2,098 questions
What policy would motivate you to do this?
How to disable Iris Recognition (Biometrics) or WHfB, if neccessary, for HoloLens 2 in Intune?
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(131.20000000000002, 52%, 22%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ELG%3C/text%3E%3C/svg%3E)
Leonard Gilbert
146
Reputation points
Due to business policy, I need to disable the HoloLens from using Iris Recognition to sign into the device. It is enabled by default after AutoPilot finishes deployment. I am finding no information on how to do this. I created an identity protection policy, WIn 10 and later, but it says not applicable for the HoloLens devices in the policy device status page. If you can't disable Iris recognition without letting them keep PIN usage then can I have any information for disabling Windows Hello on the devices then? If its not possible to disable then I'd love a mvp to reply with that so that I can take it back to the business.
Microsoft Security | Intune | Configuration
Microsoft Security | Intune | Enrollment
1,510 questions
Accepted answer
-
Jason Sandys 31,411 Reputation points Microsoft Employee Moderator2022-01-19T22:56:33.947+00:00 -
Leonard Gilbert 146 Reputation points
2022-01-20T01:18:39.15+00:00 My legal/compliance team has specifically not allowed Windows Hello usage in our environment for reasons unknown to me so therefore I leave it as business policy. If it is not possible, that is fine for me but I just need to give them an answer.
-
Leonard Gilbert 146 Reputation points
2022-01-20T18:27:47.583+00:00 Got a bit more info on this. It is in regard to Illinois biometric information protection law. It seems my company decided to just block the use of Windows Hello to not deal with the consent collection requirements I think.
-
Jason Sandys 31,411 Reputation points Microsoft Employee Moderator
2022-01-20T20:17:57.537+00:00 As noted, this law does not block the use of biometrics. From memory, it blocks the storage of biometric information which Windows Hello for Business does not do.
-
Leonard Gilbert 146 Reputation points
2022-01-20T22:09:30.337+00:00 Thanks Jason, that was very helpful. I relayed this to business and they were wondering if you can elaborate? From your last statement, I think we have some uncertainty on how the Biometric data is stored with Windows Hello in regard to continuous login.
-
Jason Sandys 31,411 Reputation points Microsoft Employee Moderator
2022-01-21T14:41:55.017+00:00 As noted, it's not stored at all. Just like we don't store passwords for authentication purposes, we don't store biometrics either. Instead, for both, we store cryptographically strong hashes of passwords and biometrics that cannot be reverse engineered to obtain the original password or biometric. This is more or less covered at https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-biometrics-in-enterprise#where-is-windows-hello-data-stored.
-
Leonard Gilbert 146 Reputation points
2022-01-21T16:08:10.69+00:00 Thanks for this information. I believe we've covered everything currently in regard to utilizing our HoloLens and potentially usage of WHFB in our environment in the future.
Sign in to comment -