Can Windows Hello be set as the default credential option in UAC elevation prompts instead of password?

Question

Can Windows Hello (PIN/fingerprint) be made the default first option in UAC elevation prompts instead of password, while still keeping password as fallback? Currently it appears only under “More choices”. I tested disabling password provider and Hello becomes default, but that is not a viable production solution. Is there any supported policy or Intune configuration for this?

Answer 1

AFAIK, unfortunately that's not the case. UAC credential prompts use a secure desktop and a fixed credential provider ordering. Microsoft does not expose any Group Policy, registry setting, or Intune configuration to change the default provider selection or reorder providers for elevation prompts. Windows Hello for Business is supported for elevation, but it is intentionally placed under “More choices” unless it is the only available provider. Disabling the password provider forces Hello to the front, as you observed, but that breaks supported security and recovery scenarios and is not considered a valid production configuration.

Relevant policies you might have already seen, such as “Interactive logon: Require Windows Hello for Business or smart card,” or various Windows Hello for Business Intune settings, only affect sign-in behavior and provisioning, not the UAC credential UI ordering. Likewise, UAC policies like “Behavior of the elevation prompt for administrators” control whether consent or credentials are required, but not which credential type is preselected.

If the goal is to reduce password use during elevation, the supported approaches are limited to either allowing consent-only elevation for administrators or ensuring Windows Hello for Business is deployed so users can choose it manually in the prompt. Beyond that, changing the default selection would require unsupported customization of credential providers or system behavior.

---

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin