HomeNewsletterCommunityMVP FeedToolsArchiveBlogToday's NewsAboutServicesQuick Links Subscribe free
← Back to Blog
Windows Hello for Business WHfBMultifactor UnlockTrusted SignalDevice UnlockIntuneGroup Policy

Windows Hello Multifactor Device Unlock: Require a Trusted Signal, Not Just a PIN

IA
Imran Awan
31 July 2026

Windows Hello for Business (WHfB) already gives you two factors: something you have (the device-bound key) and something you know or are (a PIN or biometric). For most organisations that is plenty. But if a user's PIN can be shoulder-surfed, or people share credentials, "device plus PIN" is weaker than it looks. Trusted signal unlock - the feature most admins have never configured - adds a third requirement: the device only unlocks when it can also see a trusted signal, like a specific Wi-Fi network or a paired phone in Bluetooth range. This post shows exactly how to configure it, GUIDs and signal XML included.

The problem: device plus PIN is not always enough

WHfB unlock normally succeeds on one factor from one category - a PIN, or a fingerprint, or a face. That is fine at a desk. It is not fine when the threat model includes an observed PIN, a shared workstation on a factory floor, or a high-assurance area where physical presence should be part of the check. What you want is: "unlock only if the user proves themselves and the machine is somewhere it is supposed to be." That is what trusted signal unlock delivers, without a custom credential provider and without leaving the familiar Windows sign-in.

Why it happens: two factor groups, one from each

The feature defines two categories of credential provider, and the user must satisfy at least one provider from each before Windows lets them to the desktop:

Each provider is identified by a globally unique identifier (GUID). These are the only supported ones - do not invent others:

CategoryProviderGUID
First factorPIN{D6886603-9D2F-4EB2-B667-1971041FA96B}
First factorFingerprint scan{BEC09223-B018-416D-A0AC-523971B639F5}
First factorFacial recognition{8AF662BF-65A0-4D0A-A540-A338A999D36F}
Second factorTrusted Signal (Bluetooth, IP config, Wi-Fi){27FBDB57-B613-4AF2-9D7E-4FA7A66C21AD}
Watch out: The trusted-signal provider is only supported as the second factor - never the first. And only the four providers above are supported; configuring any other credential provider as a factor is unsupported and can produce unexpected results. Stick to PIN (required) plus optional biometrics for factor one, and trusted signal for factor two.

How to verify: the Device Unlock event log

Trusted signal unlock writes to its own operational log: Applications and Services Logs › Microsoft › Windows › HelloForBusiness, category Device Unlock. The event IDs tell you exactly what happened at each unlock:

Event IDMeaning
3520Unlock attempt initiated
5520Unlock policy not configured
6520Warning event
7520Error event
8520Success event
✓ HelloForBusiness/Device Unlock — Event ID 8520
Log: Microsoft-Windows-HelloForBusiness/Operational
Task category: Device Unlock
Message: Multifactor device unlock succeeded (first + trusted signal satisfied)

Seeing 5520 ("Unlock policy not configured") on a device you targeted means the policy has not applied - check assignment and the credential-provider GUIDs before assuming the signal is at fault.

Watch out: If a user has no trusted factor configured, or their trusted factor is lost, stolen, or replaced, they can be locked out of the device. Ensure every targeted user has a working trusted signal before enforcing, and keep a fall-back (password or smart card) available during rollout. Also note the DontDisplayLastUserName security policy is known to interfere with trusted signal unlock - test them together.
Note: This is device unlock hardening, not a replacement for Conditional Access. Trusted signal unlock decides whether the local session opens; it does not gate access to cloud apps. Pair it with phishing-resistant authentication strength in Conditional Access for defence in depth.
Tip: Roll this out to a small pilot on the exact network and hardware your target users have, and watch the Device Unlock log for a clean run of 3520 → 8520. Because a bad signal rule can lock people out, this is a feature you prove on ten devices before you enforce on a thousand - and you keep the fall-back credential provider enabled until you have.

The fix: enable the policy and define the factors

Group Policy

Group policy pathSettingValue
Computer Configuration \ Administrative Templates \ Windows Components \ Windows Hello for BusinessConfigure device unlock factorsEnabled

Then set the first-factor list to a comma-separated set of GUIDs (order does not matter) and the second-factor list to the trusted-signal GUID.

Intune

Use the Settings Catalog category Administrative Templates › Windows Hello for Business › Device Unlock Plugins, or a custom policy against the PassportForWork CSP node ./Device/Vendor/MSFT/PassportForWork/DeviceUnlock. Configure the first and second factor provider lists, then supply the signal rules.

Defining the trusted signal: the rules XML

The trusted-signal provider is driven by a signal rules XML document. Each rule opens with a rule element carrying schemaVersion="1.0" and contains one or more signal elements of type Bluetooth, ipConfig, or wifi. Here is a corporate-network rule - the device is "trusted" only when it sits on your internal subnet with your DNS suffix:

Signal rules XML — IP configuration
<rule schemaVersion="1.0"> <signal type="ipConfig"> <ipv4Prefix>10.10.10.0/24</ipv4Prefix> <ipv4DnsServer>10.10.0.1</ipv4DnsServer> <dnsSuffix>corp.contoso.com</dnsSuffix> </signal> </rule>

Prefer a paired phone as the presence check? Use a Bluetooth signal. The rssiMin and rssiMaxDelta attributes control how close "in range" means:

Signal rules XML — Bluetooth proximity
<rule schemaVersion="1.0"> <signal type="Bluetooth" scenario="Authentication" classOfDevice="512" rssiMin="-10" rssiMaxDelta="-10"/> </rule>

You can combine rules. Separate rule elements with a comma and either can satisfy the signal (a logical OR); wrap signals in an <and> element to require both (a logical AND). Wi-Fi rules match on ssid, and optionally bssid, security (for example WPA2-Enterprise), and a trustedRootCA thumbprint so an attacker cannot spoof your SSID on an open access point.

Gotcha: classOfDevice="512" is the Bluetooth class for phones. The RSSI values are relative - 0 is stronger than -10, and -10 is stronger than -60. Microsoft's advice is to keep the default rssiMin="-10" / rssiMaxDelta="-10" and test per environment, because the same numbers behave differently in different offices. When the XML is deployed it must be a single line - the multi-line examples here are only wrapped for readability.

Proof it worked: a clean unlock in the event log

Success is a targeted device that opens only when both factors are satisfied, and a HelloForBusiness/Operational log showing a 3520 (attempt) followed by an 8520 (success) for each unlock - with no 5520 ("policy not configured") or 7520 (error). A user off the trusted network or away from the paired device is held at the lock screen, which is the whole point.

References

PowerShell Scripts — Device Unlock Config Reader

Script for this post is in Daily-Tasks.

Get-DeviceUnlockConfig.ps1 — read-only: reads the DeviceUnlock policy, maps the configured factor GUIDs to friendly names, and pulls recent Device Unlock (3520-8520) events
View all scripts on GitHub
Share this post
LinkedIn X / Twitter Reddit Bluesky

More from EndpointWeekly

Windows Hello for Business
How to Cleanly Disable or Remove Windows Hello for Business…
WHfB is enabled by default on every Entra joined device - Autopilot turned it on, not…
Windows Hello for Business
Windows Hello for Business PIN Complexity: Every Setting, CSP…
The WHfB PIN complexity Group Policy is not where you would look, and PIN expiration…
Windows Hello for Business
Windows Hello for Business During Autopilot: Why It Provisions…
A new Autopilot device pops a 'set up a PIN' prompt nobody configured - or fails…