How to see which users only implement the pincode in Windows Hello?

There is no tenant report that separates users with only a PIN from those who added face or fingerprint. Windows Hello for Business registers a device-bound key with Entra ID; PIN and biometric gestures unlock that same credential. Biometric templates remain on the device and do not roam, so Entra and Microsoft Graph can report Windows Hello for Business registration, but not configured local gestures.

In Entra admin center, open Protection > Authentication methods > Activity > Registration details and export the report to identify registered users. It cannot identify PIN-only users. A PIN also remains the fallback when biometrics are configured.

For adoption outreach, target all users registered for Windows Hello for Business, or collect device-local enrollment status with an approved endpoint-management script after privacy review. Do not infer biometric enrollment from sign-in logs, because the service sees the same key authentication regardless of which gesture unlocked it.