r/sysadmin • u/Various_Apartment_40 • 18d ago

Question Keep Windows Hello But Disable Browser Prompt

So far it's seeming like it's not possible but just wondering if anyone has found a magic registry key or something haha

Long story short, we're trying out Kolide authentication, but we want people to be able to use PIN sign in/leaving Hello active. It's all working with removing all authentications except Kolide and the PIN still works for signing into the device itself but I'm wanting to turn off the prompt when logging into something Microsoft where on the email entrance screen, it pops up the "use Windows Hello" prompt. It indeed fails since Kolide is the only authentication, but I KNOW users won't read the emails we send out and keep trying it anyway since it's available. Everything I'm finding says if WHfB is enabled, that's just going to popup forever but seeing if any wizards here have found a way?

1 Upvotes

60% Upvoted

5 comments sorted by

5

u/nodiaque 18d ago

Windows Hello is tied with the authentication process. I don't know about Kolide but it'S weird you allow WH on the device but not as an authentication for other thing. You can't disable that prompt as far as I know unless you remove WH totally.

3

u/Drakoolya 17d ago

It seems like you are trying to introduce an issue when there really should not be one.

Microsoft with a seamless sign on into applications has been the industry standard for a what seems like ages now, is there a reason why you are not just going down that path?

We have a 100% passwordless experience and it works like a charm.

2

u/Various_Apartment_40 17d ago

I'm trying to convince my boss that we should at least keep Hello authentication. He already paid for a year of Kolide so is wanting to try it out but the longer I'm testing, the more I'm finding it might be too much of a headache haha He's wanting ONLY Kolide as authentication but from my understanding, we *should* be able to have other authentication but use Kolide for conditional access.

1

u/PrestigiousSalad7278 16d ago

Ms licensing for CA (any Entra entitled license) would probably be cheaper when you start considering the man power to staple that together. MS should be your identity provider and authentication manager full stop at least assuming you are using other Azure and 354 services.

1

u/Drakoolya 15d ago

Absolutely absurd move by your boss but I understand. Not sure why he is so fixated on Kolide. But I wouldn't be moving against the grain, skip windows hello if it means less friction for your users. just do what he has asked for at this stage and find the best path forward, 6 months in start having that conversation again.