This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(76.8, 26%, 17%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESR%3C/text%3E%3C/svg%3E)
I'm trying to determine what the next steps should be to configure a new domain server environment. I'm using Azure AD Connect, pass-through authentication with SSO enabled.
I created a GPO Hybrid Azure AD join
Computer Configuration/Administrative Templates/Windows Components/Device Registration
"Register domain joined computers as devices" - "Enabled".
Modified Default Domain Policy to include:
User Configuration/Administrative Templates/Windows Components/Internet Explorer/Internet Control Panel/Security Page
Site to Zone Assignment List
https://autologon.microsoftazuread-sso.com - 1
https://device.login.microsoftonline.com - 1
User Configuration/Administrative Templates/Windows Components/Internet Explorer/Internet Control Panel/Security Page/Intranet Zone
"Allow updates to status bar via script" - "Enabled".
I configured Azure AD Connet with Hybrid Azure AD Join with Azure AD as the authentication service.
Yet without setting to Enable Windows Hello for Business, biometrics and pin remain unavailable.
User Configuration/Policies/Administrative Templates/Windows Components/Windows Hello for Business
"Use Windows Hello for Business" Enabled / "Do not start Windows Hello Provisioning after sign-in" Disabled
Why aren't users being prompted for pin/biometrics setup at login? I'm joining a workstation using the typical "Join this device to a local Active Directory domain".
Everything seems to be replicating properly but I don't see any provisioning actions. Group policy is functioning properly and distributing things like browser security policy settings, for example. I know the base stack environment is configured properly, I'm just missing the next steps. Should I be looking at Intune Connector for Active Directory? Should this be my next step?
https://learn.microsoft.com/en-us/mem/autopilot/windows-autopilot-hybrid
I sincerely appreciate any time you can offer. Thank you.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(86.4, 66%, 18%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ENH%3C/text%3E%3C/svg%3E)
Intune connector for AD is used for Autopilot with Hybrid Azure AD Join. It creates the computer objects in AD. It sounds like you aren't using Intune or Autopilot. It sounds like you want to set up the hybrid key trust. See https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust
That's it! It worked. As soon as I did the final step to distribute the trusted root CA to the workstation, it immediately started asking about biometrics and pin setup even after the workstation had already been connected. THANK YOU!