Authenticating Users on Shared Windows Devices

A key concern for planning and deployment of shared Windows devices is how users will authenticate to the device, or if they will authenticate to the device at all.

Regardless of the scenario, work must be done to ensure that multiple users are not using each other’s credentials (or worse, a single set of credentials) and to enforce user sign-out from the device or authenticated applications if inactive for a period of time. Not ensuring users are signed out can have both security and compliance repercussions.

Typical authentication options for a shared Windows device include the following:

Sign into the device using Active Directory (AD) credentials. This option is typically done using an AD username and password or using a smart card or other multifactor authentication device. The latter can help in healthcare situations in particular, in which user authentication and sign-out are critical to ensure regulatory compliance objectives can be met.

Sign into the device using Azure Active Directory (AAD) credentials. This option is typically done using an AAD username and password but could also now be done using other AAD authentication approaches, potentially including a FIDO2 authentication device, other multifactor authentication device, or AAD’s password-free or “passwordless” approach, typically relying on an Apple or Android phone running Microsoft Authenticator. A benefit of having each user sign in with AAD credentials is that their credentials can also then be used to activate the Microsoft 365 Apps for enterprise suite and authenticate to Office 365 hosted services.