Disabling Windows Hello for Business with Intune: A Step-by-Step Guide

Disabling Windows Hello for Business with Intune isn’t just about flipping a switch; it’s an exercise in balancing user convenience with enterprise security and compliance. While Windows Hello has earned its stripes as a modern, multifactor authentication solution—using biometrics and PINs in a way that aligns with NIST’s multifactor criteria—it isn’t always the best fit for every organization. Whether you need to meet specific compliance standards, address concerns over device-specific binding, or simply adjust to an alternative security strategy, here’s a step-by-step breakdown of how to disable Windows Hello for Business using Microsoft Intune.

Understanding Windows Hello for Business​

Windows Hello for Business transforms how users authenticate on Windows devices by combining something you have (a hardware-protected key in the Trusted Platform Module) with something you know (a PIN) or something you are (a biometric factor). This multifactor design minimizes phishing risks and facilitates a seamless single sign-on experience across cloud and on-premises applications.
However, its very strengths can sometimes pose challenges. For instance, because the authentication is bound to a specific device’s TPM, enterprise environments that require portability or alternative authentication approaches might reconsider relying solely on Windows Hello. In those cases, disabling the feature—at least temporarily—can open the door to other robust methods like smart cards or third-party MFA tools such as Cisco Duo.

Why Disable Windows Hello?​

Before you embark on disabling this feature, consider the following factors:

• Device Portability Concerns: Since Windows Hello credentials are tied to the specific hardware, users switching devices may face limitations.
• Compliance and Security Policy Changes: Some organizations might have moved to alternative strategies that are not device-centric.
• Alternative Authentication Requirements: Tools like smart cards or secondary approval platforms offer portability or additional layers of security that Windows Hello might not deliver.
• User Experience Impact: Disabling modern biometric or PIN options means reverting back to traditional username/password methods, which may increase the risk of phishing attacks if not properly mitigated.

Ultimately, any decision to disable should come after a thorough risk and compliance review. This guide will walk you through the technical steps using Intune—but always remember to align technical changes with your organization’s broader security strategy.

Step-by-Step Guide to Disabling Windows Hello via Intune​

For organizations managing their fleet of Windows devices through Microsoft Intune, policy-based management is a powerful tool. Here’s how you can disable Windows Hello for Business:

1. Access the Microsoft Endpoint Manager Admin Center:
   Log in to your Intune console with the required administrative credentials.
2. Create a New Device Configuration Profile:
   • Navigate to Devices > Windows > Configuration Profiles.
   • Click “Create Profile.”
3. Select the Appropriate Platform and Profile Type:
   • Choose “Windows 10 and later” as the platform.
   • Under Profile type, select “Templates” and then “Administrative Templates.”
     This route leverages the built-in ADMX policies for fine-grained control.
4. Locate Windows Hello for Business Settings:
   • Within the Administrative Templates, expand “Windows Components” and then select “Windows Hello for Business.”
   • Look for the policy setting named “Use Windows Hello for Business.”
5. Disable the Policy:
   • Set “Use Windows Hello for Business” to “Disabled.”
   • This action prevents devices from enrolling in Windows Hello for Business.
     Additionally, if you wish to disable fallback options like convenience PIN sign-in, locate and adjust those related policies accordingly.
6. Assign the Profile to the Appropriate Groups:
   • Carefully assign this configuration profile to the targeted user or device groups.
   • Double-check the deployment scope to ensure that only the intended devices are affected.
7. Review and Deploy:
   • Review your configuration settings and create the profile.
   • Allow time for the policy to propagate across your device fleet.
     Intune will push these settings after the next device check-in cycle.
8. Test the Deployment:
   • Verify on a few devices that Windows Hello for Business is disabled.
   • Confirm that users revert to your organization’s default authentication methods.

By following these steps, you not only disable Windows Hello for Business but also reposition your authentication framework to better align with your security requirements.

Considerations and Alternative Approaches​

Before making the final switch, consider testing the new configuration in a controlled environment. Disabling Windows Hello for Business means users will rely on passwords—which may be less secure if not coupled with additional security measures.
Here are a few pointers to keep in mind:

• Plan for User Communication:
  Inform your users of the upcoming changes. Transitioning away from biometric or PIN authentication may serve as an opportunity to introduce enhanced training on secure password practices.
• Review Compliance Requirements:
  Ensure that your new authentication method complies with your industry’s regulatory standards.
• Monitor for Exceptions:
  Keep an eye on any devices that might not receive the policy immediately. Temporary exceptions or manual configurations might be necessary.
• Consider a Phased Approach:
  If completely disabling Windows Hello seems too abrupt, consider rolling out a phased approach that gradually limits Windows Hello functionalities while introducing alternative security methods.

Final Thoughts​

While Windows Hello for Business offers a robust, multifactor authentication experience, it’s not a one-size-fits-all solution. With Microsoft's Intune, administrators have the flexibility to disable this feature and pivot to authentication methods that better suit specific organizational needs. Whether driven by compliance concerns or a strategic shift towards more portable authentication options, the process is streamlined with the right Intune policy configurations.
Before making these changes, take the time to assess your organization’s security posture and communicate any adjustments to your user base. The ultimate goal is to ensure that security enhancements do not inadvertently compromise end-user experience or expose vulnerabilities.
As always, test thoroughly in a lab environment before rolling out any policy system-wide. The balance between user convenience and robust security is delicate—and your proactive steps today can help safeguard your organization’s digital future.
With clear guidelines and a methodical approach, you can confidently disable Windows Hello for Business via Intune and explore alternative authentication paths that meet your unique requirements.

---

Source: TechTarget How to disable the Windows Hello feature with Intune | TechTarget