Windows 11 Pro security extends zero-trust all the way to the cloud, enabling policies, controls, procedures, and technologies that work together to protect your devices, data, applications, and identities from anywhere.

Microsoft offers comprehensive cloud services for identity, storage and access management in addition to the tools to attest that any Windows device connecting to your network is trustworthy. You can also enforce compliance and conditional access with a modern device management (MDM) service such as Microsoft Intune that works with Azure Active Directory to control access to applications and data through the cloud.¹ 

1. Subscription sold separately.

Passwords are inconvenient to use and prime targets for cybercriminals—and they’ve been an important part of digital security for years. That changes with the passwordless protection available with Windows 11 Pro. After a secure authorization process, credentials are protected behind layers of hardware and software security, giving users secure, passwordless access to their apps and cloud services. 

Individual users can remove the password from their Microsoft account and use the Microsoft Authenticator app,¹  Windows Hello,² a FIDO2 security key, a smart card, or a verification code sent to their phone or email. IT administrators and consumers can set up Windows 11 Pro devices as passwordless out-of-the-box, taking advantage of technologies such as Windows Hello in alignment with Fast Identity Online (FIDO) standards.

Windows 11 Pro protects credentials with chip-level hardware security including TPM 2.0 combined with VBS and Microsoft Credential Guard. 

1. Get the free Microsoft Authenticator app for Android or iOS https://www.microsoft.com/en- us/account/authenticator?cmp=h66ftb_42hbak

2. Windows Hello supports multi-factor authentication including facial recognition, fingerprint, and PIN. Requires specialized hardware such as fingerprint reader, illuminated IT sensor or other biometric sensors and capable devices.

To help keep personal and business information protected and private, Windows 11 Pro has multiple layers of application security to safeguard critical data and code integrity. Application isolation and controls, code integrity, privacy controls, and least-privilege principles enable developers to build-in security and privacy from the ground up.  This integrated security protects against breaches and malware, helps keep data private, and gives IT administrators the controls they need.

In Windows 11 Pro, Microsoft Defender Application Guard¹ uses Hyper-V virtualization technology to isolate untrusted websites and Microsoft Office files in containers, separate from and unable to access the host operating system and enterprise data. To protect privacy, Windows 11 Pro also provide more controls over which apps and features can collect and use data such as device location or access resources like camera and microphone. 

1. Windows 10 Pro and above support Application Guard protection for Microsoft Edge. Microsoft Defender Application Guard for Office requires Windows 10 Enterprise, and Microsoft 365 E5 or Microsoft 365 E5 Security.

With hardware-based isolation security that begins at the chip, Windows 11 Pro stores sensitive data behind additional security barriers, separated from the operating system. As a result, information including encryption keys and user credentials are protected from unauthorized access and tampering.

In Windows 11 Pro, hardware and software work together to protect the operating system, with virtualization-based security (VBS) and Secure Boot built-in and enabled by default on new CPUs. Even if bad actors get in, they don’t get far. VBS uses hardware virtualization features to create and isolate a secure region of memory from the operating system. This isolated environment hosts multiple security solutions, greatly increasing protection from vulnerabilities in the operating system, and preventing the use of malicious exploits. In combination with device health attestation with cloud services Windows 11 Pro is zero trust ready.