Disable Windows Hello for Business device pin using an Intune Account Protection policy

For IT Admins - How to disable Windows Hello for Business device pin on Windows using an Endpoint Manager - Account Protection policy. 

Your organization requires you to set up your work or school account with Windows Hello

When you sign into Windows for the first time, you will be required to enrol with Windows Hello and set a device pin.

On Windows 11 you'll get these prompts to set up Windows Hello

Use Windows Hello with your account
Your organization requires you to set up your work or school account with Windows Hello Face, Fingerprint or PIN

Windows Hello - Set up a PIN

Hold on, this is important You'll need to set up a PIN to use this device.

Account Protection policy to disable Windows Hello

If you're not ready to deploy Windows Hello in your environment. You can disable Windows Hello for Business using an Account Protection policy with the following settings.

Endpoint manager admin center

Endpoint Security - Account Protection

Create policy

Platform: Windows 10 or later
Profile: Account protection

Basics

Name: Disable Windows Hello

Configuration settings

Account Protection
Block Windows Hello for Business: Enabled

Assignments

All Devices

Review + create

Click Create