remove PIN from AVD sign in.

Windows Hello for Business PIN support depends on the device join type and the Windows Hello for Business deployment model. In a hybrid scenario like AVD session hosts that are domain joined (and Microsoft Entra hybrid joined for the user sessions), PIN behavior is controlled by Windows Hello for Business and its PIN reset capabilities.

Key points from the supported models:

• Microsoft Entra hybrid joined devices support Windows Hello for Business with PIN, including both destructive and nondestructive PIN reset, but with specific requirements:
  • Destructive PIN reset requires connectivity to domain controllers and, if AD FS is used, to federation services.
  • Nondestructive PIN reset requires the Windows Hello for Business PIN reset service and client policy, and works without DC connectivity.
• On‑premises only deployments (AD FS without Microsoft Entra hybrid join) cannot use the nondestructive PIN reset service because it relies on Microsoft Entra identities.

If the goal is simply to remove the PIN option for AVD sign‑in (easiest option):

• Disable Windows Hello for Business / PIN on those session hosts via policy so that users are not offered a PIN at sign‑in. The context here does not provide the exact GPO/MDM setting names, but it does clarify that PIN behavior is governed by Windows Hello for Business and its reset service, and that hybrid deployments can enable or rely on that service when PIN is required.

If instead the goal is to keep PIN and “fix” it so it works reliably:

• Ensure the AVD session hosts are correctly Microsoft Entra hybrid joined, not just domain joined.
• For destructive PIN reset to work on hybrid devices, ensure:
  • Corporate network connectivity from the session host to domain controllers.
  • If AD FS is used for certificate trust or on‑premises only deployments, connectivity to federation services.
• For nondestructive PIN reset (recommended for hybrid, especially when DC connectivity is intermittent):
  • Onboard the Microsoft Entra tenant to use the Windows Hello for Business PIN reset service.
  • Deploy the client policy that enables nondestructive PIN reset.

If users forget their PIN on these hybrid AVD session hosts:

• They can use “I forgot my PIN” from Settings or the lock screen, but:
  • Hybrid devices need DC/federation connectivity for destructive PIN reset.
  • Nondestructive PIN reset works without DC connectivity once the PIN reset service and policy are deployed.

If the environment does not want to meet these prerequisites (network connectivity to DC/AD FS, PIN reset service configuration), then removing/turning off Windows Hello for Business PIN on the AVD session hosts is the straightforward option.

References:

• PIN reset
• Common questions about Windows Hello for Business
• Microsoft Entra hybrid joined devices