Forum Discussion
How to see which users only implement the pincode in Windows Hello?
We rolled out Windows Hello for Business in the whole organisation. All users see a Windows Hello for Business wizard where the at least need to implement the pincode. It is possible to implement also the fingerprint or face recognizing. How can I generate some report where I can see the implemented Windows Hello methods? We would like to contact everybody who only implemented the pincode to do some user adoption.
1 Reply
There is no tenant report that separates users with only a PIN from those who added face or fingerprint. Windows Hello for Business registers a device-bound key with Entra ID; PIN and biometric gestures unlock that same credential. Biometric templates remain on the device and do not roam, so Entra and Microsoft Graph can report Windows Hello for Business registration, but not configured local gestures.
In Entra admin center, open Protection > Authentication methods > Activity > Registration details and export the report to identify registered users. It cannot identify PIN-only users. A PIN also remains the fallback when biometrics are configured.
For adoption outreach, target all users registered for Windows Hello for Business, or collect device-local enrollment status with an approved endpoint-management script after privacy review. Do not infer biometric enrollment from sign-in logs, because the service sees the same key authentication regardless of which gesture unlocked it.
