Comments on: Enable Windows Hello Multifactor Device Unlock with Microsoft Intune

By: Marc Kuhn

Marc Kuhn — Mon, 11 Sep 2023 09:13:37 +0000

Hey Peter
we are just about testing the solution. With the OMA-URI configured we have some questions with it. I configured PIN as first and FaceID / Finger as second factor. We are still able to login with FaceID or Finger without asking for a second factor. Where you able to have Multi-factor unlock working as well when using FaceID or Finger as the first factor?

By: Edward

Edward — Thu, 02 Mar 2023 15:06:12 +0000

In reply to Sanjay.

Hi Sanjay and Peter,

We’re testing this at the moment and have run into a similar issue.

The problem we’ve run into is that users can register both Fingerprint and Facial Recognition.
But they won’t “failover” between each other.

What this means is that I can have Fingerprint+Pin and Face+Pin setup in the config but the policy will only apply to one of them.
On the sign in screen, Fingerprint+Pin will work as expected but I can then log in only with Face, effectively bypassing the 2nd factor.

At the moment, I can’t find a way to disable users from being able to register for than one Windows Hello method which would resolve the issue.
It’s either all Biometrics on or all off, it can’t be done selectively.

By: Alexej

Alexej — Fri, 01 Jul 2022 21:19:51 +0000

Do I need to configure the trusted signals factor? I just want face/finger for first and PIN for second unlock factor without trusted signals. Is this possible? Thanks for your article.

By: Peter Klapwijk

Peter Klapwijk — Tue, 15 Jun 2021 19:19:31 +0000

In reply to Sanjay.

Hi Sanjay,

Sign in by providing your PIN twice? I don’t think that’s supposed to be possible.
Did you get on with this? Or received some feedback from Microsoft (via a support case for example)?

By: Sanjay

Sanjay — Sun, 06 Jun 2021 15:47:51 +0000

In reply to Sanjay. Just to add, I have enforced Hello sign-in so that login using Windows password credential will prompt me to login using Hello/Smart cart.

By: Sanjay

Sanjay — Sun, 06 Jun 2021 15:45:49 +0000

Hi Peter,

I had configured Face/Finger for my first factor auth and PIN and Signals as second factor auth. To mimic a scenario to see what happens when Hello fails, I disabled camera of the laptop so that face recog fails, but I was able to login using PIN twice and get access to Desktop. Is that a bug or an expected behavior? Remember that I haven’t configured PIN on my first factor and it is only there on second factor. Am i allowed to get access to desktop just using PIN because PIN happens to be failback mechanism for Hello? I also read that if you have configured a credential provider in both factors, using that particular auth factor can only be used once and not twice. ie. If PIN is configured in both first and second, it only accepts one time use? Appreciate if you can shed some light on this behavior

By: Peter Klapwijk

Peter Klapwijk — Mon, 21 Oct 2019 12:15:49 +0000

In reply to Tony. No, unfortunately that policy isn`t available through Intune. At this moment this can be only accomplished using a PowerShell script (and deploy that via Intune).

By: Tony

Tony — Thu, 10 Oct 2019 19:16:28 +0000

In reply to Fergus. ...I guess that my reply above isn't exactly an Intune setting. Sorry about that!

By: Tony

Tony — Thu, 10 Oct 2019 19:15:02 +0000

In reply to Fergus.

Group Policy:
Windows Settings/Local Policies/Security Options
Interctive logon: Require Windows Hello for Business or smart card

By: Peter Klapwijk

Peter Klapwijk — Fri, 04 Oct 2019 19:30:50 +0000

In reply to Fergus. No as far as I know, that's not possible (yet).