Windows 10 - Allow Pre-Logon, Windows Hello sign-ins and SSO

[TANielsenBest]

I'm unable to get the Windows Hello credentials (such as fingerprint/face ID) to passthrough to Global Protect at logon.

We have our computer tunnel configured to handoff to the user tunnel 60 seconds after logon, so during the logon process, the connection isn't dropped and re-established.  

However, if a user uses face id or fingerprint to logon, global protect will not re-connect with the user tunnel.  I've read through all the command line switches on the agent to install, but I'm still lost.  

Would someone be able to assist or point me in the right direction?

[aleksandar.astardzhiev]

Hi @TANielsenBest ,

I have recently researched the same question. My understanding is unfortunately it is not possible to have Fingerprint,  Face recognition and GlobalProtect SSO.

The reason for that is when GP is configured to use SSO it will introduce its own Credential Provider, so when user enter his credentials on logon they will be passed to GP first. If you choose to use fingerprint or face you are choosing different credential provider and GP will not "see" the credentials and will SSO will fail, resulting in GP prompting the user for credentials.

Some details here - https://docs.paloaltonetworks.com/globalprotect/10-1/globalprotect-admin/globalprotect-apps/deploy-a...

On the following is described how GP can "wrap" other credential providers so and I was wondering if this also could be achieved for Windows Hello, but I haven't been able to test it - https://docs.paloaltonetworks.com/globalprotect/9-1/globalprotect-admin/globalprotect-apps/deploy-ap...