Windows Hello for Business cloud Kerberos trust: UseCloudTrustForOnPremAuth, Entra Kerberos and hybrid devices

Microsoft Entra hybrid joined device

The partial TGT is obtained at sign-in, which allows immediate Active Directory authentication.

1. Windows Hello gesture. LSASS checks that cloud Kerberos trust is enabled by policy, then passes the credentials to Cloud AP, which requests a nonce from Entra ID.
2. Signature. Cloud AP signs the nonce with the user's private key and returns it to Entra ID.
3. Validation. Entra ID checks the signature with the registered public key, then creates a PRT (primary refresh token) and a partial TGT from Microsoft Entra Kerberos.
4. Caching. Cloud AP decrypts the session key with the device's transport key and protects it with the TPM if there is one. LSASS caches the PRT and the partial TGT.
5. Exchange. The Kerberos provider infers the domain from the Hello key metadata, locates a domain controller (DClocator) and sends it the partial TGT, which holds only the user's SID, signed by Entra Kerberos. The controller validates it and the KDC returns a full TGT, cached for service ticket requests. The session opens.

Microsoft Entra joined device (no domain)

At sign-in the device authenticates to Entra ID only and gets its PRT. The exchange with a domain controller happens on demand: the first time a resource requires Kerberos, the partial TGT received earlier is presented to the domain controller, which returns a full TGT.

Step 1 — Deploy Microsoft Entra Kerberos (once per domain)

If passwordless security key sign-in to on-premises resources is already deployed, Entra Kerberos is too: go to step 2. Otherwise install the AzureADHybridAuthenticationManagement module on the Entra Connect server, or on a server that has Microsoft.Online.PasswordSynchronization.Rpc.dll, in a « Run as administrator » PowerShell session. Repeat in every domain and forest that holds Entra users.

[Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12
Install-Module -Name AzureADHybridAuthenticationManagement -AllowClobber

# Le domaine Active Directory où l'objet sera créé.
$domain = $env:USERDNSDOMAIN

# Administrateur d'identité hybride (Entra ID), puis administrateur du domaine.
$cloudCred  = Get-Credential
$domainCred = Get-Credential

# Crée l'objet dans Active Directory et le publie dans Entra ID.
Set-AzureADKerberosServer -Domain $domain -CloudCredential $cloudCred -DomainCredential $domainCred

Then check that the object exists on both sides:

Get-AzureADKerberosServer -Domain $domain -UserPrincipalName $userPrincipalName -DomainCredential (Get-Credential)

The KeyVersion property (on-premises side) must equal CloudKeyVersion (Entra ID side). The same goes for DomainDnsName and CloudDomainDnsName, ID and CloudId. Enter the domain account in UPN format rather than domain\account: the latter goes through NTLM and fails.

Step 2 — Configure the policy

Two settings are required, a third is optional but recommended. If the tenant-wide Windows Hello for Business policy is already enabled and configured the way you want, it is enough to enable Use Cloud Trust For On Prem Auth.

Variant with a custom profile (OMA-URI), each value of type bool set to True, replacing {TenantId} with your tenant ID:

./Device/Vendor/MSFT/PassportForWork/{TenantId}/Policies/UsePassportForWork
./Device/Vendor/MSFT/PassportForWork/{TenantId}/Policies/UseCloudTrustForOnPremAuth
./Device/Vendor/MSFT/PassportForWork/{TenantId}/Policies/RequireSecurityDevice

Step 3 — Enrolment

Enrolment starts as soon as the user signs in, if the prerequisite checks pass: the user optionally sets up a biometric gesture, completes multifactor authentication, then creates a PIN that meets the device's complexity policy. Once enrolment is done the gesture is usable immediately on an Entra-joined device. On a hybrid device the first use of the PIN needs line of sight to a domain controller; after that, cached sign-in works with no network. Entra Connect then synchronises the user's key to Active Directory, but cloud Kerberos trust does not have to wait for that synchronisation.

Unsupported scenarios

• Remote Desktop or VDI with supplied credentials. It remains possible with Remote Credential Guard, or if a certificate is enrolled in the Windows Hello for Business container.
• « Run as » with cloud Kerberos trust.
• Signing in on a hybrid device that has never had domain controller connectivity.
• Purely on-premises environments, with no Entra ID.

Maintaining the Entra Kerberos object

The krbtgt keys of the Entra Kerberos server must be rotated regularly, on the same schedule as your other domain controller krbtgt keys, and only with the AzureADHybridAuthenticationManagement module: any other tool would update only the on-premises side, and Active Directory and Entra ID would no longer match.

Set-AzureADKerberosServer -Domain $domain -CloudCredential $cloudCred -DomainCredential $domainCred -RotateServerKey