To solve both issues, handle the disabled device in Microsoft 365 first, then reset the Windows PIN so the desktop can be used.
- Enable the disabled device in Microsoft 365 (admin required) If the device is disabled in Microsoft Entra ID (Azure AD), a Microsoft 365 admin must:
- Sign in to the Azure portal.
- Go to Microsoft Entra ID > Devices.
- Search for the device (by device name or the user’s name).
- If it appears under disabled devices, select it and choose Enable.
If the device was deleted instead of disabled:
- On the Windows 11 PC, open Settings > Accounts > Access work or school.
- Select the work/school account and choose Disconnect.
- Then select Connect and go through the sign-in process again to re-register the device.
- Reset the Windows PIN when already signed in (if possible) If sign-in is still possible using another method (password, passkey, etc.):
- Open Settings on the Windows 11 device.
- Go to Accounts > Sign-in options (or open the shortcut: Sign-in options).
- Under PIN (Windows Hello), select Change PIN if the current PIN is known, or select I forgot my PIN if it is not.
- Follow the prompts to verify the Microsoft account and set a new PIN.
- Reset the PIN from Settings using an alternate sign-in method If the PIN is forgotten but another sign-in method works:
- Sign in to Windows 11 using an alternate credential (for example, password or security key).
- Open Settings > Accounts > Sign-in options.
- Select PIN (Windows Hello) > I forgot my PIN.
- Complete the verification and create a new PIN.
- Reset the PIN from the lock screen (Windows Hello for Business / Entra-joined) If the device is Microsoft Entra joined or hybrid joined and PIN reset is enabled:
From the lock screen:
- On the sign-in screen, select Sign-in options and choose the PIN icon.
- Select I forgot my PIN.
- For Microsoft Entra joined devices: choose an authentication method (password, security key, etc.) and follow the instructions to provision a new PIN.
- For Microsoft Entra hybrid joined devices: enter the account password when prompted, then follow the provisioning steps.
- After completion, sign in with the new PIN.
Note: For some hybrid scenarios, destructive PIN reset from above the lock screen requires connectivity to domain controllers and, if AD FS is used, to federation services.
- If PIN reset fails and no sign-in method works If none of the above methods allow sign-in (for example, repeated “Something went wrong” errors and no working password), the last-resort option reported in similar cases is a full reinstall of Windows on the device, which removes data and apps. This should only be used if data is backed up or can be replaced.
References: