This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(316.8, 14.000000000000002%, 40%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EDR%3C/text%3E%3C/svg%3E)
I'm in an IT group that is part of a fast growing company, and as such many of our GPO and Intune configurations were configured by someone who is now gone, so we're left holding the bag on the issue.
We want a way for users to be able to change their Sign-In PIN, help desk to reset the PIN, and/or change from PIN to Biometrics. But on a domain-joined/intune-compliant workstation, the Windows 10 Settings->Accounts->Sign-In Options are missing. On a domain-joined/not-yet-in-azure workstation the Sign-In options are available, but not able to be changed "due to company security policies". In reviewing our Intune Device Configuration Profiles, I cannot find anything that hides the Sign-In section of Settings->Accounts. I see simple password is disabled, PIN and Biometric options are enabled, other password policies are enabled (complexity, length of time to use password, etc). On first login to a workstation after joining the domain and Intune, you can select a PIN or Biometric option, and it works to login after reboot. But we cannot change it if someone forgets their PIN
Windows Hello for Business PINs are device and user-specific and thus are not managed in any central way and also not changeable by anyone except the user. If the user needs their PIN changed, then they need to use one of the other methods to log into the same device and then they can change the PIN. If the password provider is disabled, then an admin will have re-enable it on that device first. Note that this is unrelated to Intune.
Information about how this provider can be disabled via group policy is at https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/passwordless-strategy#excluding-the-password-credential-provider. For information about to disable it using Intune, see https://www.petervanderwoude.nl/post/excluding-the-password-credential-provider/
@Dustin Rowland Thanks for posting in our Q&A.
In my environment, when I use the Azure AD account logging in the device, I can see Sign-in Options.
For the situation you met, I agree with Jason said, it is not related to intune. Also, I have done a lot of research. The following link shows some information about Windows Hello Sign In options PIN Missing issue. We can refer to it:
https://learn.microsoft.com/en-us/answers/questions/102887/windows-hello-sign-in-options-pin-missing.html
Thanks for understanding.
@Dustin Rowland I am currently standing by for further update from you and would like to know how things are going. If you have any questions or concerns, please don't hesitate to let us know.
Sorry for the delay in responding, but what I'm trying to locate is when you are logged into your account on the workstation (have access to the Desktop and Documents), if you go to Settings -> Accounts. Our "Sign-In Options" setting is missing, so users are unable to change their PIN or setup biometric options. I have looked through our GPO and Intune, and I must be missing it because I cannot find the setting that's hiding it.
I don't know if there's an equivalent group policy or setting within Intune, but using a CSP, you can disable that page: https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-settings#settings-allowsigninoptions (AllowSignInOptions settings).