How can I postpone Windows Hello PIN setup during device onboarding?

You can create the PIN during setup and remove the Windows Hello registration as the final preparation step. The employee should then be prompted to create a new PIN at their next sign-in. Be aware that deleting the registration may not take effect immediately if the device has cached credentials or has not synchronized with Entra yet.

If you have a device-management system, the cleanest approach is to temporarily disable or defer Windows Hello for Business enrollment through policy. Without that, you can create a separate provisioning OU and apply a Group Policy that prevents Hello enrollment while the laptop is being prepared. Move the device into the normal OU afterward so the employee is prompted to enroll on their first login.

A longer-term solution is to avoid signing in as the employee at all. Use automated provisioning and device-management policies to install applications, configure printers, and apply settings. Then the employee completes Windows Hello enrollment themselves, which avoids creating and later replacing a temporary PIN.

The old workaround of pressing Escape, disconnecting the network, or choosing “Continue anyway” is inconsistent on current Windows builds. It may get you to the desktop temporarily, but Windows will continue prompting for Hello enrollment and can eventually block the sign-in flow.