This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(80, 55.00000000000001%, 17%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EAS%3C/text%3E%3C/svg%3E)
-When going in windows to ->Sign ins-> I am unable to set biometrics.
*Some of these settings are hidden or managed by your organization.
for e.g.
Windows Hello Face
This option is currently unavailable - Click to learn more
-To try and solve this issue, I enabled Windows Hello for business from Intune -> Device -> enrollment -> Windows hello for business. But issue persists, What do you think could be the issue.
Check with Group Policy.
Computer Configuration > Administrative Templates > Windows Components > Biometrics.
Set Allow users to log on using biometrics policy setting to Enabled.
Hope this helps!
@Kapil Arya It is enabled.
@ZhoumingDuan-MSFT Checked this but was maybe wondering if there is a log or event viewer path to check further.
For more context Device is Hybrid entra join synced with AD and co managed with SCCM cloud attach and Intune, Devices are enrolled to intune with device credentials.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(188.79999999999998, 35%, 28%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EZM%3C/text%3E%3C/svg%3E)
@Ahmed Sh,Thanks for posting in Q&A.
Based on my research, the way you have configured to enable Windows Hello is available at device enrollment, if the device has already finish enrollment, you should Use identity protection profiles to manage Windows Hello for Business in Microsoft Intune after device enrollment.
https://learn.microsoft.com/en-us/mem/intune/protect/identity-protection-configure
If the issue persists, it is suggested that check if there exist some GPOs that may blocking this
https://www.technewstoday.com/some-settings-are-managed-by-your-organization/
Non-official, just for reference.
Hope it will help.
If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
This article has been helpful identifying potential conflicts between GPO and CSP and policy precedence.
I tried to check event viewer and can see no errors but some messages like the below:
The Windows Biometric Service failed to start its secure component.
Reason for unavailability: 4.
The operation failed with error: 0x80070032.
@Ahmed Sh,Thanks for your reply.
To solve this issue, here are some suggestions.
1.Try to update Windows.
2.Configure Automatic Startup:
Press Win + R, type services.msc, and press Enter.
Locate the Windows Biometric Service in the list.
Right-click on it and select Properties.
Set the Startup type to Automatic.
3.Update the related device driver from your device manufacturer.
@Ahmed Sh,Hope things going well.
I am currently standing by for further update from you and would like to know how things are going. If you have any questions or concerns on the recent information I've provided you, please don't hesitate to let me know.
Hello ZhoumingDuan-MSFT, It appears currently that there are some restrictions for accessing services.msc/regedit. etc... from the machine, I don't recall imposing any restrictions using GPO or Intune, So I am trying to figure that out at the moment.
@Ahmed Sh,Hope you have a good day.
I am writing as a courtesy to follow up on this issue. May I know the status from your side please? Please feel free to let me know if you have any concerns.
This article is very helpful identifying issues with conflicts between GPO and CSP and precedence.
https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/configure?source=recommendations
This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(304, 88%, 39%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESC%3C/text%3E%3C/svg%3E)
Not much help there!
How can you mark anything here as "solution"?
There is NO solution!
Hi @Sebastian Cerazy ,
I don't recall having solved this issue but at least I am aware what the issue is, I hope the below can explain it further.
My scenario is that I have third party federation and third party provisioning, I also have a upn mismatch due to domains in onpremise being different from cloud, The third party provisioning maps onprem domain to cloud.
-However on the device itself, The devices are not recognizing that I am within org network simply because I am unable to retrieve AzurePRT as a result of this mismatch.
From CMD:
Dsregcmd /status
+----------------------------------------------------------------------+
| SSO State |
+----------------------------------------------------------------------+
AzureAdPrt : NO
============================
-Thus as a result when applying WHB policy to enable biometrics in a Hybrid Entra ID scenario, The logged in user is not recognized as an Azure AD user despite being mapped to cloud using third party provisioning.
IsDeviceJoined : YES
IsUserAzureAD : NO
PolicyEnabled : YES
PostLogonEnabled : YES
DeviceEligible : YES
SessionIsNotRemote : YES
CertEnrollment : none
PreReqResult : WillNotProvision
-This means somewhere in the middle third party provisioning solution is unable to convey that user onprem using domain 1 is the same as user in cloud using domain 2 and this causes AzurePRT to not be retrieved, and pre-req check failing for NGC.