BSI-Analyse: Grenzen der biometrischen Anmeldung mit Windows Hello

16/07/2026 · 3 min read · 🌐 Automatically translated

Das BSI identifiziert Schwachstellen bei Windows Hello for Business – besonders ohne Enhanced Sign-in Security. Was Unternehmen jetzt prüfen und wie sie Risiken mindern.

flowchart LR
  subgraph Identity[Identity & Device Trust]
    A[User device with biometrics]
    A --> B[Windows Hello for Business]
    B --> C{Enhanced Sign-in Security (ESS)?}
  end

  C -- Yes --> D[Strong binding: TPM + device attestation]
  C -- No --> E[Weaker binding: potential bypass vectors]

  D --> F[Authentication to Entra ID]
  E --> F

  subgraph Controls[Security Controls & Monitoring]
    G[Defender policies]
    H[Conditional Access & governance]
    I[Sentinel monitoring]
  end

  F --> J{Access to Azure resources}
  G --> B
  H --> F
  I --> F

  E -. risk alerts .-> I
  D -. compliance signals .-> I

  J --> K[Mitigation actions]
  K --> H
  K --> G

title: What’s new teaser: The Federal Office for Information Security (BSI) has analysed Windows Hello for Business and pointed out vulnerabilities in biometric sign-in, particularly when Enhanced Sign-in Security is not enabled (according to the Heise article). Further details are provided in the linked Heise analysis, alongside recommendations for reassessing risk, strengthening device security, and enforcing robust MFA for sensitive roles. alt_text: Illustration showing security assessment of Windows Hello for Business, highlighting Enhanced Sign-in Security slug: tags: id:

What’s new

The Federal Office for Information Security (BSI) has examined Windows Hello for Business and highlighted weaknesses in biometric sign-in, particularly when Enhanced Sign-in Security is not enabled (according to the Heise article).

Further details of the analysis can be found in the Heise post: https://www.heise.de/news/BSI-seziert-Windows-Hello-Wo-Microsofts-Anmeldung-an-Grenzen-stoesst-11365867.html

What this means for customers

• Risk assessment: Organisations relying on biometric sign-in with Windows Hello for Business should reassess the residual risk without Enhanced Sign-in Security (according to the Heise article).
• Dependence on device and platform protection: The effectiveness of biometric sign-in depends heavily on hardware-backed security features. Without enhanced sign-in protection mechanisms, the attack surface increases (according to the Heise article).
• Compliance and audit: Auditors may require stricter evidence of using Enhanced Sign-in Security or equivalent controls to address authenticity and tampering risks (according to the Heise article).

Recommended actions

1. Short term: Verify whether Enhanced Sign-in Security for Windows Hello for Business is enabled across all relevant device groups; if not, plan prioritised enablement (according to the Heise article).
2. Device security hardening: Ensure that only devices with up-to-date firmware/drivers, a Trusted Platform Module (TPM), and a secured boot chain are permitted for biometric sign-in (according to the Heise article).
3. Policy review: Validate policies in Microsoft Intune/Group Policy for Windows Hello for Business (for example, mandatory use of strong sign-in protection mechanisms) and eliminate configuration drift (own assessment).
4. Enforce strong MFA: For sensitive roles, require Conditional Access with strong, phish-resistant MFA (for example, FIDO2 security keys) as an alternative or complement to biometrics (own assessment).
5. Monitoring and detection: Monitor suspicious sign-in events in Microsoft Sentinel or a SIEM; configure alerts for unusual patterns (own assessment).
6. User education: Inform administrators and end users about the limitations of biometric methods and the requirements for device protection (own assessment).

Integration into practice

• Check/set Intune policy: Define configuration profiles for Windows Hello for Business so that Enhanced Sign-in Security is enforced. Example for an OMA-URI-based setting (as a placeholder, verify the correct OMA-URI in the product documentation):

Name: Enforce Enhanced Sign-in Security
OMA-URI: ./Device/Vendor/MSFT/Policy/Config/Authentication/EnhancedSignInSecurity
Datentyp: Integer
Wert: 1

• Conditional Access in Entra ID: Create a policy that requires FIDO2 keys as phish-resistant MFA for privileged roles and allows Windows Hello only on hardened, compliant devices.
• Sentinel use cases: Set up rules that correlate failed biometric sign-in attempts and changes of authenticators to detect possible bypass attempts.

Assessment

In this assessment, the central message for organisations is clear: Biometrics simplify daily operations but, without strong, hardware-backed protection mechanisms, do not constitute a robust proof of identity. Enhanced Sign-in Security should be considered a minimum standard. For highly sensitive accounts, phish-resistant methods such as FIDO2 and rigorous device compliance checks are additionally recommended. The combination of policy-driven hardening, monitoring, and user education provides balanced protection without excessive friction.