Enforce Windows Hello

[mlawton1986]

Hi,

We have an environment full of Azure AD joined Windows 10 devices.

We want to enforce MFA (Hello).

If we set a Windows Hello Intune policy then a user can skip therefore it is not enforced. We have tested the MFA registration policy, my understanding is that after 14 days of skipping it should lock the user out of any MS cloud service... but it doesn't, it doesn't seem to do a lot.

Also - even once Hello is registered a user still has the option of logging into the desktop using username and password and therefore bypassing the MFA.... 

Has anyone got anything similar working?

Thanks

[#2]

I think you are confusing MFA and Windows Hello.

MFA can be required on Azure AD and the user has the possibility to skip registration for 14 days. After 14 days, the user is forced to register for MFA. After this, the user has to do MFA depending on the Conditional Access configuration.

Windows Hello for Business is an Intune policy but you are right that it can be skipped. I haven't found a way to force it myself. Windows Hello is device specific and the user will never be locked out of MS cloud services due to Windows Hello.

If Windows Hello is configured, the user still has the option to sign-in with a password (instead of PIN/Face) and this cannot be disabled

[#3]

@Thijs Lecomte thanks for responding.

I am a bit confused now. As far as I am aware Windows Hello for Business is MFA.... you have the devices certificate plus another form (pin, facial recognition etc.).

or are you saying that when Azure/M365 refer to MFA they are talking about password + sms/app only and Windows Hello doesn't count as MFA (e.g. for MFA registration policy, conditional access etc.)?

[#4]

Yeah you are right. I am talking about M365 MFA 🙂