Windows sign-in

In this tutorial, we protect Windows sign-in with a second factor: the Windows password and, right after, an approval on the phone. It also works offline, and with help from the support team. The agent installs with an MSI, on Windows 10, 11 and Windows Server. It adds the second factor to sign-in, unlock, remote desktop and, if you want, administrator prompts.

First, create an installation token. Under Manage, Computers, give it a label, choose automatic or manual approval, how many computers can use it, and how long it's valid. The token is shown only once, and it's a secret: treat it like a password. Then deploy the MSI. Through Group Policy, with the ADMX templates and a transform that sets the organisation's address and the token; or through Intune, as a Win32 app.

Start with a pilot group, with the emergency account set. Computers appear under Manage, Computers, with their status, compliance, and where the key lives: in the TPM or in software. Approve the ones waiting for approval, and disable or retire those that should no longer sign in. For whoever signs in, it's simple: they type the Windows password, and the panel shows a number.

On the phone, they open the request, check the computer's name, type the number, approve, and confirm with their fingerprint. The computer policy is under Offline sign-in and emergency. Set how many days and how many sign-ins are allowed offline, when the second factor is required, and the emergency account. The policy is signed: a GPO can't widen it.

Without a network, anyone who has already signed in online on that computer uses their offline code. They get it from the console, under Protect, Trusted devices, One-time codes, and scan the QR with their authenticator app. And if there's no phone and no code, the support team helps. The panel shows a ten-digit challenge. The technician first confirms who is calling, opens the computer's details, and gets the response, which they read to the person.

It works offline, and each response works only once. On each computer, the sign-in history shows who signed in, how, and with what result. That's where support sees why a phone received nothing. And that's it: Windows protected, online or offline. In the next tutorial, we'll bring people in from Entra ID and Okta through SCIM.