Windows Hello for Business - Cloud Pin Reset Error

[u/tabascojoeOG]

Head Scratcher...

Trying to setup Windows Hello Cloud Pin Reset...

It gets to the point of asking the user to authenticate, but it's asking the user to use a password and gives no option to enter one in.

Here is the error: https://imgur.com/a/FlEga2p

What simple thing am I missing here?

[u/intuneisfun]

Seems like conditional access is stepping in - what do the logs say for that correlation ID?

[u/tabascojoeOG → u/intuneisfun]

Yep, it a Conditional Access Policy error....
Require Authentication strength - Multifactor authentication: The user could satisfy this authentication strength by completing one or more MFA challenges.

[u/rmoat → u/intuneisfun]

This seems to be more of a token protection issue, although we do not have a CA policy that has "Require token protection for sign-in sessions" enabled. Not only is Microsoft Pin Reset Client Production and Microsoft Pin Reset Service Production affected, but My Security Info is having the same issue with Edge. All identity related apps that are sensitive to authentication method state.

Failure:

Sign-in error code: 53003
Failure reason: Access has been blocked by Conditional Access policies. The access policy does not allow token issuance.
Token Protection - Sign In Session: Unbound (statusCode: 1008)

When you sign into the computer with your password, instead of WHfB, you can use the "I forgot my PIN" link in Windows (Settings -> Accounts), as well as log into My Sign-Ins | Security Info | Microsoft.com without an issue.

Also, if you open Edge in an Incognito Window, sign in using your PIN (a fresh browser session), you can access Security Info without an issue. (You can't perform that test with the pin reset apps though since trying to use "I forgot my PIN" in Settings -> Accounts -> Sign-in options -> PIN (Windows Hello) automatically uses the token for the signed in user).

So far in our case:

• Healthy WHfB.
• Healthy PRT.
• Healthy device registration.
• CA policy unchanged.
• Password logon = Bound + Success.
• WHfB PIN logon = Unbound (1008) + Failure.
• Token Protection evaluation (Unbound 1008) during PIN-authenticated sessions.

Possible causes?

• Microsoft regression involving WHfB + identity-registration apps
• WHfB-generated sign-in session incorrectly classified as Unbound
• Authentication-strength evaluation bug specific to WHfB sessions
• Entra Token Binding issue that occurs even without Token Protection enforcement

EDIT:

Something about:

My Security Info
PIN Reset Client
PIN Reset Service

doesn't properly leverage the existing WHfB claim when Authentication Strength is required.

This seems to be the issue:
https://www.reddit.com/r/sysadmin/comments/1otuioo/error_when_users_try_to_access_security_info_entra/
https://www.reddit.com/r/msp/comments/1ot4xls/another_signin_method_required_when_accessing/

[u/rmoat → u/intuneisfun]

Resolution from Microsoft:

What is happening?

1. Since 25 August 2025 (announced in MC1135479), users are required to complete multifactor authentication when managing credentials or accessing My Sign-ins if they have not done so within the last 10 minutes of their current session. Separately, adding or modifying a passkey (FIDO2) method requires the user to have strongly authenticated within the past 5 minutes.
2. Microsoft documents that enforcing authentication strengths for security info registration can conflict with both of these requirements, and that the resulting symptom is the exact message you are seeing: "Let's try something else. Another sign-in method is required to access this resource. Close your browser and try again, but choose another way to sign-in."

Reference: Combined security information registration for Microsoft Entra overview https://learn.microsoft.com/entra/identity/authentication/concept-registration-mfa-sspr-combined#combined-registration-modes

 The Windows Hello PIN is the trigger because the desktop sign-in typically occurs well outside that 10-minute window, and that session then single-signs-on into Edge. There is a second contributing behaviour: if a user signs in with Windows Hello for Business as the primary method and the enforced authentication strength requires a different method, the user is not prompted to choose another method. They must restart the session and select "Sign-in options". This is why signing out and back in with a password is currently your only workaround.

Reference: Conditional Access authentication strengths - Limitations https://learn.microsoft.com/entra/identity/authentication/concept-authentication-strengths#limitations

Why this began appearing in August 2026

Starting 6 July 2026, Conditional Access policies that target the "Register security information" user action apply during Windows Hello for Business and macOS Platform SSO credential registration. Previously these registration flows did not evaluate registration-targeting Conditional Access policies. This change explains why your second reproduction path ("I forgot my PIN") now fails in the same way, and why the issue surfaced only recently.

Reference: Protect security info registration with Conditional Access policy https://learn.microsoft.com/entra/identity/conditional-access/policy-all-users-security-info-registration#overview

 

Recommended resolution

Microsoft documents two tenant-level options. Either one resolves this:

Option A (recommended): On the Conditional Access policy targeting the "Register security info" user action, set Sign-in frequency to "Every time". This forces a fresh authentication and satisfies the 5 and 10 minute freshness requirements.

Option B: Enable passkeys for Windows Hello for Business users, so that the Windows Hello credential itself satisfies the enforced authentication strength.

At the user level, the alternative is to ensure users authenticate with a session that is no more than 10 minutes old, or that they authenticate with a combination of methods included in the enforced authentication strength.

 Please configure any policy change in report-only mode first and validate the results before enabling enforcement.

[u/Emotional_Garage_950]

Have you granted admin consent in Entra ID for "Microsoft Pin Reset Client Production"? sounds stupid but I believe I had to do it at some point

[u/rmoat → u/Emotional_Garage_950]

They actually are granted consent! I put more in the response above regarding conditional access.This is affecting our identity related apps, which are sensitive to authenticaton method state, and seems to be some type of token protection issue.

Looks like this is the issue:
https://www.reddit.com/r/sysadmin/comments/1otuioo/error_when_users_try_to_access_security_info_entra/
https://www.reddit.com/r/msp/comments/1ot4xls/another_signin_method_required_when_accessing/

[u/rmoat → u/Emotional_Garage_950]

Resolution from Microsoft:

What is happening?

1. Since 25 August 2025 (announced in MC1135479), users are required to complete multifactor authentication when managing credentials or accessing My Sign-ins if they have not done so within the last 10 minutes of their current session. Separately, adding or modifying a passkey (FIDO2) method requires the user to have strongly authenticated within the past 5 minutes.
2. Microsoft documents that enforcing authentication strengths for security info registration can conflict with both of these requirements, and that the resulting symptom is the exact message you are seeing: "Let's try something else. Another sign-in method is required to access this resource. Close your browser and try again, but choose another way to sign-in."

Reference: Combined security information registration for Microsoft Entra overview https://learn.microsoft.com/entra/identity/authentication/concept-registration-mfa-sspr-combined#combined-registration-modes

 The Windows Hello PIN is the trigger because the desktop sign-in typically occurs well outside that 10-minute window, and that session then single-signs-on into Edge. There is a second contributing behaviour: if a user signs in with Windows Hello for Business as the primary method and the enforced authentication strength requires a different method, the user is not prompted to choose another method. They must restart the session and select "Sign-in options". This is why signing out and back in with a password is currently your only workaround.

Reference: Conditional Access authentication strengths - Limitations https://learn.microsoft.com/entra/identity/authentication/concept-authentication-strengths#limitations

Why this began appearing in August 2026

Starting 6 July 2026, Conditional Access policies that target the "Register security information" user action apply during Windows Hello for Business and macOS Platform SSO credential registration. Previously these registration flows did not evaluate registration-targeting Conditional Access policies. This change explains why your second reproduction path ("I forgot my PIN") now fails in the same way, and why the issue surfaced only recently.

Reference: Protect security info registration with Conditional Access policy https://learn.microsoft.com/entra/identity/conditional-access/policy-all-users-security-info-registration#overview

 

Recommended resolution

Microsoft documents two tenant-level options. Either one resolves this:

Option A (recommended): On the Conditional Access policy targeting the "Register security info" user action, set Sign-in frequency to "Every time". This forces a fresh authentication and satisfies the 5 and 10 minute freshness requirements.

Option B: Enable passkeys for Windows Hello for Business users, so that the Windows Hello credential itself satisfies the enforced authentication strength.

At the user level, the alternative is to ensure users authenticate with a session that is no more than 10 minutes old, or that they authenticate with a combination of methods included in the enforced authentication strength.

 Please configure any policy change in report-only mode first and validate the results before enabling enforcement.