---
title: ISAC support Windows Hello for Business SSO for Hybrid-joined devices - Non SAML Authentication
slug: windows-hello-for-business/isac-support-windows-hello-for-business-sso-for-hybrid-joined-devices-non-saml-authentication
docTags: 
createdAt: 2026-09-29T05:52:23.211Z
---

Windows Hello for Business (WHfB) SSO enables passwordless authentication for domain-joined devices by using credentials stored on the device.

### Prerequisites:

- Ensure that the device is Microsoft Entra joined (cloud-only) or Microsoft Entra Hybrid joined (on-premises AD + Entra ID).

:::hint{type="info"}
On-premises domain-only joined devices are not supported.
:::

- Windows Hello for Business is enrolled for the user on the end point. To set up, navigate to **Settings** > **Accounts** > **Sign-in options** and complete setup for Windows Hello PIN, fingerprint, or face recognition.
- Windows 10 (version 1903 or later) or Windows 11.

### Procedure:

1. In the MS Azure portal, navigate to **App registrations** > **New registration** .
2. Provide an application name and click **Register**.
3. Ensure to save the **Application (client) ID** and the **Directory (tenant) ID** details.
4. Select **App registrations** > **Authentication (Preview)**, toggle the **Allow public client flows** to **Enabled**.

![](https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/KMYoWpNXnSx3lZO0vmLIx_msenabled.png)

:::Paragraph{listStyleType="decimal" listStart="5" listRestartPolite="5" indent="2"}
In the **Redirect URIs configuration** **for both Mobile and Desktop**, select and add the following:
:::

:::Paragraph{listStyleType="decimal" indent="3"}
https\://login.microsoftonline.com/common/oauth2/nativeclient
:::

:::Paragraph{listStyleType="decimal" listStart="2" indent="3"}
ms-appx-web://Microsoft.AAD.BrokerPlugin/\<CLIENT\_ID>
:::

:::hint{type="info"}
Replace the \<CLIENT\_ID> with the **Application (client) ID**.
:::

![](https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/e6SQjWZWJF2qFxsLhgh_9_redirect.png)

:::Paragraph{listStyleType="decimal" listStart="6" listRestartPolite="6" indent="2"}
Select **Home** > **App registrations** > select the application > **API permissions** > Add a permission.
:::

:::Paragraph{listStyleType="decimal" indent="3"}
In Microsoft Graph, select **Delegated permissions**, select **User**: **Read** and select **Add Permissions.**
:::

:::Paragraph{listStyleType="decimal" listStart="2" indent="3"}
Click **Grant admin consent** for \<your organization> , click **Yes** to confirm.
:::

:::Paragraph{listStyleType="decimal" listStart="7" indent="2"}
Select **Home** > **App registrations** > **Manage&#x20;**> **Owners&#x20;**> **Add Owners&#x20;**> Add user.
:::



The following steps are configured in Ivanti Connect Secure:

### Configuration on Ivanti Connect Secure

:::Paragraph{listStyleType="decimal" indent="2"}
In Ivanti Connect Secure, select **Authentication&#x20;**>**&#x20;Auth. servers** > **New Server** >**Windows Hello for Business SSO server**.
:::

:::Paragraph{listStyleType="decimal" listStart="2" indent="2"}
Add the **Client ID** and **Tenant ID**.
:::

:::Paragraph{listStyleType="decimal" listStart="3" indent="2"}
Click **Save Changes**.
:::

### Configuration of Fallback Authentication Support&#x20;

:::Paragraph{listStyleType="decimal" indent="2"}
In Ivanti Connect Secure, select **Users&#x20;**> **User Realms&#x20;**>  **User Realms** > **Users&#x20;**> **General&#x20;**>**&#x20;Enable Fallback Authentication Server.**
:::

:::Paragraph{listStyleType="decimal" listStart="2" indent="2"}
Select the Server type.
:::

:::hint{type="info" indent="3"}
The authentication server type must be Windows Hello for Business. Ensure server details have the same **Client ID** and **Tenant ID**.
:::

:::hint{type="info" indent="2"}
**Windows Hello for Business (WHFB)&#x20;**&#x20;authentication supports  **OAuth&#x20;**&#x61;nd **SAML&#x20;**&#x61;s fallback authentication methods. The OAuth or SAML authentication server configured as a fallback for Windows Hello for Business (WHFB) SSO must belong to the same  **Tenant ID&#x20;**&#x61;s the WHFB authentication server.
:::

:::Paragraph{listStyleType="decimal" listStart="3" indent="2"}
Click **Save Changes**.
:::