Hi everyone,
I’m dealing with a persistent Windows Hello and passkey issue in Chrome and Brave and yes this is relevant as they're the only browsers having this issue whilst Edge for example is fine, and at this point I’m trying to understand whether this is expected behavior, a bug, or a design oversight.

PS. Yes, I'm in contact with related browser support teams but since they seem utterly hopeless i'm asking here, since its at least partially Windows Hello issue.

Problem description

Even with:

• Password managers disabled in browser settings,
• Windows Hello disabled in Chrome/Brave settings,
• Windows Hello PIN enabled only for device login,
• Passkeys still stored under chrome://settings/passkeys (which I cannot delete since its used for logging on the device),
• The devices are connected to Entra ID but this is not required to reproduce the issue although a buisness account configuration creates a Passkey with Windows Hello afaik.

Observed behavior

When I attempt to sign in on office.com, Windows Hello automatically triggers a dialog offering authentication via passkeys, even though:

1. I don’t want passkeys used for browser logins,
2. passkeys are turned off everywhere they can be,
3. Windows Hello is intended only for local device authentication.

The dialog cannot be suppressed, disabled, or hidden(trust me, i tried for weeks). It effectively forces the Windows Hello prompt as a primary option, which causes problems both personally and in business contexts (wrong credential signaling, misleading users that are supposed to use a dedicated password manager solution insted of browser password managers, enforcing an unwanted authentication flow, etc.).

What I already verified

• Many, many, (too many) Windows registry workarounds that never worked.
• Dug through almost all flags on those browsers.
• Chrome/Brave → Password Manager: disabled
• Chrome/Brave → Windows Hello toggle: off
• Looked through what feels like almost every related option in Windows Settings.
• Tried gpedit.msc local rules
• System up to date
• Windows Hello configured to use PIN, but stores "passkeys used to log on to this device"

Why this is a problem

Windows Hello automatically assumes that the device-level Windows Hello credentials should always be available as a WebAuthn authenticator.
This feels like a big security and UX issue due to:

• unexpected authentication dialogs,
• Inability to controll where and how passkey credential are shared to applications,
• inability to turn the feature off,
• no administrative or local option to disable Hello for WebAuthn separately from device login.
• Buisness users either having issues with keeping passwords in order (our buissnes uses a dedicated Password Manager but this behaviour covers its dialog option) or not having PIN to their devices (when I disable windows hello entierly, since when there is no passkeys the option doesn't appear)

Questions

1. Is there any supported way to disable Windows Hello as a WebAuthn/passkey option in browsers, while keeping Hello enabled for local device login?
2. Is this expected behavior from the Windows Hello, or is it considered a bug?
3. Are there registry/policy settings (documented or upcoming) that allow disabling the Windows platform authenticator specifically for browsers like Chrome and Brave?
4. Is Microsoft aware of this issue? If so, is it tracked anywhere?

Additional notes

This issue replicates 100% across (as long as there are passkeys configured):

• Windows 11 devices i've managed to get my hands on,
• Chrome and Brave (latest versions),
• multiple Microsoft accounts and tenants,
• multiple clean installations.

Any guidance or clarification from the Windows security or identity teams would be greatly appreciated. And honestly if there is any more info i could possibly provide PLEASE ask away.