You may be able to use the web sign in credential provider. This will block the users from using their password to login to Windows and will allow MFA using either WHfB, FIDO2, or MS MFA app to login using the new passwordless experience. https://learn.microsoft.com/en-us/windows/security/identity-protection/web-sign-in/?tabs=intune https://learn.microsoft.com/en-us/windows/security/identity-protection/passwordless-experience/ Otherwise, if they're autopiloted you can block access and that will prevent them from logging in. Hope that helps! ☺️