⚙️🪟💻CP - Security - Block Consumer Microsoft Accounts
A second identity on a managed device is a second door out of it. This one closes the personal Microsoft account before somebody signs into it out of habit.
What this policy is about 👥
A managed laptop is supposed to have one identity on it: the work account, which you can see, audit, revoke and wipe. What actually happens is that somebody signs into their personal Microsoft account as well, because Windows keeps offering, because their Xbox is on it, because they wanted to sync their browser favourites from home.
Now there are two identities on the device, and you can only see one of them. Company documents can be dragged into personal OneDrive, notes can sync to a personal account, and none of it appears in any log you have access to. When that person leaves and you wipe the device, the copy on the other identity stays exactly where it is.
This policy stops the second identity being added.
This blocks personal Microsoft accounts, the outlook.com and hotmail.com kind. Work and school accounts are unaffected, including guest access from another tenant. Nothing about normal business sign-in changes.
Why this matters 🕵️
This is not really a malware control, it is a data boundary control, and it fails quietly rather than loudly. Nobody notices a leak here. There is no alert, no incident, no moment where something obviously breaks. There is just a slow accumulation of company material in accounts you have no relationship with, discovered eventually during an offboarding that turns out not to have covered everything.
It also removes an entire category of awkward conversation. Once a personal account has been on a device for two years, asking somebody to disconnect it means asking them to lose things they consider theirs, and the answer is a negotiation you will not enjoy. Blocking it from day one means the situation never arises.
And it closes a small phishing avenue: an attacker who gets a user to sign into a personal account on a corporate device gets a foothold that no Conditional Access policy is watching, because Conditional Access does not apply to identities that are not yours.
🛠️ Configuration
Where: Intune admin center → Devices → Configuration → Create → Windows → Settings catalog.
| Setting | Category | Value |
|---|---|---|
| Block All Consumer Microsoft Account User Authentication | Administrative Templates → Windows Components → Microsoft account | Enabled |
| Accounts Block Microsoft Accounts | Local Policies Security Options | Users can't add or log on with Microsoft accounts |
| Allow Microsoft Account Connection | Accounts | Block |
| Assignment, include | 🛡️🪟💻⛓️Group - Windows Devices | |
| Assignment, exclude | 🛡️🪟💻⛓️Group - Autopilot Devices - IoT |
Three settings, because Windows offers three doors. The ADMX setting blocks the authentication itself, the security option stops accounts being added through Settings, and the Accounts CSP setting covers app-level connections. Configuring only one of them produces the familiar result where the block "does not work" on a path nobody tested. Set all three and the behaviour is consistent.
Check the Store policy is in place first. Blocking consumer accounts and leaving the Store open produces a Store users can open and cannot use, which generates tickets that look like a Store problem. The Store block removes the confusion by removing the shopfront.
Caveats ⚠️
This tattoos, and there is no inverse policy. The ADMX setting writes under HKLM\SOFTWARE\Policies\Microsoft\MicrosoftAccount, and excluding a device does not restore consumer sign-in. That is deliberate: on a managed fleet there is no per-device scenario that needs a personal Microsoft account back, so there is no exception group and therefore no paired inverse. If a customer ever produces a genuine one, the correct response is to build the pair properly, not to unassign the profile and hope.
Expect complaints in week one, and only in week one. Users who sync browser favourites or settings through a personal account will notice. The answer is the work account, which does the same job inside a boundary you control, and the complaint disappears once they move.
Some consumer-facing apps stop working. Anything that authenticates with a personal Microsoft account, which in practice means the odd game, a few hardware companion apps, and personal OneDrive. On a business device that is the intended outcome, but it is worth saying out loud before rollout rather than discovering it through a ticket.
It is not the same as blocking personal OneDrive. That has its own policy and its own exception group, because personal OneDrive can be reached through the browser and the sync client independently of whether an account is on the device. Deploy both; they overlap without replacing each other.
IoT and signage devices are excluded. Some appliance builds authenticate to vendor services in ways that trip over account restrictions. They have no user data on them and no user at the keyboard, so the control adds nothing there.
👥 Assignment scope
Baseline for the whole Windows fleet, including shared and kiosk devices, where the risk is if anything higher because more people pass through.
No exception group exists and none is planned. Membership of an exception here would mean "this device is allowed a second, invisible identity", which is not a scenario an MSP should be maintaining.
Worth verifying at tenant takeover: which devices already have a consumer account attached, because this policy prevents new ones rather than removing existing ones. Those need to be disconnected by hand, and it is better to find them during onboarding than during an offboarding two years later.
🔗 Related
- ⚙️🪟💻CP - Security - Microsoft Store: removes the most common prompt to sign in with a personal account.
- ⚙️🪟🧑💼CP - OneDrive - Block personal OneDrive: closes the same data boundary from the sync client side.
- ⚙️🪟💻CP - User Experience - Disable Xbox Services: the other consumer surface that keeps asking for a Microsoft account.
One device, one identity, one boundary you can actually see. Everything else is data leaving through a door you do not have a key to. 👥