Windows Hello for Business on Intune does not have "Digits in PIN" requirement

Dat Truong Manh 41 Reputation points
2021-04-07T03:26:57.927+00:00

Hi,
I recently find out that Windows Hello for Business on Intune does not have the requirement for digits which allows users to create letter-only PIN. I take a look at the PIN requirements on an enrolled device and the digit requirement displays as "May include digits". For testing, I attempt to create a PIN without digit to confirm and that digit-less PIN is accepted. This issue occurs on Windows Home devices and Windows Pro devices with the OS build 19042.867
85106-image.png

The PIN requirements set on Intune Windows Hello for Business:
85121-image.png
85037-image.png
85114-image.png

The desired outcome is end users must include at least 1 digit and 1 lowercase letter in the PIN. Is there any solution I can try for this issue?

Windows 10 Security
Windows 10 Security
Windows 10: A Microsoft operating system that runs on personal computers and tablets.Security: The precautions taken to guard against crime, attack, sabotage, espionage, or another threat.
2,753 questions
Microsoft Intune Configuration
Microsoft Intune Configuration
Microsoft Intune: A Microsoft cloud-based management solution that offers mobile device management, mobile application management, and PC management capabilities.Configuration: The process of arranging or setting up computer systems, hardware, or software.
1,716 questions
Microsoft Intune Enrollment
Microsoft Intune Enrollment
Microsoft Intune: A Microsoft cloud-based management solution that offers mobile device management, mobile application management, and PC management capabilities.Enrollment: The process of requesting, receiving, and installing a certificate.
1,244 questions
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Crystal-MSFT 42,956 Reputation points Microsoft Vendor
    2021-04-08T02:48:00.767+00:00

    @Dat Truong Manh , Yes, currently under identity protection template, there's no such setting with digits So we didn't get "TenantId/Policies/PINComplexity/Digits" when deploying via this template. We can try to request this feature in Intune user voice:
    https://microsoftintune.uservoice.com/forums/291681-ideas

    As a workaround, we can deploy a custom device configuration profile to set Digit requirement for Windows Hello for Business. Here are the steps I have done in my lab.

    1. I have created a custom device configuration profile.
    2. Add the OMA-URI settings with the following value.

    OMA-URI: ./User/Vendor/MSFT/PassportForWork/<tenant id>/Policies/PINComplexity/Digits
    Data type: integer
    Value: 1
    85517-image.png

    3.Then I assign the it to the same user group as the one identity protection device configuration profile.
    4.After the restart, I find it works: and change PIN is asked.
    85571-image.png

    Hope it can help.

    If the response is helpful, please click "Accept Answer" and upvote it.
    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

    1 person found this answer helpful.
  2. Crystal-MSFT 42,956 Reputation points Microsoft Vendor
    2021-04-07T07:59:14.097+00:00

    @Dat Truong Manh , Based on my research, I find that require the use of at least one digit in PIN can be defined in PassportForWork CSP. We can try to deploy this via OMA URI with value 1 to see if it is working.
    85214-image.png
    https://learn.microsoft.com/en-us/windows/client-management/mdm/passportforwork-csp

    Hope it can help.

    If the response is helpful, please click "Accept Answer" and upvote it.
    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.