Disable Windows Hello with Autopilot using Workspace ONE UEM

Workspace ONE UEM fully supports Microsoft Autopilot. For those who are not aware, Windows Autopilot provides setup and preconfiguration services for new devices so they’re ready to use right out of the box.

My colleague Pete Lindley (VMware EUC) has written an excellent article on how to setup and test Autopilot with Workspace ONE UEM.

This very short article details how you can disable Windows Hello as part of deploying Windows 10 with Autopilot.

Start by creating a Windows 10 device profile and enable Track Profile Status during OOBE as shown:

Select the Custom Settings tab, enter the Install XML as follows:

<Add>
  <CmdID>3727e578-7bec-4224-ab7d-09214bfb25b3</CmdID>
  <Item>
    <Target>
        <LocURI>./Device/Vendor/MSFT/PassportForWork/<Azure-Directory-ID>/Policies/UsePassportForWork</LocURI>
      </Target>
    <Meta>
      <Format xmlns=”syncml:metinf”>bool</Format>
      <Type>text/plain</Type>
    </Meta>
    <Data>False</Data>
  </Item>
</Add>

Remove XML settings:

<Replace>
</Replace>

Note that <Azure-Directory-ID> is replaced by your own Azure Directory ID or Tenant ID. This can be obtained by logging into your Azure AD portal, selecting Properties and copying the Tenant ID value. A screen capture from my environment is shown below:

Now select Groups & Settings > All Settings > Devices & Users > General > Enrollment > Optional Prompt. Select Enable the Status Tracking Page for OOBE to Enabled. See the following as an example:

I disabled the option Enable ‘Continue Anyway’ Button on OOBE Status Tracking Page, otherwise I found that as an end user I might Continue Anyway as shown below, before the profile was applied to disable Windows Hello.

Are you getting prompted to still setup MFA with your user once they’ve logged into Windows? By default Azure AD requires all users to register for Azure Multi-Factor Authentication. See this Microsoft article for further details and how to change this setting.

That’s it! When you start your new Windows 10 PC or laptop, you will no longer be prompted to set up Window Hello as part of a usual Autopilot setup.

If you have any feedback,  please don’t hesitate to contact me directly via my blog contact page.

Thank-you to Saurabh Jhunjhunwala (Remote Delivery Consultant, VMware) for sharing this capability with me.

11 Comments

    1. Note: I disabled the option Enable ‘Continue Anyway’ Button on OOBE Status Tracking Page, otherwise I found that as an end user I might Continue Anyway as shown below, before the profile was applied to disable Windows Hello.

      1. I did follow that as well. Should I configure those enrollment settings at the root OG? I overrode and configured that at my Azure AD sub-OG.

      1. I’m using the 20H2. BTW, it works when we changed the custom settings to these. Thank you for this article, Darryl.

        3727e578-7bec-4224-ab7d-09214bfb25b3

        ./Device/Vendor/MSFT/PassportForWork/AzureIDhere/Policies/UsePassportForWork

        bool
        text/plain

        False

        3727e578-7bec-4224-ab7d-09214bfb25b3

        ./Device/Vendor/MSFT/PassportForWork/AzureIDhere/Policies/UsePassportForWork

        bool
        text/plain

  1. @Andrew, wat is the difference in your config, than that from Darren? Can you share your Device Profile? I’m trying to disable Windows Hello in OOBE as well, but my configuration is not being accepted and still get the Windows Hello part via AutoPilot, Azure AD and Workspace ONE enrollment.

    My Device Profile config now:
    Target = OMA DM Client
    Make Commands Atomic = v (checked)
    Install Settings =

    3727e578-7bec-4224-ab7d-09214bfb25b3

    ./Device/Vendor/MSFT/PassportForWork/AzureIDhere/Policies/UsePassportForWork

    bool
    text/plain

    False

    Remove Settings =

    1. @Surbhi, I cannot copy the content of the “custom settings” from the device profile. Darryl site’s doesn’t support the XML content. Send me a DM on Twitter or LinkedIn and I can assist your further.

Leave a Reply to AndrewB Cancel reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s