Note on WHfB and Step-up Authentication

This comment is based on details provided by Libby Brown in the below Teams thread:
https://teams.microsoft.com/l/message/19:[email protected]/1658406678904?tenantId=72f988bf-86f1-41af-91ab-2d7cd011db47&groupId=3e1eb424-0cb7-4665-b384-4fbfd3cd0f83&parentMessageId=1658406678904&teamName=Identity%20PM%20Collaboration&channelName=Credential%20Management%20(SSPR%2C%20MFA%2C%20Passwordless)&createdTime=1658406678904

Author: FrankBoylan92

articles/active-directory/authentication/concept-authentication-methods.md

@@ -62,7 +62,7 @@ The following table outlines when an authentication method can be used during a
 
 | Method                         | Primary authentication | Secondary authentication  |
 |--------------------------------|:----------------------:|:-------------------------:|
-| Windows Hello for Business     | Yes                    | MFA                       |
+| Windows Hello for Business     | Yes                    | MFA\*                      |
 | Microsoft Authenticator app    | Yes                    | MFA and SSPR              |
 | FIDO2 security key             | Yes                    | MFA                       |
 | OATH hardware tokens (preview) | No                     | MFA and SSPR              |
@@ -71,6 +71,8 @@ The following table outlines when an authentication method can be used during a
 | Voice call                     | No                     | MFA and SSPR              |
 | Password                       | Yes                    |                           |
 
+> \* Windows Hello for Business, by itself, does not serve as a step-up MFA credential. For example, an MFA Challenge from Sign-in Frequency or SAML Request containing forceAuthn=true. Windows Hello for Business can serve as a step-up MFA credential by being used in FIDO2 authentication. This requires users to be enabled for FIDO2 authentication to work sucessfully.
+
 All of these authentication methods can be configured in the Azure portal, and increasingly using the [Microsoft Graph REST API](/graph/api/resources/authenticationmethods-overview).
 
 To learn more about how each authentication method works, see the following separate conceptual articles: