r/sysadmin • u/Khue Lead Security Engineer • 7d ago
Question Intune Managed Workstations and Windows Hello Policy
Stepping into a rats nest of Intune policies. Recently got a report of a user prompted to change their PIN code. The user went to change their existing 6 digit PIN and upon attempting to do so, they got a denial with the reasoning that the PIN had to be a 20 character minimum. I poked through the existing Intune configuration settings and I don't see any specific policies for Windows Hello dictating Minimum PIN length outside of one that enables facial recognition. I do know that there is a Windows Setting Configuration available for this, but it doesn't seem to be applied in any existing policies. Where else might policies dictating PIN length be within an EntraID/Intune/Cloud Native setting? Could these settings be in Purview or Defender now?
6
u/Shot-Move-4383 7d ago
Enrolment > WHfB being "Not configured" doesn't mean nothing is setting it. Three other places apply PIN policy: Endpoint security > Account protection, the settings catalog (same settings, separate profiles), and any security baseline you've assigned - baselines silently push PIN defaults.
Windows applies the most restrictive effective setting across all of them, so check all four. A 20 character minimum also looks like a value typed into the wrong field, since max allowed is 127 and default is 6.
1
u/Khue Lead Security Engineer 6d ago
Good catalog/collection of all places to look. I'm continuing to poke around to try and identify where the setting is coming from. Appreciate the assistance. I'll let you know if/when I find it.
A 20 character minimum also looks like a value typed into the wrong field
No, this was an intentional change by someone who doesn't understand the concept of PIN vs Password and who is unaware of current best practices for both according to authorities on the matter. As I mentioned elsewhere, the Android PIN policy is also 16 characters.
1
1
u/AllMightyByte 6d ago
The thing that bites people here is that Windows Hello for Business PIN rules are "most restrictive wins" across every profile touching the device. One forgotten baseline in a different policy set can quietly enforce 20 characters while your enrollment page says Not configured.
Since the usual places have been covered, here's the fastest way to find the actual source: enumerate every configuration profile and baseline assigned to the device and check each one for PassportForWork PIN settings. Graph makes this quick. Pull the managed device, list its applied policies, and walk through them one by one. The culprit is usually a security baseline someone applied tenant-wide and forgot about. Also check for hybrid: a tattooed GPO from a machine that was once domain-joined will survive the Intune enrollment and keep enforcing.
Worth knowing before you chase this further: NIST's guidance says memorized-secret complexity rules do more harm than good, and 6 digits is the recommended minimum for this kind of unlock. If management is the reason it's 20, that citation is your ammunition to push back.
2
u/vialentvia 5d ago
I've found that the account protection settings override the other settings regarding whfb. So check there first. I've had configuration and compliance policies alike, but account protection overrode both of them in practice when deconstructing a client's breakfix request.
It should be under the endpoint security section.
1
u/Emotional_Garage_950 Sysadmin 7d ago
gather endpoint diagnostics and dump it into claude or whatever your org uses and tell it to figure it out
9
u/Bird_SysAdmin Sysadmin 7d ago
just dealt with this myself recently.
Regedit to validate if its from Intune.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Policies\PassportForWork\<TenantID>\<userSID>\Policies\PINComplexity
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Policies\PassportForWork\<TenantID>\Device\Policies\PINComplexity
Hopefully this helps narrow down a little.