Windows Hello for Business Keeps Prompting for PIN

%3CLINGO-SUB%20id%3D%22lingo-sub-1070842%22%20slang%3D%22en-US%22%3EWindows%20Hello%20for%20Business%20Keeps%20Prompting%20for%20PIN%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1070842%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20All%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EStrange%20one%20here.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWindows%20Hello%20for%20Business%20is%20Disabled%20in%20Intune%20yet%20new%20devices%20are%20still%20being%20prompted%20for%20a%20PIN.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAdditional%20info%3A%20ADFS%20environment%20and%20recent%20conversion%20to%20Hybrid%20Azure%20AD%20Join.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAny%20ideas%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1070842%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EIntune%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EMobile%20Device%20Management%20(MDM)%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1071626%22%20slang%3D%22en-US%22%3ERe%3A%20Windows%20Hello%20for%20Business%20Keeps%20Prompting%20for%20PIN%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1071626%22%20slang%3D%22en-US%22%3EHave%20you%20disabled%20it%20in%20Windows%20Enrollment%20or%20through%20a%20config%20policy%3F%3CBR%20%2F%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1071816%22%20slang%3D%22en-US%22%3ERe%3A%20Windows%20Hello%20for%20Business%20Keeps%20Prompting%20for%20PIN%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1071816%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F186539%22%20target%3D%22_blank%22%3E%40Thijs%20Lecomte%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EHey%20thanks%20for%20your%20reply.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWHfB%20has%20been%20Disabled%20in%20Windows%20Enrollment.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIs%20there%20anywhere%20else%20that%20this%20would%20come%20from%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1072554%22%20slang%3D%22en-US%22%3ERe%3A%20Windows%20Hello%20for%20Business%20Keeps%20Prompting%20for%20PIN%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1072554%22%20slang%3D%22en-US%22%3EThere%20might%20be%20a%20seperate%20Intune%20policy.%3CBR%20%2F%3EIf%20you%20go%20to%20the%20WHFB%20settings%2C%20does%20it%20say%20managed%20by%20your%20org%3F%3CBR%20%2F%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1086404%22%20slang%3D%22en-US%22%3ERe%3A%20Windows%20Hello%20for%20Business%20Keeps%20Prompting%20for%20PIN%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1086404%22%20slang%3D%22en-US%22%3EHi%20Stuart%2C%3CBR%20%2F%3E%3CBR%20%2F%3EIt%20could%20be%20coming%20from%20Configuration%20Profile%20or%20Security%20Baseline.%3CBR%20%2F%3E%3CBR%20%2F%3EYou%20can%20also%20check%20traditional%20Group%20Policy%20Management%20in%20case%20anything%20scoped%20from%20there.%3C%2FLINGO-BODY%3E
Regular Contributor

Hi All

 

Strange one here.

 

Windows Hello for Business is Disabled in Intune yet new devices are still being prompted for a PIN.

 

Additional info: ADFS environment and recent conversion to Hybrid Azure AD Join.

 

Any ideas

4 Replies
Have you disabled it in Windows Enrollment or through a config policy?

@Thijs Lecomte 

 

Hey thanks for your reply.

 

WHfB has been Disabled in Windows Enrollment.

 

Is there anywhere else that this would come from?

 

 

There might be a seperate Intune policy.
If you go to the WHFB settings, does it say managed by your org?
Hi Stuart,

It could be coming from Configuration Profile or Security Baseline.

You can also check traditional Group Policy Management in case anything scoped from there.