I'm trying to provide a passwordless sign-in experience on hybrid Entra ID-joined Windows devices managed with Intune. The built-in passwordless experience appears to support Entra-joined devices but not hybrid-joined ones. We use Windows Hello for Business with PINs and biometrics, including multifactor device unlock, but we still need password-based options for tools such as RunAs and LAPS. Because of that, I can't remove the password credential provider entirely—I only want to hide it from the normal logon screen while retaining a way for administrators or other users to authenticate when necessary. Has anyone implemented this successfully, or found a practical workaround?
3 Answers
One alternative is to use smart-card-style interactive sign-in policies. The account password can be randomized and effectively unknown to the user, while LAPS remains available for administrative access. Users are then directed to Windows Hello for Business rather than relying on a password.
Windows Hello for Business can still be enforced in this setup, and LAPS can remain available for remote support accounts. For shared computers, FIDO2 security keys may help avoid the practical TPM limit on registered users. Be aware that FIDO2 support can vary depending on the type of remote desktop or gateway connection being used.
FIDO2 and Windows Hello can work with RDP and web sign-in on hybrid-joined servers, but they aren’t supported by every legacy connection method, including some classic connection brokers or gateways.
Completely hiding the password provider may not be practical because a user often needs password authentication during initial Windows Hello for Business provisioning or when signing in as a different user. Even if password sign-in is disabled for the usual account, Windows can still expose it when another account needs to authenticate.
That initial-registration scenario isn’t the main issue. I’m mainly trying to keep the password tile out of the standard sign-in screen while still allowing it to appear when another user or an administrator explicitly needs to sign in.
A similar approach is to use a short-lived certificate or smart card for the initial authentication, then guide the user through registering a FIDO2 key. The user never needs to know the randomly generated account password, while administrators can still retain recovery and support options.