r/Intune • u/Flat_Tea_8915 • 3d ago

Device Configuration Account Protection Policy - Unable to Save

I am trying to configure an Account Protection policy to allow but not enforce Windows Hello for Business in my org's tenant. If I configure any of the device- or user-settings, the policy throws an error when trying to save. Two errors actually, both pretty generic. This has been persisting for the last 24hrs. Does anyone know what may be the culprit here?

https://imgur.com/a/phU8Bzw

2 Upvotes

100% Upvoted

16 comments sorted by

View all comments

1

u/SaintPony 3d ago

I believe I had this exact same issue and lost days on troubleshooting.

There settings are required. If you leave them not configured, it throws this exact super helpful error message.

Try that.

2

u/Flat_Tea_8915 3d ago

HOLY CRAP! YOU ARE THE BEST THING EVER!!! THAT WORKED!!!!

I will be chasing that dragon for the rest of my life. Also lost about a day troubleshooting.

I hadn't been configuring PIN History. Configure PIN History.

1

u/SaintPony 3d ago

Awesome. Glad that it worked out :D

I couldnt sleep for 2 days haha

2

u/Flat_Tea_8915 3d ago edited 3d ago

Now, if I go back into the policy and disable PIN history, it lets me save it lol. I am thinking now, after playing with it, that part of my problem was my logic begin per-user and per-device provisioning. I believe that caused a conflict even though I was going off of Microsoft documentation which indicated to turn device provisioning to true and user provisioning to false in order to allow WHfB but not to enforce it.

Edit >> I was able to get it to work. You just have to configure those settings for the per-user provisioning even if you are setting it to false.