Windows Hello is targeted toward individuals/consumer devices. PIN or biometric verification is used on your personal device to reduce the risk of keyloggers or password phishing, but the login process still uses your password hash. As you are normally not joined to a domain and your hash cannot harm other devices, this is a reduced risk.
Windows Hello for Business can be configured by GPO or MDM and uses a PIN backed by asymmetric (public/private key) or certificate-based authentication. By eliminating the use of hashes, the security is considerably increased. To use this asymmetric key mode, you need to use Azure AD or implement a Windows Server 2016 domain controller. With ...
