Microsoft is expanding its Enhanced Sign-in Security feature in the August 2026 Windows 11 update to include support for compatible external fingerprint readers for improved biometric authentication.

Key Points

• Enhanced Sign-in Security (ESS) isolates biometric processing using Virtualization-Based Security (VBS) and TPM 2.0 technology.
• The update allows external fingerprint readers with dedicated secure processors to perform matching within the hardware itself.
• ESS creates an encrypted communication channel between the biometric sensor and the operating system to reduce the potential attack surface.
• Enabling ESS requires users to re-register fingerprints and update their PIN, as existing non-ESS biometric credentials are removed for security.
• Standard Windows Hello remains a highly secure authentication method for users whose hardware does not support the enhanced feature.

Why it Matters

This update provides a higher level of hardware-backed security for users who rely on external biometric peripherals rather than built-in sensors. By expanding compatibility, Microsoft is standardizing a more robust authentication architecture that protects biometric data even if the operating system is compromised.