---
title: ISAC support Windows Hello for Business with SAML authentication
slug: windows-hello-for-business/isac-support-windows-hello-for-business-with-saml-authentication
docTags: 
createdAt: 2026-09-29T05:52:23.188Z
---

Initiate a connection from ISAC opens a browser window  to complete SAML authentication with the configured identity provider. If Windows Hello for Business is enrolled on the device and the browser is configured for SSO, authentication is successful without password. This is supported on Microsoft Edge (native support), Google Chrome (requires the Microsoft Single Sign On extension), or Mozilla Firefox (requires the Firefox Windows SSO setting enabled).

##  Workflow

1. Sign in to Windows with your Windows Hello credential — PIN, fingerprint or face.
2. Configure the VPN connection profile in ISAC with WHfB SAML realm on ICS.
3. Open ISAC and select the configured VPN connection profile.
4. Click **Connect**.

Based on configuration on ICS, either a browser window opens or an embedded browser is used to complete SAML authentication with the identity provider. If the Windows Hello session is active and the browser is configured, the VPN connection is established automatically without any password prompt. 

## Browser Requirements for SAML Authentication

By default, ISAC uses an embedded browser for SAML authentication. 

If the administrator has configured ISAC to use an external browser, connect using Microsoft Edge, Google Chrome, or Mozilla Firefox. For Windows Hello for Business SSO to silently  complete via the external browser, the following configuration is required:

 

| Browser         | SSO Support                  | Requirement                                                                                                   |
| --------------- | ---------------------------- | ------------------------------------------------------------------------------------------------------------- |
| Microsoft Edge  | Native — no extension needed | None. PRT-based SSO is built into Edge on Windows 10 and later.                                               |
| Google Chrome   | Supported via extension      | Install the **Microsoft Single Sign On** extension from the Chrome Web Store.                                 |
| Mozilla Firefox | Supported via setting        | Firefox version 91 or later. Go to **about\:config** and set<br />*network.http.windows-sso.enabled* to true. |

 

## Configuring ICS server on Microsoft Azure

To configure the ICS server, perform the following:

- SAML authentication on Azure IDP server
- Configuring Single Sign-on Settings
- Assigning User to Application

For more information, see [Microsoft Azure Active Directory Configuration](https://help.ivanti.com/ps/help/en_US/ICS/vNow/maadsidg/ms_azure_ad.htm).

## Configuring SAML authentication on ICS server

### 1. Uploading Metadata

1. Navigate to System > Configuration > SAML to upload Metadata.
2. Select New Metadata Provider.
   Enter a name.
3. Set Location as Local.
4. Browse to Upload SAML Metadata XML.
5. Check the Accept Unsigned Metadata option.
6. In the Roles field, check the Identity Provider option.
7. Save Changes.

::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/q9fXWMkqBSBUwYKh6vXGa_meta.png" position="flex-start" size="89" width="620" height="632" initialPath="resources/images/meta.png" githubPath="WHB/resources/images/meta.png" darkWidth="620" darkHeight="632" showCaption="false"}

### 2. Creating a New Auth Server

1. Navigate to Authentication >Auth. Servers > SAML Server > New Server.
   Enter a name.
2. In the Configuration Mode, check the Metadata option.
3. In the Service Provider Metatdata Settings, set the Metadata Validity to 365.
4. Select Save Changes.

::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/2OdtoBCs0RHezdRfZpn5E_auth.png" position="flex-start" size="89" width="620" height="638" initialPath="resources/images/auth.png" githubPath="WHB/resources/images/auth.png" darkWidth="620" darkHeight="638" showCaption="false"}

### 3. Create User Realm

1. Navigate to Users > User Realms >New Realm.
   Enter a Name.
2. In the Server section, navigate to Authentication and select SAML as the auth server.
3. Select Save Changes.

::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/frJA-_fCEWX4_24Ik8etJ_realm.png" position="flex-start" size="69" width="480" height="642" initialPath="resources/images/realm.png" githubPath="WHB/resources/images/realm.png" darkWidth="480" darkHeight="642" showCaption="false"}

### 4. Map new realm with a role

1. Navigate to Users > Role Mapping >New Rule.
   Enter a Name.
2. Select an Available Role.
3. Select Save Changes.

![](https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/4FeEAUNIk7eMi21vYxLXF_1realm.png)

### 5. Create new Sign-In-Policies

1. Navigate to Authentication > Sign-In-Policies >New URL.
2. Provide a Sign-In URL.
3. Select Available Realm.
4. Select Save Changes.

::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/EzDW6_YLjh6WXhRPtWDsm_policy.png" position="flex-start" size="89" width="620" height="638" initialPath="resources/images/policy.png" githubPath="WHB/resources/images/policy.png" darkWidth="620" darkHeight="638" showCaption="false"}