How to disable Windows Hello for Business PIN on AAD Joined laptop?

Question

Good afternoon, We're looking to have AAD joined computers, however, I'd like to know how to disable Windows Hello for Business PIN logon for AAD. We do not currently use Intune but would still like to have our PCs AAD joined. Thank you!

Answer 1

@Hernando Torrealba,Thanks for posting in Q&A.

From your description, I know you are looking for a way to disable Windows Hello for Business PIN on AAD Joined device.

Based on my researching, we can use Group Policy to disable Windows Hello for Business.

Here are some steps you can refer.

1.Press win + R, type gpedit.msc and enter.

2.Click Administrative Templates > Windows Components > Windows Hello for Business under User configuration and Computer Configuration and disable use Windows Hello for Business.

3.Open CMD as admin and type certutil.exe -deleteHelloContainer to delete the Windows Hello for Business container.

4.Restart the device.

Please try above information, if there is any update, feel free to let me know. If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment". Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

This works and thank you for that !

Is there a way to make this as a bulk operation or automatically disable this for Entra Joined devices?

Thanks a lot