Microsoft Passport for Work Configuration for Microsoft Passport for Work Microsoft Passport for Work PIN Complexity Use Microsoft Passport for Work Allow Disallow Required Microsoft Passport for Work is an alternative method for signing into Windows using your Active Directory or Azure Active Directory account that can replace passwords, Smart Cards, and Virtual Smart Cards. If you enable or do not configure this policy setting, the device provisions Microsoft Passport for Work for all users. If you disable this policy setting, the device does not provision Microsoft Passport for Work for any user. Use a hardware security device A Trusted Platform Module (TPM) provides additional security benefits over software because data stored within it cannot be used on other devices. If you enable this policy setting, only devices with a usable TPM provision Microsoft Passport for Work. If you disable this policy setting, all devices provision Microsoft Passport for Work using software even if there is a usable TPM. If you do not configure this policy setting, all devices provision Microsoft Passport for Work using software if the TPM is non-functional or unavailable. Minimum PIN length Minimum PIN length configures the minimum number of characters required for the work PIN. The lowest number you can configure for this policy setting is 4. The largest number you can configure must be less than the number configured in the Maximum PIN length policy setting or the number 127, whichever is the lowest. If you configure this policy setting, the work PIN length must be greater than or equal to this number. If you disable or do not configure this policy setting, the work PIN length must be greater than or equal to 4. NOTE: If the above specified conditions for the minimum PIN length are not met, default values will be used for both the maximum and minimum PIN lengths. Maximum PIN length Maximum PIN length configures the maximum number of characters allowed for the work PIN. The largest number you can configure for this policy setting is 127. The lowest number you can configure must be larger than the number configured in the Minimum PIN length policy setting or the number 4, whichever is greater. If you configure this policy setting, the work PIN length must be less than or equal to this number. If you disable or do not configure this policy setting, the work PIN length must be less than or equal to 127. NOTE: If the above specified conditions for the maximum PIN length are not met, default values will be used for both the maximum and minimum PIN lengths. Use uppercase letters Use this policy setting to configure the use of uppercase letters in the Microsoft Passport for work PIN. If you configure this policy setting to “Allow” Microsoft Passport for Work allows users to use uppercase letters in their work PIN. If you configure this policy setting to “Disallow”, Microsoft Passport for Work prevents users from using uppercase letters in their work PIN. If you configure this policy setting to “Required”, Microsoft Passport for Work requires users to include at least one uppercase letter in their work PIN. If you disable or do configure this policy setting, Microsoft Passport for Work allows users to use uppercase letters in their work PIN. Use lowercase letters Use this policy setting to configure the use of lowercase letters in the Microsoft Passport for work PIN. If you configure this policy setting to “Allow”, Microsoft Passport for Work allows users to use lowercase letters in their work PIN. If you configure this policy setting to “Disallow”, Microsoft Passport for Work prevents users from using lowercase letters in their work PIN. If you configure this policy setting to “Required”, Microsoft Passport for Work requires users to include at least one lowercase letter in their work PIN. If you disable or do not configure this policy setting, Microsoft Passport for Work allows users to use lowercase letters in their work PIN. Use special characters ? @ [ \ ] ^ _ ` { | } ~ . If you configure this policy setting to “Allow”, Microsoft Passport for Work allows users to use special characters in their work PIN. If you configure this policy setting to “Disallow”, Microsoft Passport for Work prevents users from using special characters in their work PIN. If you configure this policy setting to “Required”, Microsoft Passport for Work requires users to include at least one special character in their work PIN. If you disable or do not configure this policy setting, Microsoft Passport for Work allows users to use special characters in their work PIN. ]]> Use digits Use this policy setting to configure the use of digits in the Microsoft Passport for work PIN. If you configure this policy setting to “Allow”, Microsoft Passport for Work allows users to use digits in their work PIN. If you configure this policy setting to “Disallow”, Microsoft Passport for Work prevents users from using digits in their work PIN. If you configure this policy setting to “Required”, Microsoft Passport for Work requires users to include at least one digit in their work PIN. If you disable or do not configure this policy setting, Microsoft Passport for Work allows users to use digits in their work PIN. Use biometrics Microsoft Passport for Work enables users to use biometric gestures, such as face and fingerprints, as an alternative to the PIN gesture. However users must still configure a work PIN to use in case of failures. If you enable this policy setting, Microsoft Passport for Work allows the use biometric gestures on. If you disable this policy setting, Microsoft Passport for Work prevents the use of biometric gestures. If you do not configure this policy setting, Microsoft Passport for Work allows the use of biometric gestures. NOTE: Disabling this policy prevents the user of biometric gestures on the device for all account types. Minimum PIN length Maximum PIN length Uppercase letters: Lowercase letters: Special characters: digits: