Microsoft is set to enhance the security landscape of Windows 11 with the introduction of Enhanced Sign-in Security (ESS) in the August 2026 update. This feature will now support compatible external fingerprint readers, broadening the reach of the Windows Hello experience to devices lacking built-in biometric hardware. This expansion comes at a crucial time, as many users have found the concept of Enhanced Sign-in Security somewhat perplexing since its inception. While some view it as merely an upgrade to Windows Hello, others mistakenly believe it is exclusive to business environments or high-end devices.
At its core, Enhanced Sign-in Security is not just about improving the accuracy of facial recognition or speeding up fingerprint sign-ins. Rather, it focuses on fortifying the entire authentication process against potential attacks.
Standard Windows Hello is already one of the best security features
Before the arrival of Enhanced Sign-in Security, Windows Hello had already established itself as a formidable alternative to traditional passwords. By utilizing cryptographic credentials linked to the Trusted Platform Module (TPM) on a computer, Windows Hello allows users to unlock these credentials through facial recognition or fingerprints, all while ensuring that biometric templates remain securely stored on the device rather than being uploaded to Microsoft’s servers. This architecture provides robust protection against phishing attempts, password reuse, and credential theft.
Enhanced Sign-in Security does not replace this existing framework; instead, it adds an additional layer of security.
The real difference is where the trust is placed
The distinction between standard Windows Hello and Enhanced Sign-in Security lies in the allocation of trust. With standard Windows Hello, the operating system processes biometric authentication after receiving data from a trusted sensor. In contrast, Enhanced Sign-in Security shifts much of this processing to isolated, hardware-protected environments. By leveraging Virtualization-Based Security (VBS) and TPM 2.0 technology, Microsoft enhances the trustworthiness of the authentication process.
In practical terms, when using a standard Windows Hello fingerprint reader, the sensor captures the fingerprint, and Windows 11 verifies it securely through the operating system and TPM-backed credentials. However, an ESS-compatible fingerprint reader performs more of this process within the hardware itself, featuring a dedicated secure processor, storing fingerprint templates internally, and establishing an encrypted communication channel with the operating system. Consequently, Windows 11 receives only the authentication result, minimizing the risk of exposure to raw biometric data.
While Microsoft has yet to clarify why ESS does not support external Windows Hello cameras—likely due to USB being a potential attack vector—it is evident that enhanced security for facial recognition relies on specific camera hardware and firmware. This architectural nuance may explain the initial focus on expanding support for external fingerprint readers.
Should you enable Enhanced Sign-in Security?
If your computer does not support Enhanced Sign-in Security, there is no cause for concern, as standard Windows Hello remains one of the most secure consumer authentication systems available. However, if your device is equipped with ESS-compatible hardware or if you plan to purchase a new external fingerprint reader that supports the feature, enabling it is advisable. This is not because Windows Hello has become insecure, but rather because the enhanced option offers an additional layer of security. For those with compatible hardware, the benefits of enabling ESS far outweigh any potential downsides.
How to enable the enhanced security feature
To enable the Enhanced Sign-in Security feature, navigate to Settings > Accounts > Sign-in options once your Windows Hello-compatible authentication device is connected and recognized by the operating system. Under the “Additional settings” section, check the status of the “Enhanced sign-in security” option. If your system was not previously configured for ESS, you may encounter prompts indicating “Pending setup” or “Update PIN.”
If the “Update PIN” option appears, use it to complete the setup. Alternatively, if you see “Pending setup,” configure the “Fingerprint recognition” feature under the “Ways to sign in” section. It’s important to note that when upgrading to Enhanced Sign-in Security, Windows 11 will remove any existing non-ESS biometric enrollments and associated credentials to ensure a secure environment. Users will need to refresh their PIN and re-register their fingerprints using the new sensor. Once completed, the ESS toggle will indicate that it is enabled. Additionally, while the feature is active, peripherals that do not support it will be unusable.
Windows Central’s Take
Microsoft’s choice of the term “Enhanced Sign-in Security” may have inadvertently led to confusion, as it suggests an entirely new authentication system. In reality, it represents an evolution of Windows Hello, enhancing the processing of biometric authentication behind the scenes. Many users may not notice any difference in their sign-in experience, which remains unchanged.
The significance of the August 2026 Security Update lies not in the newfound security of Windows Hello—an already robust authentication system—but in the expanded support for compatible external fingerprint readers. For those whose computers support Enhanced Sign-in Security, it is advisable to keep it enabled. However, there is no need to replace existing hardware solely to gain this feature, as standard Windows Hello is already a reliable authentication solution. For those considering a new fingerprint reader, opting for an ESS-compatible model is a prudent long-term investment, given Microsoft’s clear commitment to expanding this ecosystem.
More resources
Explore more in-depth how-to guides, troubleshooting advice, and essential tips to get the most out of Windows 11 and 10. Start browsing here:
Join us on Reddit at r/WindowsCentral to share your insights and discuss our latest news, reviews, and more.
