How do disable Windows Hello PIN on Entra ID joined device

Question

Hi dear,

I'm currently testing the Entra ID cloud-only environment, and I recently joined a device to my Entra ID. I've noticed that Windows Hello PIN was automatically enabled, and I'm unable to deactivate it.

I want to know, how can i deactivate Windows Hello PIN from my Entra ID joined devices.

Best regards,

Answer 1

Hi @Jenner Vinícius F. de Oliveira Filho ,

I understand that you are trying to disable the Windows Hello pin on an Entra ID joined device.

You have a few options to achieve this, but there are some limitations with each option.

1.You can create a dedicated device configuration profile and disable Windows Hello for Business for certain groups or users: https://learn.microsoft.com/mem/intune/protect/identity-protection-configure?WT.mc_id=M365-MVP-5004286

2.You can use a Group Policy to disable Windows Hello for Business.

1.Press win + R, type gpedit.msc and enter. 2.Click Administrative Templates > Windows Components > Windows Hello for Business under User configuration and Computer Configuration and disable use Windows Hello for Business. 3.Open CMD as admin and type certutil.exe -deleteHelloContainer to delete the Windows Hello for Business container. 4.Restart the device.

3.You can disable the PIN option in Windows Hello for Business in the Intune Admin Center under "Windows Enrollment" but this setting will apply across your entire tenant and cannot be scoped to particular users or devices.

If the information helped you, please Accept the answer. This will help us as well as others in the community who may be researching similar questions.