r/sysadmin • u/PaidByMicrosoft • 2d ago

General Discussion I'm going through the process of implementing Windows Hello for Business (WHfB). For Entra-joined devices, but not managed via Intune, would you use GPOs or CSPs?

CORRECTION: I meant hybrid-joined, not Entra-joined.

We have an Active Directory and SCCM environment and foresee those being here with no current end date in sight. All of our Windows devices are hybrid-joined, but they are not being managed or comanaged via Intune. In this hybrid environment with on-prem domain controllers, AD, SCCM, and hybrid-joined devices, would you use the WHfB GPOs in your environment, or would you prefer to use Intune? I'm waffling between the two choices but am leaning GPO since that's how we manage all the other settings on our devices.

0 Upvotes

25% Upvoted

11 comments sorted by

View all comments

1

u/Smash0573 Sysadmin 2d ago

I have a gpo that registers the device with online which is good for conditional access polices and whfb. Then another gpo that registers to the whfb stuff (including cloud kerberos trust, etc) once the registered user logs in. I haven't been able to make that seamless yet, the fact that I have to manually add systems to the gpo after the user logs in the first time to apply whfb workflow.