How is authentication changing for single-user Windows computers?

Overview

Historically, MSU Denver faculty, staff, and students have logged into Windows computers with a combination of their username or email address and network password. Starting in the Fall 2026 semester, ITS will be introducing an additional way for faculty and staff to log in to their assigned MSU Denver workstations (A.K.A. "single-user" machine). This authentication framework is called Windows Hello for Business. This Microsoft product allows enterprise users to log in to their computers using phishing-resistant authentication methods such as a PIN, fingerprint or facial recognition.

Before you begin...

Your computer must be

• A Windows computer. For the macOS equivalent, see How is authentication changing for single-user macOS computers?
• A single-user workstation (i.e. a computer assigned to a full-time faculty or staff). Windows Hello for Business is not used on shared-use computers like front desks and computer labs. Authentication on those kinds of devices uses your MSU Denver email address and network password.
• Fully cloud-managed. Computers provisioned in August 2024 and later are cloud-managed. Computers provisioned before this time may not be eligible. Eligible users were sent a targeted email letting them know of this change.

Understand PIN versus password

In this article we use the term "password" or "network password" to refer to your MSU Denver account password. This is the password you use to log in to single sign on prompts in a web browser and is associated with your @msudenver.edu email address. We use "PIN" to refer to a 6 or more digit number that you will use to authenticate on your assigned MSU Denver workstation. This PIN does not allow you to authenticate anywhere else besides this computer and no one from MSU Denver ITS will ever ask you for it.

Understand biometrics

• While Windows Hello for Business enrollment is mandatory, the use of biometrics is optional. At a minimum, you will only be required to set up a PIN.
• Not all devices have a fingerprint scanner or infrared camera used for facial recognition. All devices can use a PIN.
• MSU Denver and Microsoft can never retrieve your fingerprint or facial recognition profile. By design, this data is strictly kept on your device and is never transmitted to servers or across networks. For more information, see Microsoft Learn | Windows Hello for Business | Biometric sign-in and Microsoft | Windows Hello.

How to enroll

During the optional enrollment period

1. Open the Settings app from your Start menu and navigate to Accounts > Sign-in options.
2. Select a sign-in option with "Windows Hello" in the title.

3. Set a PIN. Your PIN must be 6 or more digits long. Your PIN must be strictly numeric. The use of letters and symbols is not allowed.

4. (Optional) set up fingerprint or facial recognition (if your computer has the requsiste hardware).
5. Click OK to complete the process.

During the mandatory enrollment period

You will be prompted to set up Windows Hello for Business the next time you sign in to your computer.

1. Click OK to start the enrollment process.

2. Perform MFA (multi-factor authentication) if you are prompted to do so.

3. If your computer has a fingerprint reader or compatible facial recognition camera, you will be prompted to set up biometrics. This is OPTIONAL. If you prefer to use a PIN only, click Skip for now.

4. Set a PIN. Your PIN must be 6 or more digits long. Your PIN must be strictly numeric. The use of letters and symbols is not allowed.

4.  Click OK to complete the process.

Signing in from the lock screen

At the lock screen, you can sign in with up to four possible methods depending on which ones your computer supports and which ones you registered:

• Password
• Fingerprint
•  PIN
• Face

Windows will remember the last method you used and present that to you the next time you need to log in. If you experience issues logging in with one method, try another. Click Sign-in options to see all available methods.

Resetting your PIN

If you forget your PIN, you can reset it.

Method 1: Settings app

1. Sign in to your computer with your Password first. Remember, this is your MSU Denver network password. The same one you would use to sign in to your email in a web browser for example.
2. Open the Settings app from your Start menu and navigate to Accounts > Sign-in options.
3. Expand the PIN (Windows Hello) option.

1. Click I forgot my PIN.
2. Set a new PIN.

Method 2: Lockscreen

1. From the lockscreen with your name and profile picture visible, click I forgot my PIN.

2. Enter your Password when prompted. Remember, this is your MSU Denver network password. The same one you would use to sign in to your email in a web browser for example.

2. Perform MFA (multi-factor authentication).

2. Set a new PIN.

Ineligible computers

If your computer was provisioned before August 2024, it may not be fully cloud managed and will not be targeted for this rollout.

If you wish to use Windows Hello for Business

You can still enroll but there are special steps you must follow and you must be on campus in order to connect to our authentication servers. Reach out to ITS if you are interested and we will work with you to make sure the enrollment goes smoothly.

If you do nothing

Your computer will not be targeted for this rollout and nothing will change for you. Since our computers are leased on a 4 year cycle, your computer will eventually be returned and replaced with a new one. You will be required to enroll in Windows Hello for Business on the new machine.