WHFB - Intune - Only PIN works and it causes print issues

Jamie, one way to confirm the print side before and after you change anything: sign in with the PIN and run dsregcmd /status. Under SSO State, check that AzureAdPrt is YES and that OnPremTgt is YES. If OnPremTgt is NO, Windows isn't getting an on-prem Kerberos ticket from the Hello sign-in, which matches the repeated password prompt and failing prints to an on-prem print server. Cloud Kerberos Trust is what fixes that for hybrid users, and klist shows the ticket once it works.

On face recognition, that's separate and policy-controlled. In the Windows Hello for Business policy, check that Use biometrics is set to Yes (or Not configured). If it's set to No, only the PIN will be offered even on cameras that support it. Each user also has to enroll their face under Settings > Accounts > Sign-in options.