Windows Hello lets people sign in to a Windows device with a PIN or supported facial or fingerprint recognition. Windows Hello for Business adds organizational identity and deployment capabilities.
In Windows Hello for Business, the device creates an asymmetric key pair. A PIN or biometric gesture unlocks use of the private key; it is not an alternative authentication mechanism to that key pair. Where a TPM is used, it protects the private key. The PIN is used locally and is not sent to the identity provider; biometric templates are stored locally.
Here is a very good article that explains the details:
How Windows Hello for Business works — Microsoft LearnCorrection, October 25, 2026: Clarified how the PIN or biometric gesture unlocks a device-bound authentication key and updated the Microsoft documentation link.