End user login experience on Windows

Updated February 10, 2023

This topic describes in detail the Login for Windows experience for your end users to help you decide what configurations are best for your organization.

Important

If using a proxy that becomes unavailable, Login for Windows behaves as if it is offline. This issue might impact laptop users who connect their laptops to networks in which the proxy is unavailable.

First login with password only

End users can log in without second-factor authentication for the number of days set by the administrator in the Grace Period option. This allows end users to log in with a password only (without using second-factor authentication), and typically occurs after the Login for Windows installation. End users can then access their device to set up their two-factor authentication methods, such as push-to-accept and answers to Security Questions, before they must authenticate to access their device.

Use case: Password-only login is useful for one or more new employees who have been issued a laptop on their first day of employment. For example, if Login for Windows is already installed on the laptops and the admin has not set the Grace Period option, new employees might not be able to log into their computer if they cannot connect to the SecureAuth Identity Platform realm to register their mobile phone or self-service page to enter a phone number.

Workflow: End users are prompted to log in with their username and password only. The login screen indicates the number of days end users can continue to log in with a password only on the machine, as shown in the following image.

End users who want to log in with a password only enter their password in the field next to number 1. After end users set up their second-factor methods, they are ready to authenticate so they click the message next to number 2, which dismisses the password-only screen and opens the 2FA login screen. Thereafter, the 2FA login screen opens for end users.

Login without connection to Identity Platform

End users can log in when their machine does not have a connection to the Identity Platform if the Install Login for Endpoint without connection to Identity Platform and Grace Period options are set. This allows end users to log in with a password only (without using second-factor authentication).

Use case: Password-only login is useful if a third-party company configures machines for end users and the third-party company does not have connectivity to the Identity Platform. For example, if Login for Windows is installed on machines by a third-party without a connection to the Identity Platform, and the admin has not set the Install Login for Endpoint without connection to Identity Platform and Grace Period options, when new employees get their machine, they will not be able to log in.

End users whose machines are not connected to the Identity Platform should contact the admin first so they can copy the message next to number 1 and send it to their admin. End users can then log in with a password only in the field next to number 2. After the machine connects to the Identity Platform, the 2FA login screen opens for end users so they can set up their second-factor methods and log in.

Login with VPN client

If you have VPN clients and you enabled a pre-logon access provider by setting the Auto add pre-logon access providers option, end users can connect to your VPN server before logging into Login for Windows. The frequency that end users must log into the VPN client depends on settings completed by the administrator. When end users log into their machine, they will first select the VPN login icon, called Network sign-in, which is shown in the following image surrounded by a red box:

End users can then authenticate with Login for Windows.

First-time login experience

If the administrator has set up a mandatory questionnaire for your organization to fill out prior to logging into Login for Windows, you will log in with a username and then you will be redirected to the questionnaire. After you fill out the questionnaire and submit it, close the browser to display the second-factor authentication screen.

Note that if different end users log into the same machine by using Other User, the Windows Credential Provider causes the end user that has answered the questionnaire to complete an extra step before logging in. The following describes the workflow for this scenario:

David logs off the workstation.
Maria sits at the same workstation, clicks Other User, and enters her username. Maria sees the "Additional information required" message, clicks the link, and fills out the questionnaire. She submits the form and closes the browser.
Maria sees the login screen for David. She must click Other User again, enter her username again, then she will see the 2FA screen where she can enter her password and MFA option to log in.

Enter your username on the Windows login screen.
To authenticate by using a different primary credential provider, see the Allow other credential providers setting on the Personalization tab of the Login for Endpoints installer configuration in Configure Identity Platform and Login for Endpoints.
The first time end users log in, Login for Windows shows only OATH-based methods (for example, TOTP, HOTP YubiKey), if at least one method is available to end users. If at least one OATH-based method is not available to end users, they can use any other available method. This could be a method that uses the SecureAuth Authenticate app on your mobile device or another device provisioned with the SecureAuth Identity Platform realm to supply timed passcodes, such as an HOTP YubiKey.
If the end users need to login when their machine is offline, they must choose an OATH-based method during the first login. After end users select a timed authentication option and enter their password, TOTP and HOTP passcode options will be available for them to use when logging on the machine offline.
End users with more than one mobile phone or YubiKey provisioned can select which device or token to use when online. When logging on the machine offline, any OATH-based method that was used online will be available for use.
If you do not have an authentication method that provides a timed passcode, then select any other option available to you.
End users who already use the Authenticate app and want to add the ability to accept biometric push notifications to use face (iOS) or fingerprint recognition must first reconnect the account for their mobile device.
You can provision either "Approve login" or "Symbol-to-Accept." The following image shows the login screen with the "Approve login notification on mobile" option; if "Symbol-to-Accept" is set, end users will see the "Passcode from Symbol-to-Accept" option in place of the "Approve login notification on mobile" option on the login dropdown. (On the SecureAuth Authenticate mobile app, the icons will be different, but both icons will have a tool tip that reads "Approve login".)
If you are authenticating through a different primary credential provider (that is, not the SecureAuth credential provider), you will see the login screen offered by that credential provider. The different primary credential provider supports offline mode, for end users who need to login when their machine is offline.
The following image shows an example of a login screen, but yours will look different.
1. Sign in.
  The image shows two sign-in options, a Microsoft credential provider (the key icon) and a Microsoft Smart Card credential provider (the card icon). To sign in, you could click the icon with your preferred method. If your site offers one kind of sign-in option, then only that option will be displayed for you to sign in with.
  Additionally, if you can sign in as "Other user", a multi-user credential login provided by that credential provider will be displayed. After specifying who you are, click the Sign-in options link to choose which multi-user credential you want to use to sign in.
2. You have completed your authentication login process. You can disregard the remaining end user steps in this section and in "Subsequent login experience." Your login experience will remain the same as the one provided by your primary credential provider.
3. Notice the placement of the Password Reset icon on the lower left. To update your password, click the icon. Login for Windows is the password reset credential provider, and requires online network access.
Show or hide the passcode so that, as you type, you see characters instead of dots.
1. Focus on the passcode field and enter characters to see the following "eye" icon displayed.
2. Click the icon and hold it until the dots in the field turn to characters.
3. To hide the passcode, click and hold the icon until the characters turn to dots.

Face recognition (Windows Hello)

Use biometric face recognition to authenticate access to your Windows workstation.

Use face recognition (Windows Hello)

In Login for Windows, type your Windows password.
Make sure you have face recognition set up in Windows Hello.
To learn more, see Set up Windows Hello.
Log out.
Log in again and follow the on screen prompt to provide face recognition to log in.

Fingerprint recognition (Windows Hello)

Use biometric fingerprint recognition to authenticate access to your Windows workstation.

Use fingerprint recognition (Windows Hello)

In Login for Windows, type your Windows password.
Make sure you have fingerprint recognition set up in Windows Hello.
To learn more, see Set up Windows Hello.
Log out.
Log in again and follow the on screen prompt to provide fingerprint recognition to log in.

Push notification

Approve the login notification sent to Authenticate app on your mobile device to log in.

Approve login notification on mobile

In Login for Windows, type your Windows password.
Select the mobile device on which the provisioned SecureAuth Authenticate app is installed.
Click the arrow to send a push notification to Authenticate app and approve your log in to Windows.

Email

Use a passcode sent to your email.

Passcode from email

In Login for Windows, type your Windows password.
Select the email address if more than one address is included in your user profile.
Click the arrow to send a passcode to your email and complete log in to Windows.

Email link

Click the link sent to your email to log in.

Link from email

In Login for Windows, type your Windows password.
Select the email address if more than one address is included in your user profile.
Click the arrow send the link to your email.
Click the link in your email to complete log in to Windows.

Face on mobile

Use face recognition on your mobile device to log in.

End users must use the Authenticate mobile app to use face recognition. This option is available to users on iOS mobile phones.

Use face recognition on mobile

In Login for Windows, type your Windows password.
Select the mobile device on which the provisioned Authenticate app is installed to send a request to the mobile app.
Click the arrow to log in to Windows.
Show your face on the mobile device to approve the request.
Login for Windows receives the face information and you are authenticated.

Fingerprint on mobile

Use fingerprint recognition on your mobile device to log in.

End users must use the Authenticate mobile app to use fingerprint recognition.

Use fingerprint recognition on mobile

In Login for Windows, type your Windows password.
Select the mobile device on which the provisioned Authenticate app is installed to send a request to the mobile app.
Click the arrow to log in to Windows.
Provide a fingerprint on the mobile device to approve the request.
Login for Windows receives the fingerprint information and you are authenticated.

Help desk

Contact the help desk in your organization to receive a passcode to log in.

Contact help desk for passcode

In Login for Windows, type your Windows password.
Select the phone number option to use for contacting the help desk.
Click the arrow to log in to Windows.

Passcode from notification

Use a passcode sent in an Authenticate app notification on your mobile device to log in.

Passcode from notification

In Login for Windows, type your Windows password.
Select the mobile device on which the provisioned SecureAuth Authenticate app is installed.
Click the arrow to send a passcode to Authenticate app and complete log in to Windows.

Use a predefined personal identification number (PIN) to log in. To learn more, see PIN settings.

Enter PIN

In Login for Windows, type your Windows password.
Type your predefined personal identification number (PIN).
You must have a PIN set up in the Authenticate app. See PIN settings.
Click the arrow to log in to Windows.

SMS

Use a passcode sent to your SMS to log in.

Passcode from SMS / text

In Login for Windows, type your Windows password.
Select the phone number if more than one mobile phone is included in your user profile.
Click the arrow to get a passcode by SMS to complete log in to Windows.

SMS link

Tap the link sent to your SMS to log in.

Link from text

In Login for Windows, type your Windows password.
Select the phone number if more than one number is included in your user profile.
Click the arrow send the SMS link to your phone.
Tap the link sent to your SMS to complete log in to Windows.

Timed passcode

Use a time-based one-time passcode (TOTP) from the app on your device to log in.

This method and "Passcode from token" are displayed at first login, if available. If not available, all available methods are displayed.

Timed passcode from app

In Login for Windows, type your Windows password.
If there is more than one provisioned OATH OTP app, select the device.
If you have enrolled more than one device to accept OATH OTP passcodes, select the device from which you copied the passcode.
If offline, end users can choose an OATH-based method they used when online.
Type the passcode, and click the arrow to log in to Windows.

Token

Use a passcode in a token like a HOTP security key to log in.

This method and "Timed passcode from app" are displayed at first login, if available. If not available, all available methods are displayed.

Passcode from token

In Login for Windows, type your Windows password.
If you have enrolled more than one token to accept passcodes, select the token.
To find your YubiKey version, see Identifying Your YubiKey on the Yubico website.
If offline, end users can choose an OATH-based method they used when online.
Type the passcode from selected token and click the arrow to log in to Windows.

Voice call

Use a passcode sent in a voice call to your mobile device to log in.

Passcode from voice call

In Login for Windows, type your Windows password.
Select the phone number if more than one mobile phone is included in your user profile.
Click the arrow to get a passcode by a voice call and log in to Windows.

YubiKey

Use a YubiKey to log in.

This method and "Timed passcode from app" are displayed at first login, if available. If not available, all available methods are displayed.

Passcode from YubiKey

In Login for Windows, type your Windows password.
Plug in the YubiKey and tap it to receive a passcode from the device.
Click the arrow to log in to Windows.

Subsequent login experience

When logging on the same machine in subsequent sessions, the Login for Windows page includes a selection of all multi-factor authentication methods for which you enrolled.

Note

The login screen defaults to the authentication method used in the last login session.

To show characters as you type a passcode instead of seeing dots, refer to step 2.

You can provision either "Approve login" or "Symbol-to-Accept. The following image shows the login screen with the "Approve login" icon; if "Symbol-to-Accept" is set, end users will see the "Symbol-to-Accept" icon in place of the "Approve login" icon on the login screen. (On the SecureAuth Authenticate mobile app, the icons will be different, but both icons will have a tool tip that reads "Approve login".)