Windows Hello for Business PIN Complexity: Every Setting, CSP and GPO (and the 24H2 Trap)

Two things about Windows Hello for Business (WHfB) PIN complexity trip up almost every admin. First, the Group Policy is not where you would look for it - it is not under Windows Hello for Business at all. Second, if you set PIN expiration on a modern fleet, it may silently do nothing, because Windows 11 24H2 quietly stopped honouring it on Virtualization-based Security devices. This post documents every PIN complexity setting, both CSP and Group Policy, and the two traps that make people think their policy is broken when it is actually working exactly as designed.

The problem: "a PIN is less secure than a password"

It is the objection every passwordless project hits. The answer is that a WHfB PIN is device-bound and Trusted Platform Module (TPM)-protected - it never leaves the machine, so it is not "a short password." But that argument only holds if you can show the PIN meets a real complexity standard. To do that you need to configure the PIN complexity policy correctly - and that is where the surprises start.

Why it happens: PIN complexity lives in two odd places

WHfB PIN settings are exposed through the PassportForWork Configuration Service Provider (CSP) under a PINComplexity node, and through Group Policy - but the Group Policy is filed under System › PIN Complexity, not under Windows Hello for Business where every other WHfB setting lives. Admins spend twenty minutes looking in the wrong Group Policy folder before they find it.

How to verify the effective policy

The applied PIN complexity values land in the registry under the PINComplexity subkey. Read them to confirm what is actually enforced (versus what you think you assigned):

The fix: configure every PIN complexity setting

Here is the complete set. The CSP nodes are under ./Device/Vendor/MSFT/PassportForWork/{TenantId}/Policies/PINComplexity/ (a matching ./User/... path exists), and every Group Policy setting is under the same Computer Configuration › Administrative Templates › System › PIN Complexity folder:

"Require digits" behaves in three states worth understanding: Enabled forces at least one digit; Disabled forbids digits entirely; Not configured allows but does not require them. The same three-state logic applies to lowercase, uppercase, and special characters. The special-character set is the standard keyboard punctuation range.

Here is a sensible baseline as an Intune custom policy (Settings Catalog exposes the same under Windows Hello for Business and PIN Complexity):

The two traps

If you configure via Group Policy instead of Intune, the values land under a different registry root (Policies\Microsoft rather than Microsoft\Policies) - useful to know when you are checking which channel actually applied:

Proof it worked

Set a policy that requires a 6-digit minimum with digits required, assign it, and try to set a 4-digit PIN on a target device - Windows should reject it and state the requirement. The registry PINComplexity values match your policy, and a compliant PIN is accepted. If you configured expiration, verify on a non-VBS device (or accept it is a no-op on 24H2/VBS and remove it from your compliance narrative).

References

• Windows Hello for Business policy settings (PIN settings)
• PassportForWork CSP (PINComplexity nodes)
• Windows Hello Enhanced Sign-in Security (ESS)
• Configure Windows Hello for Business (policy precedence, strictest-wins)