Setting up Microsoft Authenticator and Windows Hello

For a company-managed Windows PC, set up Microsoft Authenticator first so it can complete the multifactor authentication required during Windows Hello for Business enrollment; however, if your company’s enrollment wizard starts automatically, follow its displayed order because it may collect your face before verifying Authenticator and creating the PIN.^1^

1. Set up Microsoft Authenticator on your phone

Authenticator is a mobile app and is not available for Windows PCs or Macs.^2^

1. Install Microsoft Authenticator from the Apple App Store or Google Play Store.
2. On the computer, sign in to your work account.
3. If More information required appears, select Next to open the Keep your account secure wizard.
4. Leave the setup page open on the computer.
5. On your phone, open Authenticator and allow notifications and camera access when requested.
6. Select + or Add account.
7. Select Work or school account.
8. Select Scan a QR code.
9. Return to the computer and select Next until the QR code appears.
10. Scan that code with the phone. Do not scan it with the phone’s normal Camera app.
11. On the computer, select Next. Approve the test notification on your phone.
12. Complete any additional method required by your employer, such as a phone number.^3^

If no setup prompt appears:

1. Open the work-account Security info page:
   https://mysignins.microsoft.com/security-info
2. Select Add sign-in method.
3. Choose Microsoft Authenticator, select Add, and then select Next to display the QR code.
4. In Authenticator, select + → Work or school account → Scan a QR code.
5. Scan the code, select Next on the computer, and approve the test notification.^4^

If scanning fails, select Can’t scan the image on the computer and Enter code manually in Authenticator.^4^

2. Set up Windows Hello facial recognition

Your computer must have a Windows Hello-compatible infrared camera; an ordinary webcam might not support Windows Hello Face.^5^

1. On the Windows computer, open Start → Settings.
2. Select Accounts → Sign-in options.
3. Under Ways to sign in, expand PIN (Windows Hello).
4. Select Set up and create a PIN if Windows has not already asked you to create one.
5. Return to Ways to sign in and expand Facial recognition (Windows Hello).
6. Select Set up → Get started.
7. Enter your Windows Hello PIN when requested.
8. Look directly at the camera while Windows records your face.
9. Complete the wizard. If offered, use Improve recognition, particularly if you wear glasses.
10. Lock the computer with Windows key + L, then test face sign-in.

If your organization launches Windows Hello enrollment automatically, the integrated sequence can instead be:

1. Register your face.
2. Confirm use of Windows Hello with the organization account.
3. Complete MFA through Authenticator.
4. Create and confirm the Windows Hello PIN.^1^

If Authenticator registration is blocked by an administrator policy, or the Hello options say they are managed or unavailable, contact your company’s IT support rather than changing the work-account connection or security policies yourself.

What “a tag is required” means

That message belongs to the Microsoft Q&A website, not to Authenticator or Windows Hello. A tag categorizes and routes the question to the appropriate experts. When posting, select one hierarchical tag from the available dropdown, such as the closest Windows security or Microsoft Authenticator category.^6^

References

1. Prepare users to provision and use Windows Hello for Business
2. Download Microsoft Authenticator | Microsoft Support
3. Set up Security info from a sign-in page | Microsoft Support
4. Work/school
5. Configure Windows Hello | Microsoft Support
6. Ask a question on Microsoft Q&A