Overview

Ivanti Secure Access Client (ISAC) and Ivanti Connect Secure (ICS) support Windows Hello for Business (WHfB) Single Sign-On for VPN authentication, enabling users to connect to VPN using the same credential they used to sign in to Windows — a PIN, fingerprint, or facial recognition — without being prompted for a password again.

Windows Hello for Business is Microsoft's passwordless authentication solution built into Windows 10 and Windows 11. Authentication is protected by a device-bound key pair stored in the hardware TPM and backed by Microsoft Entra ID. For more information, see Windows Hello for Business and Authentication methods in Microsoft Entra ID.

Users initiate a connection from ISAC and are redirected to Microsoft Entra ID through a browser-based authentication flow. If a valid Windows Hello for Business session already exists, user can authenticate without entering a password. This model supports Microsoft Edge, Google Chrome, and Mozilla Firefox when the required Microsoft SSO settings are configured.

Users authenticate silently using their existing Windows Hello for Business session. ISAC obtains an OAuth access token from Microsoft Entra ID and uses it to authenticate with ICS, eliminating the need for browser interaction, passwords, or certificates. The connection process is seamless and passwordless.