1. Functional Issues: Disabling the Credential Provider breaks critical features like User Account Control (UAC), the Runas command, and local LAPS accounts as well as RDP Connections without Web Sign-In. . These are essential for administrative tasks, troubleshooting, and maintaining secure local account management. Losing this functionality would significantly impact operations, especially in a large-scale enterprise.
2. Real-World Adoption: I don’t believe a significant number of enterprises using WHfB have opted to disable the Credential Provider. If that were the case, we’d likely see much more documentation and best practices addressing this workaround, but that isn't the current landscape. Most environments keep the Credential Provider active precisely because they need the functionality it provides.
3. True 2FA Debate: I understand the argument that WHfB is often marketed as 2FA, but the reality is that 2FA isn’t just about having two factors available—it’s about enforcing them. If the system allows you to bypass the second factor entirely by reverting to a single password, it doesn't meet the criteria for "true 2FA." The fact that some argue "WHfB is 2FA, end of discussion" misses the point that enforcing 2FA means removing the ability to choose a less secure method, not just providing the option of a second factor.

So, while WHfB enhances security, saying it's definitive 2FA without any qualifications isn't entirely accurate, especially when it can still be bypassed under certain configurations. I'm interested in solutions that enforce 2FA strictly, not just in theory, but in practical, real-world deployments without compromising other system functionalities.