Setting Up Windows Hello for Business: What Should I Know?

I'm looking to implement Windows Hello for Business in an on-premises environment from scratch. I understand that I need to establish a Public Key Infrastructure (PKI) environment to utilize the Group Policy Objects (GPOs) for Windows Hello for Business, but I'm not sure about the key considerations for doing this. Specifically, I want to know: - Should I invest in a dedicated physical server for the offline certificate authority, or is a virtual machine on our existing host server sufficient? - Are there risks of disrupting normal authentication processes during this setup? - Could this impact users in any significant way? - What additional questions should I be asking, considering my limited knowledge on the subject? Ultimately, my goal is to enable users to utilize fingerprint recognition on their laptops and manage passkeys effectively.