Require Security Device policy for Windows Hello for Business noncompliant

Question

Hello,

I am working on enabling Windows Hello for Business and I am running into an issue with the "Require Security Device" policy. My devices are running Windows 11 22H2 with the TPM 2.0 modules enabled, and I have enabled cloud trust. According to this MS article, I should enable these policies from the Settings Catalog and deploy them to my devices or users (I have it deployed to a device group.) After sending the policy to my test group, Intune is reporting an error with the Require Security Device policy on some devices as it is not compliant.

Also I have noticed on at least one machine, the results will flip between compliant and not compliant. I validated the TPM module is visible to Windows and I cannot find any issues with it. Despite this, I created a Windows Hello configuration policy using the Identity Protection template and and deployed to the same device group. My testers were able to enroll in Windows Hello for Business and it works fine as I understand Windows will provision Windows Hello using software as opposed to the TPM if it is unavailable or not functioning but I don't understand why this is happening to begin with. Thanks in advance.

Answer 1

Update: After posting, I checked the HelloForBusiness event log on my PC and I noticed these two events which may explain the policy is succeeding or failing though I haven't come across this before. I think this might be driver related but I am fairly sure that I am up to date. I'll do a driver check and post back.