Event ID 360: Every Prerequisite That Blocks Windows Hello for Business Provisioning

The Windows Hello for Business provisioning prompt never appears. No error. No toast. The user just never gets asked to set up a PIN. You check Event Viewer and find Event ID 360 in Microsoft-Windows-User Device Registration/Admin: "Windows Hello for Business provisioning will not be launched." Then comes a list of prerequisites — some yes, some no — and one of those failed lines is the entire reason provisioning is blocked.

Event 360 is the most actionable event in the WHfB troubleshooting toolkit because it tells you exactly which condition failed. The message body has up to a dozen distinct prerequisite lines, each with its own cause and fix. This post goes through every one of them.

The problem: WHfB provisioning silently blocked

When a user signs into a device that meets WHfB requirements, Windows evaluates a set of prerequisites in the background. If all are met, it launches the provisioning flow — the "Set up a PIN" prompt appears. If any prerequisite fails, Windows logs Event 360 and silently exits without showing anything to the user.

The user experience is identical whether provisioning was never attempted or was blocked: the Sign-in options page still shows "Windows Hello is not set up" and no prompt ever appears. Without checking Event Viewer, there is no way to know the evaluation happened and failed.

How to find Event 360 in Event Viewer and PowerShell

Option 1 — Event Viewer (GUI)

Open Event Viewer and navigate to the User Device Registration log. This is not a standard Windows Logs path — it lives under Applications and Services Logs:

Filter for Event ID 360. The most recent entry is the one to read first — it reflects the current state. The General tab in the bottom pane shows the full prerequisite list. On Windows 11 24H2 and later, the lines use plain English descriptions. On older builds they use technical field names like IsAzureAdJoined. The meaning is the same.

Here is Event 360 captured from a Hybrid-joined Windows 11 device. The blocked lines are immediately visible — post-logon provisioning is disabled and the user signed in with domain credentials rather than Entra credentials:

Option 2 — PowerShell (faster for remote or bulk)

This command pulls the last 5 Event 360 entries and colour-codes each prerequisite line so No values stand out immediately:

# Run as the signed-in user (not SYSTEM)
$events = Get-WinEvent -LogName 'Microsoft-Windows-User Device Registration/Admin' |
    Where-Object { $_.Id -eq 360 } |
    Select-Object -First 5

foreach ($e in $events) {
    Write-Host "=== Event 360 @ $($e.TimeCreated.ToString('yyyy-MM-dd HH:mm:ss')) ===" -ForegroundColor Cyan
    $e.Message -split "\`n" | ForEach-Object {
        $line = $_.Trim()
        if (-not $line) { return }
        if     ($line -match ': No$')   { Write-Host "  $line" -ForegroundColor Red   }
        elseif ($line -match ': Yes$')  { Write-Host "  $line" -ForegroundColor Green }
        else                            { Write-Host "  $line" -ForegroundColor Gray  }
    }
}

=== Event 360 @ 2026-09-17 09:54:06 ===
  Windows Hello for Business provisioning will not be launched.
  Device is Microsoft Entra joined (or hybrid joined): Yes
  User has logged on with Microsoft Entra credentials: No
  Windows Hello for Business policy is enabled: Yes
  Windows Hello for Business post-logon provisioning is enabled: No
  Local computer meets Windows Hello for business hardware requirements: Yes
  User is not connected to the machine via Remote Desktop: Yes
  User certificate for on premise auth policy is enabled: No
  Machine is governed by none policy.
  Cloud trust for on premise auth policy is enabled: Yes
  User account has Cloud to OnPrem TGT: Not Tested

Primary blockers: no Entra sign-in (no PRT) + post-logon provisioning disabled by policy.

Every prerequisite line decoded

Work through the cards below in order. Fix the first red item — lower ones often resolve automatically once a foundational prerequisite is met. Cards with an amber border are context-dependent: failing them may not be a real blocker depending on your deployment model.