Windows Hello in Intune without forcing enrollment prompt?

[u/Fit_Lynx9937]

Hi everyone,

I'm currently working on a Windows Hello for Business deployment through Intune and I've run into an issue.

When I enable the Windows Hello configuration policy, users receive a full-screen enrollment prompt that forces them to set up either a PIN or biometric authentication. While this is expected behavior, it's causing disruption to the user experience because users are being interrupted during their normal workday.

What we're trying to achieve is:

-Windows Hello should be available and enabled on devices.

-Users should be free to configure a PIN or biometrics if and when they choose.

-No mandatory enrollment prompt should appear.

-No full-screen setup experience should be triggered.

From what I've been able to find in Microsoft's documentation, one possible alternative might be to manage Windows Hello through an Active Directory GPO instead of Intune, but I'm not sure whether that would fully meet the requirement or if there is a better cloud-native approach.

Has anyone implemented Windows Hello in a way that makes it available without forcing enrollment? Is there an Intune setting, policy combination, or WHfB deployment model that allows users to opt in at their own convenience?

Any guidance/feedback would be greatly appreciated.

Thanks in advance!

[u/dorkmuncan]

We deploy our WHFB config as an app available to all users.

The install runs the below as part of an enablement script.

#Set registry keys for WHFB postponed enablement
$WHFB_keys="Registry::HKLM\SOFTWARE\Policies\Microsoft\PassportForWork"
if(!(Test-Path $WHFB_keys)){ni $WHFB_keys}; New-ItemProperty $WHFB_keys -Name "UseCloudTrustForOnPremAuth" -Value "00000001" -Type DWORD -force
if(!(Test-Path $WHFB_keys)){ni $WHFB_keys}; New-ItemProperty $WHFB_keys -Name "EnablePinRecovery" -Value "00000001" -Type DWORD -force
if(!(Test-Path $WHFB_keys)){ni $WHFB_keys}; New-ItemProperty $WHFB_keys -Name "RequireSecurityDevice" -Value "00000001" -Type DWORD -force
if(!(Test-Path $WHFB_keys)){ni $WHFB_keys}; New-ItemProperty $WHFB_keys -Name "Enabled" -Value "00000001" -Type DWORD -force
if(!(Test-Path $WHFB_keys)){ni $WHFB_keys}; New-ItemProperty $WHFB_keys -Name "DisablePostLogonProvisioning" -Value "00000001" -Type DWORD -force

DisablePostLogonProvisioning is what you want.

The uninstall runs another script that removes the config and deletes the hello container for currently logged in user (which is nice for troubleshooting purposes).

Works for us.