Forum Discussion
Disabling PIN-based login on Entra-joined PCs
underQualifried​
Hello
When a device is associated with Microsoft Entra, Windows automatically attempts to provision Windows Hello for Business (WHfB) during the user's first login. This is what triggers the PIN setup request.
This behavior is not controlled by Authentication Methods in Entra, because the Windows Hello PIN is a device authentication mechanism, not a tenant authentication method.
In environments where Intune is not used, the recommended way to prevent this provisioning is to disable Windows Hello for Business locally on the device.
You can configure this through Local Group Policy:
Computer Configuration
Administrative Templates
Windows Components
Windows
Hello for Business.
Set the option Windows Hello for Business Disabled
and restart the device.
This prevents Windows from attempting to provision Windows Hello, and users will be able to sign in using only their username and password, which may be more appropriate for shared or secondary machines, such as the two devices you described
Thank you, this seems to have done the trick. Sadly the PIN each user has configured prior to disablement can't be removed, but this isn't a major issue as they can still sign in using their 365 password which is what we wanted. Have a good day and thanks again!
Great to hear that the solution helped resolve the issue.
Thank you for sharing the outcome here in the discussion. This feedback is very useful for other professionals who may face the same situation.
If you have any further questions in the future, feel free to open a new question. Have a great day!
