Passwordless authentication using Windows Hello For Business (WHFB) with Microsoft product group 

What aspects of CKT are you looking for? Always looking to help more folks get rid of passwords. :)

github.com/425show/level400

That sounds like you have an additional GPO configured to force second factor auth. RU-vid comments are not a great place to troubleshoot. Please open a support case or try posting the full issue techcommunity.microsoft.com/t5/security-compliance-and-identity/bd-p/SecurityandCompliance

Why would LoS to a DC be an issue for a hybrid joined device? They need it to log in to a hybrid joined device even without Windows Hello. If you have users that you want to not use Windows Hello and you don’t have a security requirement to enforce this, then exempt their PC from the GPO that enables it. You can inform users that it’s coming many days prior to enabling it so that users with a use case that won’t work with Windows Hello can submit feedback giving their reason why they can’t use it and their device can be excluded from the scope of the GPO or Intune configuration profile.

@@webcomment8895 The first time WHfB is configured on a hybrid device it needs LoS to a DC when logging in. Using a password to log in does not need LoS to a DC as long as the user has connected before which in our case everyone has. We do not have always on vpn nor can our vpn currently connect before login. Turns out there is a way to accomplish what I need but it involves both using Intune and GPO (or regkey set via powershell) because the specific feature only exists in GPO form.

Yes, you have it right. GPO has the check box "Do not start Windows Hello provisioning after sign-in", unfortunately Intune does not. To be clear though, users can provision their credentials without line-of-sight to a DC, they just can't use them to sign-in the first time without LOS.

@@jjstreicher-bremer309 yes I understand that. The first time login will definitely cause issues (support calls) even with email notifications telling users what to expect.

Thanks JJ!

I would double check you have the correct permissions for both AAD and AD. It sounds like you might not have it for AAD. RU-vid comments probably aren't the best spot for troubelshooting this. I would recommend you try posting that techcommunity.microsoft.com/t5/security-compliance-and-identity/ct-p/MicrosoftSecurityandCompliance and see if anyone else over there can help dig in a bit more or open a support case.

@@425show Thanks for the reply! I have opened a case with Microsoft and they are currently looking into this issue. Seems like the issue is on on-prem DC.

@@tedzhang5663 Post back what the solution ends up being!

To do H4B today you have to use cert trust method. learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-feature-remote-desktop. There are many options for passwordless though, www.microsoft.com/en-us/security/business/solutions/passwordless-authentication?rtc=1

The good news is that RDP now supports "EntraID RDP" authentication. learn.microsoft.com/en-us/windows/client-management/client-tools/connect-to-remote-aadj-pc#connect-with-azure-ad-authentication which requires the session host to be connected to EntraID. There are some limitations based on version (server 2022 is required for server OS), but it works really well.