Contoso has a hybrid Microsoft Entra environment with on-premises Active Directory synced to Entra ID. The security team wants users on Entra hybrid-joined Windows 11 devices to sign in with a PIN or biometric gesture instead of a password. They do NOT want to deploy an internal PKI or issue certificates to each device, but users must still be able to access on-premises file shares that require Kerberos authentication after signing in. Which Windows Hello for Business deployment model should you implement?