Contoso wants to implement Windows Hello for Business.
Walking through the "Planning a Windows Hello for Business Deployment" process with Contoso resulted in the following deployment parameters:
1. Hybrid - customer has AD and Azure AD (federated environment with ADFS)
2. Certificate Trust - customer already has ADCS PKI and wants to reuse WHFB certificates for other purposes (e.g., AlwaysOn VPN.)
3. All PCs are Hybrid Azure AD Joined (no non-domain-joined PCs; no Azure AD Joined PCs.)
4. Contoso wants to use Modern Management (Intune) policy to manage the WHFB PCs - not Group Policy.
Note that Contoso is a federated environment, so they could use group policy and an ADFS RA. But they don't want to (creates another dependency on ADFS, which is undesirable.)
Above requirements yield a need for an NDES Registration Authority.
The Windows Hello for Business Hybrid Certificate Trust Deployment Guide does not document this scenario with modern management and an NDES RA. It only describes deployment with Group Policy management and an AD FS RA. (link: https://docs.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-hybri...)
Is it supported to deploy Windows Hello for Business Hybrid Certificate Trust using only modern management and an NDES RA?
(Note: I can supply the WHFB planning worksheet for Contoso.)
