This post will help in understanding and setting the Turn On Convenience PIN Sign-In Policy Using Intune. Here we are going to implement this policy using Intune’s Configuration Profiles. This policy’s main aspect is providing hands-on experience over the Turn On Convenience PIN Sign-In Policy Using Intune.
Turn On Convenience PIN Sign-In Policy configuration controls whether a domain user can sign in using a convenience PIN. Enabling this policy allows a domain user to establish and use a convenience PIN for signing in. Conversely, if you disable or leave this policy unconfigured, a domain user won’t have the option to set up or use a convenience PIN.
It’s important to note that when this feature is employed, the user’s domain password is cached in the system vault. To configure Windows Hello for Business, utilize the Administrative Template policies found under Windows Hello for Business.
When this policy setting is enabled, a domain user has the capability to establish and use a convenience PIN as an alternative method for signing in. If this policy setting is disabled or not configured, a domain user won’t have the option to set up or utilize a convenience PIN for signing in.
It’s crucial to be aware that when a convenience PIN is used, the user’s domain password is cached in the system vault. This caching is part of the process associated with using a convenience PIN for authentication.
- Easy Method to Disable Password Reveal Button Policy using Intune
- Turn On Virtualization Based Security Policy using Intune
Windows CSP Details AllowPINLogon
We will see Windows CSP Details for this Policy setting AllowPINLogon. This policy setting introduces a level of control and flexibility for administrators regarding the use of convenience PINs for domain user sign-ins. It balances user convenience with security considerations, and administrators should carefully configure and communicate policies to align with organizational security standards.
CSP URI – ./Device/Vendor/MSFT/Policy/Config/CredentialProviders/AllowPINLogon
Turn On Convenience PIN Sign-In Policy using Intune
To Turn On Convenience PIN Sign-In Policy Using Intune, follow the steps stated below:
- Sign in to the Intune Admin Center portal https://intune.microsoft.com/.
- Select Devices > Windows > Configuration profiles > Create a profile.
In Create Profile, I select Windows 10 and later in Platform, and select Profile Type as Settings catalog. Click on the Create button.
| Platform | Profile Type |
|---|---|
| Windows 10 and later | Settings Catalog |
On the Basics tab pane, I provide a name for the policy as “Allow Clipboard Synchronization Across Devices Policy.” Optionally, if you want, you can enter a policy description and proceed by selecting “Next“.
Now in Configuration Settings, click Add Settings to browse or search the catalog for the settings I want to configure.
In the Settings Picker windows, I searched for the keyword PIN, I found the category Administrative Templates\System\Logon and selected this.
When I select that option as stated above, I see the sub-category Turn on convenience PIN sign-in. After selecting that, click the cross mark at the right-hand corner, as shown below.
I kept the Turn on convenience PIN sign-in as Disabled and Click on Next to continue.
Using Scope tags, you can assign a tag to filter the profile to specific IT groups. One can add scope tags (if required) and click Next to continue. Now in Assignments, in Included Groups, you need to click on Add Groups, choose Select Groups to include one or more groups, and click Next to continue.
In the Review + Create tab, I review settings. After clicking on Create, changes are saved, and the profile is assigned.
Upon successfully creating the “Turn On Convenience PIN Sign-In Policy,“ notification will appear in the top right-hand corner, confirming the action. You can also verify the policy’s existence by navigating to the Configuration Profiles list, where it will be prominently displayed.
Your groups will receive your profile settings when the devices check in with the Intune service. The Policy applies to the device.
Intune Report for Turn On Convenience PIN Sign-In Policy
From the Intune Portal, you can view the Intune settings catalog profile report, which provides an overview of device configuration policies and deployment status.
To track the assignment of the policy, you need to select the relevant policy from the Configuration Profiles list. Then, you can review the device and user check-in status to determine whether the policy has been successfully applied. If you require more detailed information, you can click on “View Report” to access additional insights.
Intune MDM Event Log
To verify the successful implementation of String or integer policies on Windows 10 or 11 devices through Intune, you can leverage event IDs 813 and 814. These event IDs provide valuable insights into the application status of the policy as well as the specific value assigned to the policy on those devices. In the case of this particular policy, the value is a String and is linked to the event ID 814.
By analyzing these event IDs, you can gain a clear understanding of the policy’s application status and the corresponding value associated with it on the devices in question.
To confirm this, you can check the Event log path – Applications and Services Logs – Microsoft – Windows – Devicemanagement-Enterprise-Diagnostics-Provider – Admin.
MDM PolicyManager: Set policy string, Policy: (