Turning off MFA during autopilot enrollment

[mmiadmin]

How will I turn off MFA during autopilot device (windows 10) enrollment?

I saw some articles using conditional access policies. But, if it is enabled where will it be enabled and how can I turn it off? I do not want to create a new conditional access policy. Should this not exist already if it is working during autopilot enrollment? If so, how can I turn it off?

[#2]

If you set the “Require Multi-Factor Authentication to register or join devices with Azure AD” option to “Yes”, Azure AD prompts users to complete MFA. Thereafter, the user will be challenged with the MFA again if you have a CA policy enabled to do. Both of these settings can be controlled, however it is security best practice not to disable these.

[#3]

Hi, by the looks of it, you want to turn off the global setting to require MFA for devices that are getting enrolled. YOu can do so within devices/enroll devices/Windows hello for business
When this setting is not configured or enabled, the user will get prompted to setup mfa during enrollment.
You could turn this off by setting it to disabled.
Of course its not best practise to disable this setting but sometimes people disable this setting to scope it to a specific amount of users by configuring a policy

[#4]

@Rudy_Ooms_MVP Apologies for opening up an old thread, but I am trying the method you suggested for disabling users being prompted for MFA during autopilot. Regardless of whether or not I set the value of "Configure Windows Hello" to Disabled or Enabled, I am prompted to enter in values for pin length, complexity, etc. Are those values just being displayed but not applied if the "Configure Windows Hello" setting is set to disabled?

My end goal is to have users not be prompted for MFA during autopilot as well as to not be prompted for a pin during account setup. (No Biometric or Pin)

[#5]

Exclude Intune enrollment apps from MFA CA policy. Disable requirement for MFA for users under azure devices settings for Azure AD join. Disable WHfB in Intune at the tenant level and also through a device identity profile. Having said all of the above, it is not recommended to exclude the devices from MFA during Intune enrollment.