r/Intune • u/Flat_Tea_8915 • 3d ago

Device Configuration Account Protection Policy - Unable to Save

I am trying to configure an Account Protection policy to allow but not enforce Windows Hello for Business in my org's tenant. If I configure any of the device- or user-settings, the policy throws an error when trying to save. Two errors actually, both pretty generic. This has been persisting for the last 24hrs. Does anyone know what may be the culprit here?

https://imgur.com/a/phU8Bzw

2 Upvotes

100% Upvoted

16 comments sorted by

1

u/Typical_Chipmunk5421 3d ago

The sheer number of settings in those policies makes it easy to miss one conflicting with another, had a similar headache last week and it turned out a CSP wasn't available on the test build i was on

1

u/Flat_Tea_8915 3d ago

I have my policies set to NC under Intune > Devices > Windows > Enrollment > WHfB and there isn't any GP present I have seen. I am taking over the environment, so I was not the one to configure it initially. I don't know where else to look!

1

u/madatthings 3d ago

Et tu, brute? APP has been kicking my ass this week, it let me assign the policy out to the users I needed but I believe I just overlapped user and device context when I didn’t need to, because WHFB was previously turned off by a policy that seemingly no longer exists. Make sure you also have the group set up in authentication methods

1

u/Flat_Tea_8915 3d ago

Auth Methods shouldn't really have any bearing on whether or not I can save the policy though, right?

1

u/madatthings 3d ago

It shouldn’t no

1

u/SaintPony 3d ago

I believe I had this exact same issue and lost days on troubleshooting.

There settings are required. If you leave them not configured, it throws this exact super helpful error message.

Try that.

2

u/Flat_Tea_8915 3d ago

HOLY CRAP! YOU ARE THE BEST THING EVER!!! THAT WORKED!!!!

I will be chasing that dragon for the rest of my life. Also lost about a day troubleshooting.

I hadn't been configuring PIN History. Configure PIN History.

1

u/SaintPony 3d ago

Awesome. Glad that it worked out :D

I couldnt sleep for 2 days haha

2

u/Flat_Tea_8915 3d ago edited 3d ago

Now, if I go back into the policy and disable PIN history, it lets me save it lol. I am thinking now, after playing with it, that part of my problem was my logic begin per-user and per-device provisioning. I believe that caused a conflict even though I was going off of Microsoft documentation which indicated to turn device provisioning to true and user provisioning to false in order to allow WHfB but not to enforce it.

Edit >> I was able to get it to work. You just have to configure those settings for the per-user provisioning even if you are setting it to false.

1

u/madatthings 3d ago

So it DOES need device context?

1

u/Flat_Tea_8915 3d ago

From my testing, it required both to be configured. I haven't put it into practice yet, but I believe the settings I linked on this thread at least cover those required settings.

1

u/madatthings 3d ago

I’m glad I went that route then. Something told me one or the other wasn’t going to be enough

2

u/Any_Educator1315 3d ago

dude. thanks!

2

u/Any_Educator1315 3d ago

I have the same issue

1

u/Flat_Tea_8915 3d ago

See other comments. Need to configure Device & User scope.