Symptom:

If you have a Windows 10 machine with a camera that supports Windows hello login you might see that Windows Hello is disabled by administrator.

windows 10 hello disabled

This is becasue of the Intune Policy in Microsoft Intune.

Implications:

Note, that if you want to enable Windows Hello you will also force the user that uses Azure AD join to enroll with a pin, adding an extra step to the Azure AD join process.

Steps:

Navigate to https://portal.azure.com and log in with admin credentials and select Intune.

intune blade

Select then Device enrollment.

device enrollment

Select then Windows Enrollment

windows enrollment

You should then see Windows Hello for Business, click it.

manage windows hello for business

You may create several policies based on Groups. However there should be a default policy that is assigned to everyone.

default policy

I had the policy disabled. Now click enable.

whfb status

You do not need to change any settings, just Ensure that you allow biometric auth. Then remember to click “Save”enable biometric and click save

That is it. On a Windows 10 Device you can update the policies or log off/on/restart to recieve this new policy.

windows hello enabled

You can also force this policy Down on the Device by syncronizing it:

syncronize with intune