How to set up Windows Hello securely

Secure your Windows device with biometric authentication. Follow this guide to enable Windows Hello Face, Fingerprint, or PIN with hardware-level security.

1. Navigate to Sign-in options. Open the Settings app by pressing the Windows key + I. Select Accounts from the left-hand sidebar, then click on Sign-in options to view available authentication methods.
2. Create a Windows Hello PIN. Windows Hello requires a PIN as a recovery credential. Under Ways to sign in, click PIN (Windows Hello) and select Set up, then verify your user account password when prompted.
3. Enable Facial or Fingerprint recognition. Select Facial recognition (Windows Hello) or Fingerprint recognition (Windows Hello). Click Set up to initialize the sensor hardware, then follow the on-screen prompts to scan your face or finger.
4. Configure dynamic lock settings. Return to the Sign-in options menu and expand the Dynamic lock section. Check the box labeled Allow Windows to automatically lock your device when you're away to ensure your PC secures itself when your paired device moves out of Bluetooth range.
5. Enforce biometric-only access. Under the Additional settings section in Sign-in options, toggle the switch for For improved security, only allow Windows Hello sign-in for Microsoft accounts on this device to ON. This disables legacy password logins for Microsoft services on your machine.