Executive Summary
The State of Michigan modernized its authentication system by supplementing traditional password logins with Windows Hello for Business, a phishing-resistant biometric platform. This update gives users faster, more flexible authentication through facial recognition, fingerprint scanning, or a PIN. Affecting about 40,000 workstations statewide, the change strengthened cybersecurity, simplified access, and aligned with Zero Trust Architecture (ZTA) principles guiding future initiatives.
By introducing a structured enterprise organizational change management (EOCM) approach, the SOM achieved early voluntary adoption from nearly 10,000 employees before an enforcement date was announced. Importantly, there was no notable increase in authentication-related calls to the Customer Service Center (CSC) during or after the release of Hello, a success attributed largely to careful technical planning, strong interest, and participation through EOCM engagement activities.
By integrating modern identity technology with enterprise-wide change management, the SOM was able to build a resilient, future-ready authentication foundation that advances statewide security goals, improves employee experience, and positions SOM’s enterprise to succeed at planned security initiatives in the future.
In addition to the technical and organizational successes of the rollout, the project’s communication and support strategy proved central to its effectiveness. A comprehensive online resource hub became a highly visited source for self-service training, providing step-by-step job aids, a how-to video, and comprehensive FAQs. To date, the support site has generated over 18,000 views. This self-service model reduced anxiety, increased readiness, and reinforced confidence in the Hello rollout.
The communications cadence also played a major role in sustaining awareness. The first SOM-wide email introduced Hello and gave users an opportunity to enroll at their own pace. Then, messages were delivered over several months. Finally, three weeks before enforcement, then at two weeks, one week, the day before, and the day of rollout, giving employees clear guidance, and multiple avenues for support. This structured timing created predictability, reduced disruption, and drove high voluntary adoption across the enterprise.
