Overview
Learn more about passwordless authentication, how it is supported at the University of Oregon, and different methods with vendor documentation.
Questions
What is Passwordless Authentication?
Passwordless Authentication is logging into a computer or device without the use of a typed password. This could be using your fingerprint, facial recognition, or a USB FIDO2 key. Note: Passwordless authentication is NOT multi-factor (or two-factor) authentication. It does not remove the requirement for DUO from certain account actions.
What forms of Passwordless Authentication does UO Support?
On UO-owned and managed devices, we support Apple's Face ID for iOS, and Touch ID for macOS and iOS devices. We are also now supporting Windows Hello for Business on managed Windows 11 devices with supported Cameras or Fingerprint Scanners.
What is Windows Hello for Business?
Windows Hello for Business is a passwordless authentication method for Windows computers. It uses biometric information (which is all stored locally, and does NOT sync to any other location) to provide login to the local computer, as well as authenticate to Cloud and UO local resources.
What is Face ID?
Face ID is an Apple technology that iPhones can use to recognize the users face and unlock the device.
What is Touch ID?
Touch ID is an Apple technology that some iPads and macOS computers can use to unlock the device or computer using a fingerprint.
How do I configure Windows Hello for Business on my Windows PC?
Enabling Windows Hello for Business on a UO owned device requires hardware support. Most standard Windows laptop computers purchased within the last year have this support as part of the standard. The easiest method to see if your computer supports Windows Hello for Business is to go through the setup process.
To set up Windows Hello for Business
- After logon, go to Start → Settings → Accounts → Sign-in options
- Facial recognition (Windows Hello)
- Fingerprint recognition (Windows Hello)
- PIN (Windows Hello) (setting up either Fingerprint or Facial Recognition also requires configuring a PIN)
- Pick Set up on either of the two options and you will be guided through the process
- Note for PIN option: this is a computer specific password. PINs are minimum 8 characters (currently).
- If setting up Fingerprint recognition, you may Add Finger after it's setup initially.
What about Windows Hello for Business on Desktop Computers?
Desktop computers can also use Windows Hello for Business if they have a compatible webcam and/or fingerprint reader.
We know the following devices to work for Windows Hello for Business
Webcams
Fingerprint Readers
How do I configure Face ID on my iPhone?
To configure Face ID on your phone, go to Settings then Face ID & Passcode. You will be prompted for your Passcode on the phone, then have the option to enable Face ID.
How do I configure Touch ID on my Mac?
To configure Touch ID on your Mac, go into System Settings, then Touch ID & Password and select Add Fingerprint.
What about Touch ID on my Mac Desktop?
Apple does not provide a way to tie into Touch ID with third-party hardware.
To use Touch ID on a Mac Desktop, or a laptop with a dock, you must use an Apple Touch ID-enabled Keyboard (these are included with iMacs, and can be purchased separately via CDW-G).
How do I disable Windows Hello for Business?
To disable Face or Touch recognition for Windows Hello for Business, go to Start → Settings → Accounts → Sign-in options, and Remove the given piece you'd like to disable. If you remove all pieces, including the PIN, Windows Hello for Business will revert to using your account password to unlock saved credentials (like Passwords/Passkeys saved in your browser). To completely disable Windows Hello for Business, please reach out to IT. Completely disabling Windows Hello for Business may result in saved passwords being lost.
How do I disable Touch ID on my Mac?
Open System Settings, "Touch ID & Password" and under Touch ID, remove the Finger(s) you no longer wish to use. After removing all fingers registered with the machine, Touch ID will be disabled.
How do I disable Face ID on my iPhone/iPad?
Go to Settings, "Face ID & Passcode" and select "Reset Face ID". You may need to turn off "Stolen Device Protection" if that's enabled prior to doing the reset.
What should I be aware of regarding any of these technologies?
A few things to be aware of regarding any of these passwordless auth systems. Here are some examples in no particular order.
- Windows Hello for Business is computer specific. Your face, finger, or PIN will work to log you into a different computer unless it has been separately set up.
- Windows Hello for Business can only have 10 registered users on a given computer. This technology is really meant for 1:1 computers, not lab computers, or other shared workstations.
- Windows Hello for Business registrations are removed when a computer is wiped. This means computers that are repurposed or reimaged due to any issue will require re-setting up Windows Hello for Business.
- Certain security technologies, like Passkeys in Google Chrome, rely on Windows Hello to store those credentials securely on the computer. If a browser prompts you for enabling Passkeys, it may enable Windows Hello on that computer, which may change certain behaviors in the browser (suddenly asking for PIN to unlock saved Passwords/Passkeys, for example). This is a security function of Windows, and not a behavior specific to UO owned devices.
- Touch ID does not remove the requirement to use a password to login to your Mac from an off or restart state. This is an Apple restriction and cannot be adjusted.
- Face ID does not remove the requirement to login to your phone with a passcode from an off or restart state. This is an Apple restriction and cannot be adjusted.
How can I learn more about these technologies?
How can I get help setting any of these up or ask questions?
To request help or ask questions, please submit a ticket via Desktop & Mobile Device Support.