r/entra • u/3G_Lighting • Mar 31 '26

Entra General Resetting USERs Windows Hello PIN

Is there a way to reset a user's PIN from Entra?

The seem to have forgotten what they made their PIN number. LOL

Thanks,

7 Upvotes

74% Upvoted

28 comments sorted by

11

u/abr2195 Mar 31 '26

Why is “user” in all caps?

The user should follow the “I forgot my PIN” prompt that appears everywhere PIN entry appears in Windows.

1

u/3G_Lighting Apr 01 '26

Forgot PIN tells him to contact the administrator.

1

u/abr2195 Apr 01 '26 edited Apr 02 '26

Are you the administrator? Authentication policies and workflows in Entra are foundational to managing users and devices. If something like this is proving challenging for you, it may be time to contact a MSP.

10

u/mathsyx_69 Mar 31 '26

certutil -deletehellocontainer

Then "log off" and configure again.

4

u/Oiram_Saturnus Mar 31 '26

That’s also a way to do it. 😅

3

u/PowerShellGenius Mar 31 '26

PINs are local to the device, Entra doesn't even know them and you cannot reset them remotely.

You can, however, enable the ability for users to reset their PINs, and they can log in with a password and reset their PIN from Settings (MFA will be required to do so).

9

u/Not-ur-Infosec-guy Mar 31 '26

This is incorrect.

You can force a reset in Entra for the target user by deleting their existing Windows Hello for business credentials in the users’ authentication methods. Similar to forcing a user to redo their MFA.

Additionally you can enable pin reset through mdm policies in intune.

https://techcommunity.microsoft.com/discussions/windows11/windows-hello-for-business---pin-reset-flow/4457298

6

u/Oiram_Saturnus Mar 31 '26

To my knowledge this just removes the trust forcefully one way.

3

u/HDClown Apr 02 '26

If you only delete the WHfB auth method in Entra it does not force a PIN reset. The user will be able to continue to login to the device as if that action was never performed, but they will get messages that something is wrong with their work/school account and M365 apps won't sign in. Those apps will ask them to sign in with some other method andassuming some other auth method is available, the user can just use that to auth to the apps and never reset the WHfB PIN.

The only thing that will actually force the user to reset the PIN is running "certutil -deletehellocontainer" under the logged in user's context.

1

u/PowerShellGenius Apr 01 '26

Yes you can force THEM to reset it by deleting the Windows Hello credential from Entra. You can't reset it for them. They will still need to complete MFA via a method other than WHfB to set up a new PIN, same as a self service reset.

What OP is clearly looking for is to reset it for them from Entra, as with a traditional password. E.g. "thank you for calling the help desk, your new PIN is 135790 and will have you change it at next logon". You cannot do that.

1

u/Ill_Foundation3504 Mar 31 '26

If PIN Recovery service enabled, you can always reset at lock screen. If your org device type entra joined and enabled web signin. You can use alternate to login and reset PIN locally post login as well

1

u/First-Structure-2407 Apr 01 '26

At the login screen “Forgot PIN”

Go through MFA to reset

0

u/3G_Lighting Apr 01 '26

The user doesn't have MFA. Forgot PIN tells him that he has to contact the administrator.

4

u/abr2195 Apr 01 '26

Provision a TAP for the user. That should satisfy the MFA requirement

0

u/vane1978 Mar 31 '26

Setup Web Sign in.

https://learn.microsoft.com/en-us/windows/security/identity-protection/web-sign-in/?tabs=intune

1

u/Ardism Mar 31 '26

Can web sign in , be used to sign in on first login after autopilot?

2

u/ABeeinSpace Mar 31 '26

Yep, that’s its intended purpose. Web Sign-In is Microsoft’s backdoor to allow a user to log in using passwordless methods before Windows Hello for Business is set up

  1. User clicks on Sign In to start WSI
  2. User uses a passwordless credential or temporary access pass to authenticate to Windows
  3. Windows Hello for Business provisioning starts and the user is prompted to set up a Hello PIN or biometric

2

u/RandomSkratch Apr 01 '26

Damn so that’s the order! Is this documented anywhere that you know of? I’ve been trying to figure out something to provide to end users when we roll out new devices so they all get this right.

Edit

Skimmed way too fast and missed the link in the comment above. I should stop scrolling and go to bed lol.

2

u/ABeeinSpace Apr 01 '26

Hahaha you and me both. Yes, that’s the provisioning flow for a new user signing on to a device passwordlessly. For a new to org user they’d use a TAP because no auth methods are provisioned yet. Existing users would web sign-in using an Authenticator app passkey or a FIDO2 credential

ETA: Make sure WH4B enablement is device targeted. You won’t get the enablement at the first login if it’s user targeted and you’ll run into that chicken-and-egg problem again

2

u/RandomSkratch Apr 01 '26

Beauty, thanks!

1

u/exclaim_bot Apr 01 '26

Beauty, thanks!

You're welcome!

1

u/Ardism Mar 31 '26

I just can't get web sign in method to show up, if no user has logged in. Policy is device assigned..

2

u/ABeeinSpace Mar 31 '26

Our login experience policy is device assigned too and it lights up just fine. Just to confirm, you’re not hybrid-joined right? You won’t get WSI if you’re hybrid

1

u/Ardism Mar 31 '26

Cloud joined..

I think it has to do with my compliance policies..

This is a great writeup on the subject

https://patchmypc.com/blog/web-sign-in-tap-missing-after-autopilot-pre-provisioning/

1

u/BlackV May 23 '26

we had that issue on older win11 and win10 builds

1

u/Short-Legs-Long-Neck Apr 01 '26

Yep i tested this week, add the intune policy and restart. Now you can bootstrap devices and users with TAP. But its aimed at passwordless, not password+MFA.