Hi,
Thank you for posting in Microsoft Q&A forum.
Disabling Windows Hello for Business configuration (tenant-wide settings) from the Intune portal only disables Windows Hello for Business enrollment on new device provisioning. It has no effect on devices that have already gone through provisioning in the past and does not stop the users from using the PIN that already set up.
To delete Windows Hello for Business (WHfB) registration and remove existing PIN from the local device, we can use the PowerShell command “certutil /deletehellocontainer“, and deploy the PowerShell command to the devices via Intune. For more information, please refer to:
Remove existing WHfB PIN using Intune
Disabling Windows Hello for Business and removing existing PIN with Microsoft Intune
Intune: Delete Windows Hello for Business registrations
Thanks for your time. Have a nice day!
Best regards,
Simon
If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.