Windows Hello Face/Fingerprint doesn't work when deploying with MDT

Question

We've moved all new builds to Windows 11 (where the computer supports it) - one thing we've noticed is that all machines we install 11 on don't let you enroll your face or fingerprint in Settings.

If you're logging in for the first time in the OOBE it lets you enroll, after that you can't enroll. It just shows "Sorry, something went wrong", the Face enrollment just crashes.

I thought this was due to our TS breaking something, installing Windows from USB on this hardware works fine.

I've just set up a brand new Deployment Share with nothing in it but the stock Client TS template and the Microsoft ISO, the issue happens here as well.

Anybody else seen this or know where to even start? Event logs don't show anything.