How to Configure Windows Hello for Business Cloud Kerberos Trust in Intune

On a domain-joined machine with Domain Admin privileges, open PowerShell as Administrator.

Install and import the module:

1Install-Module -Name AzureADHybridAuthenticationManagement -Force
2Import-Module AzureADHybridAuthenticationManagement

Connect to Entra ID and create the Kerberos server object:

1Connect-AzureAD
2New-AzureADKerberosServer -Domain "yourdomain.com"

Replace yourdomain.com with your actual AD domain. The command creates an AzureADKerberos computer account and a krbtgt_AzureAD user account in your domain. These objects let on-premises resources accept Kerberos tickets issued by Entra ID.

Verify:

1Get-AzureADKerberosServer -Domain "yourdomain.com"

You need both Global Admin (Entra ID) and Domain Admin (on-prem AD) credentials. The command prompts for both.

Run this on a domain controller or a machine with AD RSAT tools for the best experience. The AzureADKerberos object must replicate to all DCs before cloud Kerberos trust works reliably. Wait for AD replication to complete (or force it with repadmin /syncall).

Policy 1: Account Protection (user-targeted)

In Intune, go to Endpoint Security > Account Protection > Create Policy. Select Windows 10 and later, profile Account Protection.

Configure:

• Use Windows Hello For Business (User): Enabled
• Require Security Device (User): Enabled
• Minimum PIN Length: 6
• Lowercase/Uppercase/Special Characters: Allow

Assign to a user security group. Click Create.

Policy 2: Settings Catalog (device-targeted)

Go to Devices > Configuration > Create > New Policy. Select Windows 10 and later, Settings Catalog.

Name it "Windows Hello Cloud Kerberos Trust". Click Add settings, search "Windows Hello for Business" and add:

• Use Cloud Trust For On Prem Auth: Enabled
• Cloud Kerberos Ticket Retrieval Enabled: Enabled
• Use Certificate For On Prem Auth: Disabled

Assign to a device security group. Click Create.

Account Protection policies go to users, Settings Catalog policies go to devices. Don't mix these assignments. If migrating from certificate-based Hello, the 'Use Certificate For On Prem Auth: Disabled' setting is critical to avoid conflicts.

Force a policy sync on a target device:

1C:\Windows\System32\deviceenroller.exe /c /AutoEnrollMDM

Have a test user sign in and set up Windows Hello: Settings > Accounts > Sign-in options > Windows Hello PIN > Set up. Complete MFA verification and create a PIN.

Test on-premises access:

1net use Z: \\fileserver\share
2klist

The klist output should show Kerberos tickets including a krbtgt entry from the cloud. File share access should succeed without any password prompt.

Check device registration:

1dsregcmd /status

Look for AzureAdJoined: YES or DomainJoined: YES + AzureAdPrt: YES.

Check Hello events in Event Viewer:

1Applications and Services Logs > Microsoft > Windows > HelloForBusiness > Operational

Look for Event ID 300-series entries confirming cloud Kerberos trust authentication.

If on-prem access fails, check that the AzureADKerberos object has replicated to the DC the device is authenticating against. Verify VPN or direct line-of-sight to a DC is available. Run klist purge and retry if tickets are stale.