I honestly don't know. I did a batch with my other 4 mailboxes and it went as expected. Time to decommission this Ex2010 server. Rinse and repeat for 2016->2019. I really miss in place upgrades of Exchange. Yes I have been working with it since Exchange server 4.0, but gleefully ignored it for a decade.
Thanks for this tip. It got me past the initial check. Then using the GUI installer it showed me the other three pre-requisites the command line one wasn't mentioning. Maybe that is why it wasn't moving forward. Going through the setup 15 steps now. Once I finish I will report back.
Also, I entered the registry key on the Exchange server rather than the DC since that is where I was running setup from.
Hi, thanks for your feedback. It seems this issue is not only with Endpoint Manager (Intune) but possibly with all MDM and IOS 14.2 and Apple A12 chips. Further details at iOS 14.2 app crashes if deployed via mdm but not from appstore.
Hi,
I did contact the app support and they indicated it is an Endpoint Manager (Intune) MDM issue. I have since found it is an issue with possibly all MDM and IOS 14.2 and Apple A12 chips. Further details at iOS 14.2 app crashes if deployed via mdm but not from appstore which is a Microsoft product so maybe it does belong in Microsoft forum? Also the problem only presents when the app is deployed via MEM so that involves Microsoft.
Thanks for the reply. The settings for Windows Hello for Business, enrollment behavior and the configuration profiles to enable convenience PIN are all managed in Intune. AAD is the authentication mechanism but not what defines how the device works. My question is how to disable WHfB without totally disabling biometrics and simultaneously enable convenience PIN. The detail of why due to issues of AAD identity management were just for context.
I have found that I can enable convenience PIN via an ADMX configuration profile. I can also disable WHfB it seems to a select set of users. The challenge for me is I can't find a way to enable biometrics.

It seems I might be able to do with ADMX ingestion but I am having challenges figuring it out.
These devices will be AAD joined.
Thanks this did it. I just deleted in ADUC and cleaned it up. I also see all of my long dead public folders listed there. Something else to clean up I suppose.