Windows Hello

A Faster, Safer Sign-In (In Pilot)

Signing in to your work device should be both secure and simple. Windows Hello helps make that possible by giving staff a quicker way to sign in without typing their full password every time.

Windows Hello is also supported by Duo, giving you one secure, non phishable sign in method for both Windows and MFA prompts.

What Is Windows Hello?

Windows Hello is a secure sign-in feature built into Windows. It lets you sign in using a PIN and, on supported devices, biometrics such as facial recognition or a fingerprint.

Your Windows Hello PIN is required for all staff on supported devices. Biometric sign-in is optional, but strongly recommended when available because it can make sign-in much faster and easier.

If you choose to use facial recognition or a fingerprint, that biometric information is stored in encrypted form on the device where you enrolled it. It does not leave that device.

It is also important to know that your Windows Hello credentials only work on the specific device where they were created. They do not work on other computers.

How to Set Up Windows Hello

When Windows Hello is available on your assigned device, you will be prompted to set it up during sign-in:

1. Set up facial recognition or fingerprint sign-in if offered (optional)

If your device includes a supported camera or fingerprint reader, you may see an option to enroll biometrics. This step is optional, but recommended for a faster sign-in experience.

Windows Hello enrollment biometrics

2. Create your Windows Hello PIN (required)

Choose a PIN you can remember but that others cannot easily guess. This PIN will be used only on that device. It is important that you do not share your PIN with anyone, including IT.

Windows Hello enrollment PIN

3. Finish setup

Once setup is complete, Windows Hello will be ready to use for future sign-ins.

Windows Hello enrollment finished

What to Expect After Setup

After Windows Hello is set up, you can sign in with your PIN instead of typing your full password each time.

If your device supports it and you enrolled biometrics, you may also be able to sign in with your face or fingerprint.

Your password still matters and may still be required in certain situations, such as account changes, security checks, or app sign-in prompts.

Questions and Answers

Can I use Windows Hello with Duo for MFA?
Yes. After Windows Hello is set up on your device, you may register Windows Hello as a Duo sign-in method. It can then be used as a sign-in option for supported Duo prompts in Edge or Chrome on that same device. Remember, Windows Hello only works on the device where you enrolled it.

See directions on Platform Authentication in MFA Enrollment and Management.
Who can use Windows Hello?
Windows Hello is available on eligible district devices that are managed through Intune. It is not enabled on traditional Active Directory-only computers.
How do I know if my computer is eligible?
In general, a device must be assigned to you as a staff device. Eligible Intune Windows devices also typically have names that start with SDUSD-, but eligibility depends on management and assignment status, not just the device name.
Is the PIN required?
Yes. The Windows Hello PIN is required for staff on supported devices.
Is facial recognition or fingerprint required?
No. Facial recognition and fingerprint sign-in are optional. If your device supports them, they are recommended because they make sign-in quicker and easier.
Why do I need a PIN if I already have a password?
Your PIN gives you a faster and more secure way to sign in. It only works on the device where you created it, so it cannot be used to sign in on other computers.
Can I use the same PIN on another computer?
No. Your Windows Hello PIN only works on the device where it was created.
Do I still need my password?
Yes. Your password is still important and may still be needed for some apps, account changes, security checks, or support purposes.
Does my fingerprint or face get sent somewhere?
No. With biometrics, Windows Hello does not store an actual photo of your face or fingerprint. It creates a secure encrypted representation on that device only to help verify that it is you. This information stays on the device and is not shared with IT, Microsoft, or anyone else.
What if my device does not show face or fingerprint options?
That usually means the device does not have the required hardware for those features. You can still use your Windows Hello PIN.
What if I get a new or replacement computer?
You will need to set up Windows Hello again on the new device.
What if I forget my PIN?
You may be able to reset it from Windows Settings, then Accounts, then Sign-in options, then PIN (Windows Hello). If you need help, contact the IT Help Desk.
Can I share my PIN with IT or anyone else?
No. Never share your PIN or other credentials with anyone, including IT staff.