Merge pull request #206587 from MicrosoftDocs/main

8/01 PM Publish

Author: huypub

articles/active-directory/authentication/concept-authentication-methods.md

@@ -62,7 +62,7 @@ The following table outlines when an authentication method can be used during a
 
 | Method                         | Primary authentication | Secondary authentication  |
 |--------------------------------|:----------------------:|:-------------------------:|
-| Windows Hello for Business     | Yes                    | MFA                       |
+| Windows Hello for Business     | Yes                    | MFA\*                      |
 | Microsoft Authenticator app    | Yes                    | MFA and SSPR              |
 | FIDO2 security key             | Yes                    | MFA                       |
 | OATH hardware tokens (preview) | No                     | MFA and SSPR              |
@@ -71,6 +71,8 @@ The following table outlines when an authentication method can be used during a
 | Voice call                     | No                     | MFA and SSPR              |
 | Password                       | Yes                    |                           |
 
+> \* Windows Hello for Business, by itself, does not serve as a step-up MFA credential. For example, an MFA Challenge from Sign-in Frequency or SAML Request containing forceAuthn=true. Windows Hello for Business can serve as a step-up MFA credential by being used in FIDO2 authentication. This requires users to be enabled for FIDO2 authentication to work sucessfully.
+
 All of these authentication methods can be configured in the Azure portal, and increasingly using the [Microsoft Graph REST API](/graph/api/resources/authenticationmethods-overview).
 
 To learn more about how each authentication method works, see the following separate conceptual articles:

articles/active-directory/cloud-infrastructure-entitlement-management/media/cloudknox-overview/cloudknox-key-cases.png

@@ -26,7 +26,7 @@ Organizations have to consider permissions management as a central piece of thei
 - IT security teams are under increased pressure to ensure access to their expanding cloud estate is secure and compliant.
 - The inconsistency of cloud providers' native access management models makes it even more complex for Security and Identity to manage permissions and enforce least privilege access policies across their entire environment.
 
-:::image type="content" source="media/cloudknox-overview/cloudknox-key-cases.png" alt-text="CloudKnox Permissions Management.":::
+:::image type="content" source="media/overview/key-use-cases.png" alt-text="Diagram of Microsoft Entra Permissions Management use cases." lightbox="media/overview/key-use-cases.png":::
 
 ## Key use cases