We have two AD FS farms and a hybrid Entra ID environment with device writeback. Windows Hello for Business uses hybrid certificate trust, and we plan to move federation to the other farm.
What should we check for existing users, Enterprise PRT renewal, and new enrollments?
Existing Hello enrollment should not automatically need to be repeated just because the federation configuration changes. The credential is already provisioned, so the farm switch is different from resetting or replacing that credential.
I would not assume that every later authentication or Enterprise PRT renewal is independent of AD FS, though. Test those flows in this configuration before treating the old farm as unnecessary. Also check the existing certificate's validity and renewal path rather than equating a successful PIN sign-in with every backend flow working.
For new enrollments, verify the target farm is ready for the same hybrid certificate trust and device registration flows before changing federation. Device writeback being enabled is useful context, but it does not by itself prove the new farm has all the required configuration.
Run a controlled enrollment after the switch and check certificate issuance, device registration, and access to the resources users need. Keep a rollback plan for the federation change until those checks pass.
Don't forget the helpdesk side. Hello can mean people use their passwords less often, then struggle when a password is required again. Make sure recovery guidance and support capacity are ready, including requests from people who want Hello removed.
Answers are reviewed before publication.
w905!foldgate_3:
A successful Windows sign-in alone is a limited test. Check access to federated resources and the Enterprise PRT state as separate cases.