Entra/Win11 - Shared Multi-User Device woes

[Garacesh]

We're testing shared multi-user device mode because of of our depts has a revolving door of interns, we use OneDrive everywhere so the chances of C:\Users getting filled up with rubbish is reasonable I reckon. We want to just be able to say "Here, use this laptop for each one" and just have it nix profiles after X days or Y disk space full, since there's never multiple interns in at the same time, and since we're going fully cloud here we can't really push DelProf via GPO or anything like the old days.

 

Cool, Microsoft has a policy for that, yeah?

Endpoint Manager, Devices, Configuration, Create, New Policy, Shared PC settings, Enable Shared PC Mode With One Drive Sync, Enabled. Assign to device. 

Winlogon immediately shows Insert your security key into the USB port to sign in

 

Er. What?

It's the same settings as any other PC in the organisation, just with the shared pc mode policy on top. There's nothing else in that policy (there was initially, but I've removed it all and reset the device trying to debug this issue) 

 

You're still able to use email/password (or email/PIN if you've previously logged in and set up Windows Hello) from the Sign-in options menu, but it always defaults to wanting a USB key that was never set up, we don't even use them here. And it even asks if nobody has ever logged on before, so it's not the first user's Windows Hello going screwy, either. 

 

Google-fu is letting me down, doesn't seem to be anybody discussing this that I can find. 

Microsoft's documentation on Shared Multi-User Mode doesn't list anything about security keys (just disabling biometric logon) 

 

Looking at the Device Configuration page for the device, none of the other policies look like they're applicable to this issue, and if I remove the shared user policy, the issue goes away, so it definitely seems to be that policy.

 

What gives? Anyone had this issue before?