Intune

How to Set Up Windows Hello for Business via Intune

Published 18 March 2026 · 8 min read

Windows Hello for Business (WHfB) replaces passwords with PIN or biometric authentication backed by TPM cryptography. It is a key part of a passwordless strategy for Microsoft 365 environments. This guide covers setting it up via Intune, the difference between cloud and hybrid deployments, and how to enforce it for all users.

Contents
  1. How Windows Hello for Business works
  2. Prerequisites
  3. Configure via Intune
  4. Key settings explained
  5. Enforce setup at enrolment
  6. Troubleshooting

How Windows Hello for Business works

When a user sets up WHfB, Windows generates a key pair protected by the device TPM. The private key never leaves the device. Authentication works by:

  1. User provides PIN or biometric gesture to the device
  2. Device uses the TPM-protected private key to sign a challenge from Entra ID
  3. Entra ID verifies the signature with the stored public key
  4. Token issued - no password transmitted at any point
✅
Why this is stronger than passwords
A WHfB PIN cannot be phished (it never leaves the device), cannot be reused on other sites, and is tied to a specific device. Even if someone knows the PIN, they cannot authenticate without physical access to that exact device.

Prerequisites

Configure via Intune

Devices → Configuration → + Create → Windows 10 and later → Templates → Identity Protection
  1. Name the profile (e.g. WHfB - All Devices)
  2. Configure Windows Hello for Business settings
  3. Assign to All Devices or a specific device group

Key settings explained

⚙️
Identity Protection profile - Windows Hello for Business settings
Configure Windows Hello for BusinessMust be set to Enable to push WHfB configuration
Enable
Minimum PIN length6-digit minimum is a good balance of security and usability
6
Maximum PIN length
127
Lowercase letters in PINKeep PIN numeric unless you want alphanumeric PINs
Not allowed
Uppercase letters in PIN
Not allowed
Special characters in PIN
Not allowed
PIN expiry (days)PIN expiry reduces security by encouraging predictable patterns - Microsoft recommends Never
Never
Remember PIN history
0
Enable PIN recoveryAllows users to reset their PIN without IT help
Yes
Use a Trusted Platform Module (TPM)Enforce TPM - do not allow software fallback
Required
Allow biometric authenticationEnables fingerprint and facial recognition
Yes
Use enhanced anti-spoofingRequires modern IR cameras for facial recognition - prevents photo attacks
Yes

Enforce setup at enrolment

To ensure users set up WHfB before reaching the desktop on first login, configure the Enrollment Status Page in Autopilot:

Devices → Enrol devices → Enrollment Status Page → + Create

Set Block device use until required apps are installed and include the WHfB configuration profile as a required app. Users cannot proceed past the OOBE until WHfB is configured.

Troubleshooting

WHfB not prompting users to set up

Check that the Identity Protection profile is assigned to the device group and the device has checked in. Review the Intune profile assignment status. Also confirm the device has TPM 2.0 enabled in the BIOS - WHfB silently fails on devices with TPM disabled.

Users see "Your organisation removed Windows Hello for Business"

This usually means a conflicting policy is disabling WHfB. Check for a conflicting Accounts policy or a Device Restrictions profile that has WHfB set to Disable. One profile enables it, another disables it, and the disable wins.

Frequently Asked Questions

Q: What is Windows Hello for Business?

Windows Hello for Business replaces passwords with strong two-factor authentication using a PIN, fingerprint, or facial recognition. The PIN is device-specific and backed by a cryptographic key in the device TPM. It is more secure than a password because the credential never leaves the device and cannot be phished or sprayed.

Q: What is the difference between Windows Hello and Windows Hello for Business?

Windows Hello is the consumer version - a convenient PIN or biometric to log in to a Microsoft personal account. Windows Hello for Business is the enterprise version - it uses certificate or key-based authentication against Entra ID or Active Directory, backed by TPM, and managed via Intune or Group Policy.

Q: Does Windows Hello for Business require a TPM?

Yes for cloud deployments. TPM 1.2 is the minimum but TPM 2.0 is recommended and required for some features. Devices without a TPM can use a software-based key but this is less secure and Microsoft does not recommend it for production deployments.

Q: How do I force users to set up Windows Hello for Business?

Configure an Enrollment Status Page (ESP) in Autopilot or use an Intune Identity Protection profile to require WHfB setup during device enrolment. Users will be prompted to set up a PIN before reaching the desktop on first login.

Related Guides
-> Passwordless Authentication-> Conditional Access-> Cyber Essentials Setup
// need intune set up properly?
Fixed-price Intune setup for UK businesses

I set up Intune for UK small businesses at a fixed price - app deployment, compliance policies, Conditional Access, and full documentation.

View Packages