World of EUC

Where is the Windows Hello configuration located? GPO or Intune?

You should be able to disable Windows Hello for Business sign in via this policy:
<https://www.prajwaldesai.com/disable-windows-hello-using-group-policy/>

Will give it a try - thanks for fast response <@ULL6F7DRA> :+1: :muscle: 

You need to find out if you override GPO settings with Intune settings, if not, the policy from earlier should work

The specific setting is called "MDM wins over GP":
<https://www.anoopcnair.com/mdm-wins-over-gpo-group-policy-intune-policy/>

However Intune settings only apply if the Citrix VDI is enrolled in Intune or Co-Managed via SCCM

If you are using FAS with NetScaler here is the process to use those SmartCards with Azure AD and Conditional Access for SSO to the VDI.  This might help.  <https://www.jeffriechers.com/wiki/azuread-prt-with-fas-certificates/>