How to disable/enable Windows Hello for Business in Intune?

Question

Hello,

After deletion by Microsoft Identity Protection configuration template in July, what is the way to block Windows Hello for Business for all users and then enable it for only one group?

Previously, it was "Configure Windows Hello for Business" with Enable/Disable options.

In Endpoint security > Account protection I don't see this option.

It's not in the settings catalog either (Devices > Configuration > Policies).

Answer 1

You might have to push registry settings to enable it by users.

Make sure the enrollment there is set at what you want too for the device;

Answer 2

Hi Artur,

Thank you for posting in the Q&A Forums.

Using Group Policy

If your environment is based on Active Directory, you can manage the enabling and disabling of Windows Hello Enterprise via Group Policy.

Steps:

Open the Group Policy Management Editor (gpedit.msc).

Navigate to Computer Configuration > Administrative Templates > Windows Components > Windows Hello for Business (note that the path may be slightly different depending on the Windows version, but roughly similar).

Find the relevant policy setting, such as “Enable Windows Hello for Business” or similar, and set it to “Disabled” to prevent all users from using it.

Next, in order to enable Windows Hello for Business for just one specific group, you may need to create a new Group Policy Object (GPO) and link it to the OU (Organizational Unit) that contains that user group.

In the new GPO, enable the appropriate Windows Hello Enterprise policy settings.

Using Microsoft Intune or Endpoint Manager

If your organization uses a modern management solution such as Microsoft Intune or Endpoint Manager, you can configure policies using these tools.

Steps:

Log in to the Microsoft Endpoint Manager management portal.

Navigate to the Device Configuration or Policies section.

Create a new profile, selecting Windows 10 and later as the target platform.

In the profile, find the settings related to Windows Hello Enterprise and set it to Allow only specific groups.

Assign this policy to the Azure AD group that contains the target user group.

Best regards

NeuviJ

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.