Hello is a more personal and secure way to sign in to your Windows device. Instead of using a password, with Windows Hello you can sign in using facial recognition, fingerprint, or a PIN.

Required Hardware

  • Fingerprint Reader: Your device must have a compatible fingerprint reader. Many modern Dell laptops feature a fingerprint reader integrated into the power button.
  • Face Recognition: For facial recognition, your device needs an infrared (IR) camera and support Enhanced Sign-in Security (ESS). Most modern laptops come equipped with this feature.
    • Despite being marketed as Windows Hello capable, external devices are not supported for Windows Hello at this time due to lack of ESS support (refer to Additional Information section).

NOTE: If your device does not have biometric authentication support, you can still use Windows Hello using the PIN method.

Configure Windows Hello

You can use the Settings app to configure and manage Windows Hello.

  1. Go to the Settings app on your Windows device.
  2. Click on Accounts.
    1. If you don't see a left-hand sidebar with an Accounts section, maximize the window. You should see Accounts show up on the left side.
  3. Under Sign-in options, you have three choices to sign in with Windows Hello. On Windows 11 devices with Window Hello functionality enabled/unrestricted, the Sign-in options screen will present these options:
    1. Select Facial recognition (Windows Hello) to set up facial recognition sign-in with your PC's infrared camera or an external infrared camera.
      1. Signing in with your face requires a Windows Hello-compatible camera.
    2. Select Fingerprint recognition (Windows Hello) to set up sign-in with a fingerprint reader.
      1. Signing in with your fingerprint requires your device to have a fingerprint reader.
    3. Select PIN (Windows Hello) to set up sign-in with a PIN.
  4. Choose an option and select Set up
  5. Follow the instructions to complete the configuration of Windows Hello

After a biometric option is configured, you will be then prompted to set up a PIN, if one is not already set. During this stage, you will need to verify your two-factor authentication code (Okta); Once authenticated, a prompt will appear to enter and confirm a PIN.

PIN requirements

  • Must be at least 6 characters long Can't be longer than 127 characters
  • May include uppercase letters
  • May include lowercase letters
  • May include digits
  • May include special characters
  • Can't be a number pattern (such as 123456 or 11111)

The next time you sign in to your device, you can use facial recognition, fingerprint identification, or PIN code instead of your password.

You can always use your password if PIN or biometric methods fail.

Example Screen

Windows 11 Sign-in options screen, showing available Windows Hello login methods

Additional Information

Note: Every time you restart your computer, the login screen will default to showing username and password entry fields. At this point, you can click on "Sign-in options," then select the Face or Fingerprint button to allow you to log in using saved facial or fingerprint biometrics.

Why is Enhanced Sign-in Security enabled on my device?

Enhanced Sign-in Security (ESS) is a Windows Hello feature that protects your face or fingerprint data using dedicated, isolated hardware on your computer. With ESS enabled, your biometric data is processed in a protected area of memory that is walled off from the rest of Windows, so even if the operating system were compromised by malware, your face and fingerprint information — and the sign-in credentials they unlock — could not be stolen or tampered with. We enforce ESS on all managed devices to ensure your identity and university credentials receive the strongest protection available.

One side effect of this protection: external webcams and USB fingerprint readers can't be used for Windows Hello sign-in, since ESS only permits sensors that meet its hardware security requirements. Your built-in camera or fingerprint reader will work normally, and external cameras still work fine in apps like Teams and Zoom — the restriction only applies to signing in.

Refer to Microsoft’s article regarding Windows Hello common issues and troubleshooting tips.

Need additional information or assistance? Contact the ITS Service Center.

Print Article

Related Services / Offerings (1)

ITS-MiWorkspace
This service is a desktop support service that provides network connectivity to your computers and devices, delivery of software and security updates, printing, and access to a team of desktop support professionals. The service standardizes common desktop support work across campus, allowing units to focus on mission-critical technology.