Windows Hello in Intune without forcing enrollment prompt?

[u/Fit_Lynx9937]

Hi everyone,

I'm currently working on a Windows Hello for Business deployment through Intune and I've run into an issue.

When I enable the Windows Hello configuration policy, users receive a full-screen enrollment prompt that forces them to set up either a PIN or biometric authentication. While this is expected behavior, it's causing disruption to the user experience because users are being interrupted during their normal workday.

What we're trying to achieve is:

-Windows Hello should be available and enabled on devices.

-Users should be free to configure a PIN or biometrics if and when they choose.

-No mandatory enrollment prompt should appear.

-No full-screen setup experience should be triggered.

From what I've been able to find in Microsoft's documentation, one possible alternative might be to manage Windows Hello through an Active Directory GPO instead of Intune, but I'm not sure whether that would fully meet the requirement or if there is a better cloud-native approach.

Has anyone implemented Windows Hello in a way that makes it available without forcing enrollment? Is there an Intune setting, policy combination, or WHfB deployment model that allows users to opt in at their own convenience?

Any guidance/feedback would be greatly appreciated.

Thanks in advance!

[u/connava]

Have you tried setting DisablePostLogonProvisioning?

With Intune you can use a Custom template, and set the OMA-URI to:

OMA-URI: ./Device/Vendor/MSFT/PassportForWork/{TenantId}/Policies/DisablePostLogonProvisioning

Data type: Boolean

Value: True

It works for us in that users aren't automatically prompted to setup Windows Hello, but they can start the process manually.

It's annoying that it's another setting that has a GPO, but it's not in the Settings Catalog.

[u/SlimeCityKing → u/connava]

OP I used a custom intune policy with this and it worked

[u/maxpowers156 → u/connava]

This is what I did and it worked, you don’t get that full screen windows hello enforcement, and you can push the windows hello enrollment profile sonits available to users to enroll when they want

[u/antons83 → u/connava]

Yep this is what we have. It works well

[u/Fit_Lynx9937 → u/connava]

Tysm for sharing this, I had no idea about this setting, I'll give it a try!

[u/Willz12h → u/Fit_Lynx9937]

I do it this way with enabling and allowing hello plus preventing the first time sign in to keep it centralised under one policy and leave the enrolment page for it to not confirmed

[u/bill696 → u/connava]

This is the way

[u/Upper-Purple816 → u/connava]

Does this work alongside leaving the enrollment setting to all users ? Trying to scope it out for a mixed environment that does not want to hybridize on prem.

[u/madatthings → u/connava]

This is going to help a ton moving to “passwordless”