How to disable Windows Hello for Business and PIN

Question

Hello, I am unable to disable Windows Hello for Business and PIN from Intune.

When I select Disable for windows Hello I don't have the option to have PIN disabled too.

Any help please!

Answer 1

Hi,

Thank you for posting in Microsoft Q&A forum.

Disabling Windows Hello for Business configuration (tenant-wide settings) from the Intune portal only disables Windows Hello for Business enrollment on new device provisioning. It has no effect on devices that have already gone through provisioning in the past and does not stop the users from using the PIN that already set up.

To delete Windows Hello for Business (WHfB) registration and remove existing PIN from the local device, we can use the PowerShell command “certutil /deletehellocontainer“, and deploy the PowerShell command to the devices via Intune. For more information, please refer to:

Remove existing WHfB PIN using Intune

Disabling Windows Hello for Business and removing existing PIN with Microsoft Intune

Intune: Delete Windows Hello for Business registrations

Thanks for your time. Have a nice day!

Best regards,

Simon

---

If the response is helpful, please click "Accept Answer" and upvote it.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Hi @MoTaar ,

Disabling the WHfB Option also disables (All other settings on the screen are then unavailable.) the pin since the WHfB function is driven by the Pin set up.

Here is a link for additional details https://learn.microsoft.com/en-us/mem/intune/protect/identity-protection-windows-settings#windows-hello-for-business

Alternatively, this question has a response on how this can be achieved using GPO: https://learn.microsoft.com/en-us/answers/questions/1602409/how-do-i-disable-windows-hello-requirement-when-no