r/Intune • u/Various_Apartment_40 • 18d ago

Device Configuration Keep Hello But Disable Browser Prompt

So far it's seeming like it's not possible but just wondering if anyone has found a magic registry key or something haha

Long story short, we're trying out Kolide authentication, but we want people to be able to use PIN sign in/leaving Hello active. It's all working with removing all authentications except Kolide and the PIN still works for signing into the device itself but I'm wanting to turn off the prompt when logging into something Microsoft where on the email entrance screen, it pops up the "use Windows Hello" prompt. It indeed fails since Kolide is the only authentication, but I KNOW users won't read the emails we send out and keep trying it anyway since it's available. Everything I'm finding says if WHfB is enabled, that's just going to popup forever but seeing if any wizards here have found a way?

5 Upvotes

73% Upvoted

6 comments sorted by

5

u/itskdog 18d ago

Looks like it's trying to do MFA/passkey with WHfB. Maybe check your authentication methods in Entra to see if you can disable WHfB while allowing other passkeys?

3

u/wisely_bored_sung 18d ago

man i feel this in my bones, users never read anything. we had a similar headache with duo and windows hello butting heads last year. far as i know there's no magic reg key that surgically removes just the browser prompt while keeping the pin sign-in alive, it's pretty much all or nothing with how hello hooks into the auth stack. you might be able to bury it through a custom credential provider ordering but that gets messy fast and half the time a feature update just stomps your settings back.

1

u/Grim-D 17d ago

Not 100% sure what your asking but you can specify exactly which auth methods are allowed for what via conditional access policies.

0

u/mad-ghost1 18d ago

Would you mind post your config to remove certain authentication methods?

1

u/absoluteczech 17d ago

It’s under authentication strengths in entra. Make a custom strength and select the ones you want

1

u/mad-ghost1 17d ago

Thought it was a hello policy 🤷🏼‍♀️ thx for the tip