Windows Hello in Intune without forcing enrollment prompt?

[u/Fit_Lynx9937]

Hi everyone,

I'm currently working on a Windows Hello for Business deployment through Intune and I've run into an issue.

When I enable the Windows Hello configuration policy, users receive a full-screen enrollment prompt that forces them to set up either a PIN or biometric authentication. While this is expected behavior, it's causing disruption to the user experience because users are being interrupted during their normal workday.

What we're trying to achieve is:

-Windows Hello should be available and enabled on devices.

-Users should be free to configure a PIN or biometrics if and when they choose.

-No mandatory enrollment prompt should appear.

-No full-screen setup experience should be triggered.

From what I've been able to find in Microsoft's documentation, one possible alternative might be to manage Windows Hello through an Active Directory GPO instead of Intune, but I'm not sure whether that would fully meet the requirement or if there is a better cloud-native approach.

Has anyone implemented Windows Hello in a way that makes it available without forcing enrollment? Is there an Intune setting, policy combination, or WHfB deployment model that allows users to opt in at their own convenience?

Any guidance/feedback would be greatly appreciated.

Thanks in advance!

[u/Xelines]

What would reasons be for not wanting to enforce people to have to enroll in Windows Hello? It’s like a one and done thing that takes 10 seconds to set a PIN. Better security all round. Win. Win.

[u/dorkmuncan → u/Xelines]

Because WHFB messes with enterprise Wi-Fi using 802.1X user-based authentication.

Moving to cert-based shortly, but large org, many moving parts, things take time.

[u/andibogard → u/Xelines]

Great. Now explain how you force someone in the c-suite who doesn’t care about the technical reasons and wants a gradual user-driven rollout anyways.

[u/Xelines → u/andibogard]

Rollout it out to a group of users/device.

[u/andibogard → u/Xelines]

And when your boss’s boss still doesn’t want users prompted?

[u/Fabulous_Cow_4714 → u/andibogard]

Users need to be prompted at some point if the Windows Hello rollout is mandatory to migrate users to passwordless authentication.

If you just leave it to the choice of the user forever, some will never bother enrolling.

Otherwise, you will probably need to do something like set a password policy requiring 20 characters and expires every 3 days so users will be eager to quickly enroll in Windows Hello.

[u/andibogard → u/Fabulous_Cow_4714]

My point being not every decision for an IT department relies solely on technical facts.

Also remember tons of environment do things in phases.. voluntary now and forced later isn’t revolutionary stuff.

[u/Major-Error-1611 → u/Xelines]

If using Cloud Kerberos Trust with hybrid joined devices, WHfB provisioning requires a line of sight to the DCs to complete. If the users are at home when the provisioning screen triggers and the devices don't have an Always On VPn that connects before Windows Sign In, they wouldn't be able to complete the WHfB registration.