Use uppercase letters

Use this policy setting to configure the use of uppercase letters in the Microsoft Passport for work PIN.If you configure this policy setting to “Allow” Microsoft Passport for Work allows users to use uppercase letters in their work PIN.If you configure this policy setting to “Disallow” Microsoft Passport for Work prevents users from using uppercase letters in their work PIN.If you configure this policy setting to “Required” Microsoft Passport for Work requires users to include at least one uppercase letter in their work PIN.If you disable or do configure this policy setting Microsoft Passport for Work allows users to use uppercase letters in their work PIN.

Maximum PIN length

Maximum PIN length configures the maximum number of characters allowed for the work PIN. The largest number you can configure for this policy setting is 127. The lowest number you can configure must be larger than the number configured in the Minimum PIN length policy setting or the number 4 whichever is greater.If you configure this policy setting the work PIN length must be less than or equal to this number.If you disable or do not configure this policy setting the work PIN length must be less than or equal to 127.NOTE: If the above specified conditions for the maximum PIN length are not met default values will be used for both the maximum and minimum PIN lengths.

Maximum PIN length

Maximum PIN length configures the maximum number of characters allowed for the work PIN. The largest number you can configure for this policy setting is 127. The lowest number you can configure must be larger than the number configured in the Minimum PIN length policy setting or the number 4 whichever is greater.If you configure this policy setting the work PIN length must be less than or equal to this number.If you disable or do not configure this policy setting the work PIN length must be less than or equal to 127.NOTE: If the above specified conditions for the maximum PIN length are not met default values will be used for both the maximum and minimum PIN lengths.

Minimum PIN length

Minimum PIN length configures the minimum number of characters required for the work PIN. The lowest number you can configure for this policy setting is 4. The largest number you can configure must be less than the number configured in the Maximum PIN length policy setting or the number 127 whichever is the lowest.If you configure this policy setting the work PIN length must be greater than or equal to this number.If you disable or do not configure this policy setting the work PIN length must be greater than or equal to 4.NOTE: If the above specified conditions for the minimum PIN length are not met default values will be used for both the maximum and minimum PIN lengths.

Minimum PIN length

Minimum PIN length configures the minimum number of characters required for the work PIN. The lowest number you can configure for this policy setting is 4. The largest number you can configure must be less than the number configured in the Maximum PIN length policy setting or the number 127 whichever is the lowest.If you configure this policy setting the work PIN length must be greater than or equal to this number.If you disable or do not configure this policy setting the work PIN length must be greater than or equal to 4.NOTE: If the above specified conditions for the minimum PIN length are not met default values will be used for both the maximum and minimum PIN lengths.

Use biometrics

Microsoft Passport for Work enables users to use biometric gestures such as face and fingerprints as an alternative to the PIN gesture. However users must still configure a work PIN to use in case of failures.If you enable this policy setting Microsoft Passport for Work allows the use biometric gestures on.If you disable this policy setting Microsoft Passport for Work prevents the use of biometric gestures.If you do not configure this policy setting Microsoft Passport for Work allows the use of biometric gestures.NOTE: Disabling this policy prevents the user of biometric gestures on the device for all account types.

Use a hardware security device

A Trusted Platform Module (TPM) provides additional security benefits over software because data stored within it cannot be used on other devices.If you enable this policy setting only devices with a usable TPM provision Microsoft Passport for Work.If you disable this policy setting all devices provision Microsoft Passport for Work using software even if there is a usable TPM.If you do not configure this policy setting all devices provision Microsoft Passport for Work using software if the TPM is non-functional or unavailable.

Use Microsoft Passport for Work

Microsoft Passport for Work is an alternative method for signing into Windows using your Active Directory or Azure Active Directory account that can replace passwords Smart Cards and Virtual Smart Cards.If you enable or do not configure this policy setting the device provisions Microsoft Passport for Work for all users.If you disable this policy setting the device does not provision Microsoft Passport for Work for any user.

Untrusted Font Blocking

This security feature provides a global setting to prevent programs from loading untrusted fonts. Untrusted fonts are any font installed outside of the %windir% -> Fonts directory. This feature can be configured to be in 3 modes: On Off and Audit. By default it is Off and no fonts are blocked. If you aren’t quite ready to deploy this feature into your organization you can run it in Audit mode to see if blocking untrusted fonts causes any usability or compatibility issues.