Our devices are joined to Entra ID. Before handing out a new laptop, we sign in as the employee to configure Outlook, printers, and other basics. We use a Temporary Access Pass to get past MFA, but Windows still requires us to enroll in Windows Hello and create a PIN. Is there a way to postpone that requirement until the employee receives the laptop, without disabling Windows Hello permanently? Right now, we create a temporary PIN and then have the employee change it during onboarding.
4 Answers
The cleanest process is usually to avoid signing in as the employee altogether and automate the Outlook and printer configuration. Autopilot and Intune are designed for this kind of handoff, but if those aren't available yet, a temporary PIN that is replaced during the employee's first onboarding session is safer than leaving the device in a partially configured state.
A practical option is to finish the setup, remove the existing Windows Hello credential, and let the employee enroll with a new PIN at their first sign-in. You can remove the Hello registration from the user's authentication methods in Entra ID, although the device may need time to synchronize before the old credential stops working.
You can sometimes select the option to skip PIN creation, or briefly disconnect the device from the network and choose the option to continue anyway. That may get you to the desktop, but Windows will continue prompting at future sign-ins until a PIN is created, so it isn't a reliable long-term solution.
If you use Intune, Windows Hello for Business enrollment can be disabled or deferred through the device configuration policies. Since you don't use Intune yet, a similar approach is to create a temporary organizational unit with a Group Policy that prevents Hello enrollment. Put the device in that OU while it is being prepared, then move it into the normal OU before handing it to the employee.
We don't use Intune yet, and we'd prefer to defer enrollment rather than disable Windows Hello completely.
I tried removing the Hello entry and waited about 30 minutes, but the old PIN still worked. The laptop was connected at the sign-in screen, so I'm not sure how long the device needs to synchronize.