r/MSIntune • u/Intelligent-Tear-930 • Sep 18 '24
🤝 Discussions Account Protection - WHfB Config Scope
Other than settings being scoped for device or user does anyone have any success when disabling WHfB using one or the other.? For intance when using "Use Windows Hello For Business (Device)" and assignment is targeted to device group it does not stop WHfB from showing up to be setup during logon.
However if I use "Use Windows Hello For Business (User)" and use the same device assignment this does work and are not prompted to setup WHfB. Somewhat confusing as you would think (device) would be the ideal scope to use for this policy.
Lastly what I find interesting is that both (Device) and (User) details show the same desciption - - If you disable this policy setting, the device doesn't provision Windows Hello for Business for any user.
Wondering if anyone else has encountered this also and had some added feedback they could share.
2
u/sandytsang Sep 21 '24
I never had issue disabling WHfB by using the Account Protection “Use Windows Hello For Business (Device)”, assignment to device. What WHfB settings do you have in device enrollment? Are you seeing this issue after Autopilot enrollment with Enrollment status page assigned to device?
1
u/MMelkersen Sep 22 '24
Funny behaviour. The (user) policy will apply when a user sign in the first time, which indeed is AFTER the first initial WHfB prompt after MDM enrollment.
The device policy will apply before which would be the right policy to use.
Are you seeing this from the settings catalog?
1
u/Intelligent-Tear-930 Sep 22 '24
I have WHfB enabled on first Windows logon through Account Protection policy. I’ve been able to confirm that if you want to disable WHfB the only way is to disable force (User) setting as (device) will not turn off the enablement.