For Hybrid-Joined Devices, Should Windows Hello for Business Be Managed with GPO or Intune?
Asked by
MapleOrbit47
I'm implementing Windows Hello for Business in an environment with on-premises Active Directory, domain controllers, and SCCM. I initially said Entra-joined, but I meant hybrid-joined. Our Windows devices are hybrid-joined and currently aren't managed or co-managed through Intune. Since we expect to keep using AD and SCCM for the foreseeable future, would you deploy WHfB through Group Policy, or start moving toward Intune? Most of our other device settings are managed with GPO, so I'm currently leaning that way. Devices outside the corporate network automatically connect through Always On VPN and can retrieve Group Policy.
Answers
One workable setup is to use one GPO to enable device registration for Conditional Access and WHfB, then apply another policy for the WHfB configuration, including Cloud Kerberos Trust, after the user signs in. The main drawback is that the rollout may not be completely seamless—you might need to target devices or users after their first login before every WHfB setting applies.
Reply to this answer
For truly Entra-joined devices, GPO isn’t an option. Since yours are hybrid-joined, GPO can work, but it may be worth moving toward co-management and an Intune-centered deployment over time. Intune gives you better support for remote and off-network devices and can simplify newer Windows security configuration once the environment is ready.
Reply to this answer
For a hybrid environment that still relies heavily on AD and SCCM, using GPO for WHfB is a reasonable approach. You can configure device registration, WHfB policy, and Cloud Kerberos Trust through Group Policy while keeping the deployment model consistent with your existing management process. Intune is still worth considering as part of a longer-term co-management plan, but there’s no requirement to switch immediately.
Reply to this answer
Add your answer
Answers are reviewed before publication.
MapleOrbit47: That makes sense. In our case, Always On VPN connects devices automatically when they’re off the corporate network, so they can still receive GPO settings. I’m trying to determine whether that reduces the practical advantage of moving WHfB to Intune.