Windows-itpro-docs: Doesn't articulate the drawbacks of key-trust

[webash]

Remote Desktop Connection (RDP) sign-in using Windows Hello for Business (WHfB) isn't possible with key-trust deployments. Additionally, it doesn't make it clear that two Azure AD Connect synchronisations are required in order for WHfB to begin working. These pages should be guiding people to make decisions on which method to use, but they don't give all the information to understand why one option may be better than another.

---

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

• ID: fd3b8524-491d-7f49-0445-a34ed47d504c
• Version Independent ID: 1106b56a-45f9-9465-7c7c-2fa9a68ca807
• Content: Windows Hello for Business Deployment Guide
• Content Source: windows/security/identity-protection/hello-for-business/hello-deployment-guide.md
• Product: w10
• Technology: windows
• GitHub Login: @DulceMontemayor
• Microsoft Alias: dolmont

[jvsam]

@officedocsbot assign @jvsam

[jvsam]

Hi @webash , thank you for your feedback. I will get this issue over to the Windows writing team for review. I also requested the team to update this issue if we need additional information from you.

We want users to have the best Windows 10 experience by ensuring that contents of the Microsoft Docs are useful, relevant and up-to-date. Suggestions, comments and feedback to improve the docs are always welcome!

[Reeced40]

@webash Thank you for your feedback, I will investigate further.

[Reeced40]

@webash Please have a look at this article and let me know if it helps, and I can have it added to the doc. https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-faq

[webash]

These FAQs don't address the two issues I raised in my original comment; unless I've missed them somewhere in the page?

[Reeced40]

@webash Sorry to hear that. I did some more research and found that there is a terms section coming out in the 'how it works' section that goes over key trust, cert trust and the trust types. It should be visible with the next update coming out soon. @DulceMontemayor Could you please advise on update and documentation for this?

[jvsam]

Hello again @webash, thank you for your patience. I just want to inform you that there's already a suggested update to this documentation (see PR #4568) based on your feedback. PRs are normally reviewed/merged in the order of submission but once approved, they will be displayed here at docs.microsoft.com site in the next scheduled publishing run. I will let you know once the PR has been approved and merged.

[webash]

Calling out the RDP limitation is great - thanks for that. I wonder if there are other places where key-trust doesn't work and should all be listed? Otherwise if RDP the only drawback, then this note is great :)

[jvsam]

Calling out the RDP limitation is great - thanks for that. I wonder if there are other places where key-trust doesn't work and should all be listed? Otherwise if RDP the only drawback, then this note is great :)

You're welcome! So far, we only have details on key trust in relation to RDP @webash. And thanks for requesting for it to be clarified on this doc.

[jvsam]

Hi @webash, PR #4568 has been approved and merged. Soon, the updates will be displayed here at docs.microsoft.com. We will now close this issue, however, feel free to re-open if you have other suggestions or ideas to improve the quality of this documentation.

We really appreciate your feedback and thank you for being part of the Microsoft Docs community!

[jvsam]

@officedocsbot close

[webash]

Oops, I must have missed it before but "Windows Hello for business" is missing a capital on the "B". I know it is minor, but it may cause confusion as to whether it is referring to the product Windows Hello for Business or not. @jvsam

[illfated]

Even though the page appears to be updated yesterday, it does not have the full text from the pull request added in the note yet. When it does (not sure how soon), it should read

---

Remote Desktop Protocol (RDP) does not support authentication with Windows Hello for Business key trust deployments. RDP is only supported with certificate trust deployments at this time. See Remote Desktop with Biometrics to learn more.

---

instead of the current text

RDP does not support authentication with Windows Hello for business key trust deployments. RDP is only supported with certificate trust deployments at this time.

[webash]

Very strange!

[illfated]

Yes, well, it is sort of strange. But some times, it takes more than a week for the Github master branch of MicrosoftDocs/windows-itpro-docs to migrate to the docs.microsoft.com pages.