Home › Guides › Does a PIN Count as MFA

Does a Microsoft PIN Count as MFA for CMMC?

One of the most-asked CMMC questions — and the answer is "it depends on which kind of PIN." Here's the honest version of 3.5.3.

If you've wondered whether the Microsoft PIN your team types to log into Windows is enough to satisfy CMMC's MFA requirement (3.5.3), you're in good company — it's one of the most common points of confusion. The honest answer hinges on a distinction most people miss.

Short answer: A plain login PIN, by itself, is not MFA — it's a single factor. But a Windows Hello for Business PIN does count as MFA, because that PIN unlocks a device-bound cryptographic key. Same word, very different security.

Why a plain PIN isn't MFA

Multifactor authentication means two of three different factor types: something you know (a password or PIN), something you have (a phone, token, or device-bound key), and something you are (a fingerprint or face). A standalone PIN is just "something you know." Swap a password for a PIN and you still have one factor — so on its own, it doesn't meet 3.5.3.

Why Windows Hello for Business does count

Windows Hello for Business (WHfB) looks like "just a PIN" to the user, but under the hood it's different. The PIN (or your fingerprint/face) unlocks a private key that is bound to that specific device's TPM — a hardware security chip. NIST SP 800-63B recognizes a TPM-backed key as a hardware cryptographic authenticator. So you're combining something you have (the device-bound key) with something you know or are (the PIN or biometric) = genuine two-factor, and a phishing-resistant one at that.

Microsoft has published guidance specifically on satisfying CMMC 3.5.3 with Windows Hello for Business, and assessors generally accept it when it's properly configured (TPM-backed, key-based, deployed through Entra/Active Directory — not a convenience PIN on an unmanaged device).

The trap: "We use PINs" is not a passing answer by itself. "We use Windows Hello for Business with TPM-backed keys, enrolled through Entra ID" is. The words matter because the security underneath is completely different — and an assessor will ask which one you actually have.

The safe bar for 3.5.3

If you want zero ambiguity, the clearly-accepted, phishing-resistant options are:

What to avoid as your only factor: SMS text codes. They're vulnerable to SIM-swapping, and assessors increasingly question SMS-only implementations.

What 3.5.3 actually requires

For the record, the requirement is MFA for local and network access to privileged accounts, and network access for all (non-privileged) users. In plain terms: every admin uses MFA everywhere, and every user uses MFA over the network. It's a 5-point control — one of the heaviest on your SPRS score. See the full control breakdown →

MFA is a 5-point control — see what it's worth to you

Run all 110 requirements free and find out where MFA and the other heavy controls put your score.

Calculate your SPRS score →

Bottom line

Don't answer the MFA question with "we have PINs." Either deploy Windows Hello for Business properly (and document that it's TPM-backed and key-based), or use an authenticator app / FIDO2 key. Then write exactly what you did into your SSP — because for this control, the configuration detail is the whole answer. Confirm your specific setup with your assessor.