Windows Hello for Business PIN Complexity: Every Setting, CSP and GPO (and the 24H2 Trap)

Two things about Windows Hello for Business (WHfB) PIN complexity trip up almost every admin. First, the Group Policy is not where you would look for it - it is not under Windows Hello for Business at all. Second, if you set PIN expiration on a modern fleet, it may silently do nothing, because Windows 11 24H2 quietly stopped honouring it on Virtualization-based Security devices. This post documents every PIN complexity setting, both CSP and Group Policy, and the two traps that make people think their policy is broken when it is actually working exactly as designed.

The problem: "a PIN is less secure than a password"

It is the objection every passwordless project hits. The answer is that a WHfB PIN is device-bound and Trusted Platform Module (TPM)-protected - it never leaves the machine, so it is not "a short password." But that argument only holds if you can show the PIN meets a real complexity standard. To do that you need to configure the PIN complexity policy correctly - and that is where the surprises start.

Why it happens: PIN complexity lives in two odd places

WHfB PIN settings are exposed through the PassportForWork Configuration Service Provider (CSP) under a PINComplexity node, and through Group Policy - but the Group Policy is filed under System › PIN Complexity, not under Windows Hello for Business where every other WHfB setting lives. Admins spend twenty minutes looking in the wrong Group Policy folder before they find it.

How to verify the effective policy

The applied PIN complexity values land in the registry under the PINComplexity subkey. Read them to confirm what is actually enforced (versus what you think you assigned):

The fix: configure every PIN complexity setting

Configure it via Intune (Settings Catalog)

1. Sign in to the Intune admin center › Devices › Configuration › Create › New Policy.
2. Platform = Windows 10 and later, Profile type = Settings catalog › Create.
3. Name it (for example WHfB - PIN Complexity) › Next.
4. Add settings › search PIN Complexity › tick the settings you want (Minimum PIN length, Digits, Uppercase letters, etc.) from the table below.
5. Set each value › Next › assign to a pilot group › Next › Create.

Configure it via Group Policy

1. Open gpmc.msc › right-click the target OU › Create a GPO in this domain, and Link it here... › name it.
2. Right-click the GPO › Edit.
3. Navigate to Computer Configuration › Administrative Templates › System › PIN Complexity (not under Windows Hello for Business - see the Gotcha below).
4. Double-click each setting from the table, set Enabled, and enter the value.

Here is the complete set. The CSP nodes are under ./Device/Vendor/MSFT/PassportForWork/{TenantId}/Policies/PINComplexity/ (a matching ./User/... path exists), and every Group Policy setting is under the same Computer Configuration › Administrative Templates › System › PIN Complexity folder:

"Require digits" behaves in three states worth understanding: Enabled forces at least one digit; Disabled forbids digits entirely; Not configured allows but does not require them. The same three-state logic applies to lowercase, uppercase, and special characters. The special-character set is the standard keyboard punctuation range.

Here is a sensible baseline as an Intune custom policy (Settings Catalog exposes the same under Windows Hello for Business and PIN Complexity):

The two traps

If you configure via Group Policy instead of Intune, the values land under a different registry root (Policies\Microsoft rather than Microsoft\Policies) - useful to know when you are checking which channel actually applied:

Proof it worked

Here is a real run of Get-PinComplexityPolicy.ps1 from this series, showing the exact 24H2/VBS trap the post describes - MinimumPINLength is enforced, but this device would silently ignore an Expiration/History setting if one were added:

MinimumPINLength : 8 confirms the policy applied and is being read correctly. The VBS/build check underneath is the script doing your homework for you: because this device runs build 26200 with VBS on, any Expiration or History value you might set later would be silently ignored - the script flags that automatically instead of leaving you to find out the hard way.

Set a policy that requires a 6-digit minimum with digits required, assign it, and try to set a 4-digit PIN on a target device - Windows should reject it and state the requirement. The registry PINComplexity values match your policy, and a compliant PIN is accepted. If you configured expiration, verify on a non-VBS device (or accept it is a no-op on 24H2/VBS and remove it from your compliance narrative).

References

• Windows Hello for Business policy settings (PIN settings)
• PassportForWork CSP (PINComplexity nodes)
• Windows Hello Enhanced Sign-in Security (ESS)
• Configure Windows Hello for Business (policy precedence, strictest-wins)