How do I Enable Windows Hello for Business in Microsoft Intune?

Enabling Windows Hello for Business in Microsoft Intune

Windows Hello for Business provides passwordless Windows sign-in using a PIN, fingerprint, or facial recognition. This article explains how to deploy Windows Hello for Business to selected devices through a targeted Microsoft Intune policy. The configuration below enables Windows Hello for Business and requires a PIN with a minimum length of eight characters.

Create the Windows Hello for Business policy

  1. Sign in to the Microsoft Intune admin center.
  2. Select Endpoint security.
  3. Select Account protection.
  4. Select Create Policy.
  5. For Platform, select Windows.
  6. For Profile, select Account Protection.
  7. Select the Create button.
  8. Enter a name and optional description for the policy, then select Next.

Configure Windows Hello for Business

On the Configuration settings page, expand Windows Hello For Business. Use the following settings to enable Windows Hello for Business and require a minimum PIN length of eight characters.

 

Required settings

Setting Value Purpose
Use Windows Hello For Business (Device) True Enables Windows Hello for Business on devices that receive the policy.
Minimum PIN Length 8 Requires the Windows Hello PIN to contain at least eight characters.

 

Optional settings

The following settings are not required to enable Windows Hello for Business with a minimum PIN length of eight. Configure them only when the unit has an additional security requirement.

 

Setting Recommended value When to configure it
Enable Pin Recovery True Allows users to recover a forgotten Windows Hello PIN. Select False only if PIN recovery must not be available.
Expiration Not configured Configure this setting only if PINs must expire after a specified number of days.
Lowercase Letters Not configured Configure this setting only if lowercase letters must be required or prohibited in the PIN.
Uppercase Letters Not configured Configure this setting only if uppercase letters must be required or prohibited in the PIN.
Maximum PIN Length Not configured Configure this setting only if the PIN must not exceed a specified length.
PIN History Not configured Configure this setting only if users must be prevented from reusing previous PINs.
Require Security Device Not configured Configure this setting only if Windows Hello credentials must be protected by compatible hardware, such as a Trusted Platform Module.
Special Characters Not configured Configure this setting only if special characters must be required or prohibited in the PIN.
Use Certificate For On Prem Auth Not configured Configure this setting only if the organization uses certificate trust for authentication to on-premises resources.
Facial Features Use Enhanced Anti Spoofing Not configured Set this to True only if enhanced anti-spoofing must be required for Windows Hello facial recognition.


User-scoped settings


Leave all settings under User-scoped settings set to Not configured. This procedure uses the device-scoped settings listed above. Configuring both scopes is unnecessary and may create conflicting policy values.

After configuring the required settings, select Next.

Assign the policy

  1. On the Scope tags page, select the appropriate scope tags, if required, then select Next.
  2. On the Assignments page, select Add groups under Included groups.
  3. Select the Microsoft Entra device groups that should receive the policy.
  4. Add exclusions if specific groups should not receive the policy.
  5. Select Next.
  6. Review the configuration, then select Create.
Important: Avoid configuring conflicting Windows Hello for Business settings through both Group Policy and Intune. Applicable Group Policy settings can take precedence over the corresponding Intune settings.

Verify the deployment

  1. In the Microsoft Intune admin center, open the Account Protection policy.
  2. Review Device and user check-in status for assignment or configuration errors.
  3. On a targeted Windows device, open Settings.
  4. Select Accounts, then Sign-in options.
  5. Verify that the user is prompted to configure Windows Hello for Business and that the PIN contains at least eight characters.
Print Article