Event banner

Windows Office Hours: January 16, 2025

Event Ended
Thursday, Jan 16, 2025, 08:00 AM PST
Online

Event details

Dom_Cote's avatar
Dom_Cote
Brass Contributor
Jan 16, 2025

Here's a fun one - that is SUPER common in our business:

  1. Configure M365/Entra for phishing resistant MFA (=WHfB + FIDO2)
  2. Take an existing device and JOIN Entra through settings - accounts - access work etc.
  3. Sign in to Entra using FIDO2 key (WHfB hasn't been configured at this point). Success.
  4. Switch to new Entra / work account by signing in to it.
  5. Windows completely (!) skips the ESP and goes straight to desktop, which is not ready yet. Also, WHfB never deploys, despite it being a mandatory policy.

When we repeat the same process using a password and MFA, everything works as expected.

Why does the ESP not run in this scenario?
How can we ensure ESP runs as expected for the perfect desktop experience - using NOTHING but FIDO2 keys to onboard?

Hung_Dang's avatar
Hung_Dang
Icon for Microsoft rankMicrosoft
Jan 16, 2025

In the ESP profile, make sure the "Only show page to devices provisioned by out-of-boxy experience (OOBE)" setting is set to No, since you're doing a Workplace Join and not an Entra join/MDM enrollment in OOBE.  Setting it to Yes should make the ESP display only when Entra join/MDM enrollment occurs during OOBE.  Hope this helps.

Date and Time
Jan 16, 20258:00 AM - 9:00 AM PST