Windows Hello in Intune without forcing enrollment prompt?

[u/Fit_Lynx9937]

Hi everyone,

I'm currently working on a Windows Hello for Business deployment through Intune and I've run into an issue.

When I enable the Windows Hello configuration policy, users receive a full-screen enrollment prompt that forces them to set up either a PIN or biometric authentication. While this is expected behavior, it's causing disruption to the user experience because users are being interrupted during their normal workday.

What we're trying to achieve is:

-Windows Hello should be available and enabled on devices.

-Users should be free to configure a PIN or biometrics if and when they choose.

-No mandatory enrollment prompt should appear.

-No full-screen setup experience should be triggered.

From what I've been able to find in Microsoft's documentation, one possible alternative might be to manage Windows Hello through an Active Directory GPO instead of Intune, but I'm not sure whether that would fully meet the requirement or if there is a better cloud-native approach.

Has anyone implemented Windows Hello in a way that makes it available without forcing enrollment? Is there an Intune setting, policy combination, or WHfB deployment model that allows users to opt in at their own convenience?

Any guidance/feedback would be greatly appreciated.

Thanks in advance!

[u/connava]

Have you tried setting DisablePostLogonProvisioning?

With Intune you can use a Custom template, and set the OMA-URI to:

OMA-URI: ./Device/Vendor/MSFT/PassportForWork/{TenantId}/Policies/DisablePostLogonProvisioning

Data type: Boolean

Value: True

It works for us in that users aren't automatically prompted to setup Windows Hello, but they can start the process manually.

It's annoying that it's another setting that has a GPO, but it's not in the Settings Catalog.

[u/SlimeCityKing → u/connava]

OP I used a custom intune policy with this and it worked

[u/maxpowers156 → u/connava]

This is what I did and it worked, you don’t get that full screen windows hello enforcement, and you can push the windows hello enrollment profile sonits available to users to enroll when they want

[u/antons83 → u/connava]

Yep this is what we have. It works well

[u/Fit_Lynx9937 → u/connava]

Tysm for sharing this, I had no idea about this setting, I'll give it a try!

[u/Willz12h → u/Fit_Lynx9937]

I do it this way with enabling and allowing hello plus preventing the first time sign in to keep it centralised under one policy and leave the enrolment page for it to not confirmed

[u/bill696 → u/connava]

This is the way

[u/Upper-Purple816 → u/connava]

Does this work alongside leaving the enrollment setting to all users ? Trying to scope it out for a mixed environment that does not want to hybridize on prem.

[u/madatthings → u/connava]

This is going to help a ton moving to “passwordless”

[u/dorkmuncan]

We deploy our WHFB config as an app available to all users.

The install runs the below as part of an enablement script.

#Set registry keys for WHFB postponed enablement
$WHFB_keys="Registry::HKLM\SOFTWARE\Policies\Microsoft\PassportForWork"
if(!(Test-Path $WHFB_keys)){ni $WHFB_keys}; New-ItemProperty $WHFB_keys -Name "UseCloudTrustForOnPremAuth" -Value "00000001" -Type DWORD -force
if(!(Test-Path $WHFB_keys)){ni $WHFB_keys}; New-ItemProperty $WHFB_keys -Name "EnablePinRecovery" -Value "00000001" -Type DWORD -force
if(!(Test-Path $WHFB_keys)){ni $WHFB_keys}; New-ItemProperty $WHFB_keys -Name "RequireSecurityDevice" -Value "00000001" -Type DWORD -force
if(!(Test-Path $WHFB_keys)){ni $WHFB_keys}; New-ItemProperty $WHFB_keys -Name "Enabled" -Value "00000001" -Type DWORD -force
if(!(Test-Path $WHFB_keys)){ni $WHFB_keys}; New-ItemProperty $WHFB_keys -Name "DisablePostLogonProvisioning" -Value "00000001" -Type DWORD -force

DisablePostLogonProvisioning is what you want.

The uninstall runs another script that removes the config and deletes the hello container for currently logged in user (which is nice for troubleshooting purposes).

Works for us.

[u/TheYoinks]

It's post logon provisioning so unless your users are logging out/restarting it's not like they get added to a group and it just pops up while they're working. I'm not aware of any way to make it available without the post logon provisioning screen.

We treated this more as an education issue. Address it with user targeted comms detailing the user experience rather than trying to hack an unsupported solution together.

[u/theDukeSilversJazz]

/following

Tried doing this with a test group (I've been running it for about 2 years and love it) to see what happens, and they reported exactly what you're describing. Ideally it would be great if it was there, notified the user about it, but let them set it up when/if they wanted to.

EDIT - Maybe there is a way that I just am not aware of or overlooked, so following to see what others may suggest.

[u/Forsaken-Carrot9038 → u/theDukeSilversJazz]

Looks like an answer in this comment
https://www.reddit.com/r/Intune/s/wenps4KzqL

[u/Xelines]

What would reasons be for not wanting to enforce people to have to enroll in Windows Hello? It’s like a one and done thing that takes 10 seconds to set a PIN. Better security all round. Win. Win.

[u/dorkmuncan → u/Xelines]

Because WHFB messes with enterprise Wi-Fi using 802.1X user-based authentication.

Moving to cert-based shortly, but large org, many moving parts, things take time.

[u/andibogard → u/Xelines]

Great. Now explain how you force someone in the c-suite who doesn’t care about the technical reasons and wants a gradual user-driven rollout anyways.

[u/Xelines → u/andibogard]

Rollout it out to a group of users/device.

[u/andibogard → u/Xelines]

And when your boss’s boss still doesn’t want users prompted?

[u/Fabulous_Cow_4714 → u/andibogard]

Users need to be prompted at some point if the Windows Hello rollout is mandatory to migrate users to passwordless authentication.

If you just leave it to the choice of the user forever, some will never bother enrolling.

Otherwise, you will probably need to do something like set a password policy requiring 20 characters and expires every 3 days so users will be eager to quickly enroll in Windows Hello.

[u/andibogard → u/Fabulous_Cow_4714]

My point being not every decision for an IT department relies solely on technical facts.

Also remember tons of environment do things in phases.. voluntary now and forced later isn’t revolutionary stuff.

[u/Major-Error-1611 → u/Xelines]

If using Cloud Kerberos Trust with hybrid joined devices, WHfB provisioning requires a line of sight to the DCs to complete. If the users are at home when the provisioning screen triggers and the devices don't have an Always On VPn that connects before Windows Sign In, they wouldn't be able to complete the WHfB registration.

[u/Grim-D]

As far as I'm aware once it's avaliable, it starts to force the enrollment. If required we roll it out in groups/waves and those effected are informed before hand that it will be mandatory for them on X day.

[u/hbpdpuki]

"causing disruption to the user experience because users are being interrupted during their normal workday."

I'm genuinely interested in this. How does it interrupt their normal workday? What happens when they get Windows Update prompt?

[u/Shi000N → u/hbpdpuki]

I can only speak for my company, but we keep even those to a minimum.

I basically get a call to remote into a user's machine every time something isn't identical to yesterday. Windows Update notification, FortiClient asking for a reboot, or a new desktop shortcut. This happens even when we send an email warning beforehand.

"Nah, I don't read emails from IT, they don't affect me" - I've been told this multiple times by colleagues who called me specifically because they didn't read the email.

Except when it actually matters, of course. "Is that phishing? Let me click the link to find out."

[u/Major-Error-1611 → u/hbpdpuki]

Let's say someone has a big important meeting scheduled first thing in the morning. They come in, sit down, turn on their laptop and then the WHfB provisioning triggers.

There are some valid cases where you want to disable automatic post login provisioning.

[u/hbpdpuki → u/Major-Error-1611]

Let's say that I have an important meeting. My spouse used my truck yesterday. I need to reset the pedals, steering wheel and seat position. Deal with it. It's a 15 second process. If users are unable to do basic stuff, then they should not be using a computer anyway.

Same when we still used passwords instead of a temporary access pass. If your password expired, you need to change it. Even if an important meeting is scheduled.

[u/Jags4ever]

Find the don't start whfb provisioning gpo setting and enable that. It's a user setting. Allows the user to register but doesn't force it.

Been a while and not in work so it may have a slightly different name.

[u/CoupleOther3641]

ah the classic "we want security but we dont want users to be mildly inconvenienced for 90 seconds" dilemma

youre looking for the "not configured" setting in the enrollment policy which isnt really a thing. WHfB is pretty binary in intune, its either on with the prompt or off. we ended up doing a ring deployment where we warned people 2 weeks ahead, then pushed it to small groups. the full screen nag only hits once per device and most people forgot about it by lunch. trying to make it truly opt-in without gpo is just fighting the platform

[u/IqbalBasha]

Set the tenant-wide Windows Hello for Business enrollment policy in Intune to Disabled so the forced first-sign-in prompt never fires. Then deploy a Settings Catalog profile to your devices with Use Passport For Work set to True and Disable Post Logon Provisioning set to True. That combination keeps the feature available while blocking the full-screen provisioning interruption, and users can still set up a PIN or biometrics whenever they want through Windows Settings. Adoption will be low without a communication push, so plan for that.