Start > Run gpedit.msc

1. "Turn on Convenience PIN sign-in" policy (as above) must be enabled

2. All 3 Policies under Computer Configuration\Administrative Templates\Windows Components\Windows Hello for Business\ must be in the state "Not configured"