Create Intune Policy to Block Microsoft Accounts

This article is designed to take you through the process of implementing the Intune Block Microsoft Accounts Policy. We’ll make use of Intune’s Settings Catalog to enforce this policy, emphasizing a practical, hands-on approach to make you understand the Block Microsoft Accounts Policy in action with Intune.

Block Microsoft Accounts Policy configuration restricts users from adding new Microsoft accounts to this computer. Choosing the “Users can’t add Microsoft accounts” option prevents users from creating new Microsoft accounts, converting a local account to a Microsoft account, or linking a domain account to a Microsoft account.

This option is recommended if you wish to control the usage of Microsoft accounts within your enterprise. Opting for the “Users can’t add or log on with Microsoft accounts” choice denies existing Microsoft account users the ability to log on to Windows.

However, be cautious, as this selection may prevent an existing administrator on this computer from logging in and managing the system. If you disable or leave this policy unconfigured (recommended), users can use Microsoft accounts with Windows.

• How to Setup Passwordless Login for Microsoft Accounts
• Enable Local Admin Access for Windows 365 Business Edition

Block Microsoft Accounts Policy Utilizing Intune

To implement Block Microsoft Accounts Policy Utilizing Intune, follow the steps stated below:

• Sign in to the Intune Admin Center portal https://intune.microsoft.com/.
• Select Devices > Windows > Configuration profiles > Create a profile.

In Create Profile, I select Windows 10 and later in Platform, and select Profile Type as Settings catalog. Click on the Create button.

Platform	Profile Type
Windows 10 and later	Settings Catalog

On the Basics tab pane, I provide a name for the policy as “Block Microsoft Accounts Policy.”

• Optionally, if you want, you can enter a policy description and proceed by selecting “Next“.

Now in Configuration Settings,

• Click Add Settings to browse or search the catalog for the settings I want to configure.

• In the Settings Picker windows
• I searched for the keyword Microsoft Accounts
• I found the category Local Policies Security Options and selected this

When I select that option as stated above, I see the sub-category Accounts Block Microsoft Accounts. After selecting that, click the cross mark at the right-hand corner, as shown below.

Here i choose Enabled (Users can’t add Microsoft accounts) for Accounts Block Microsoft Accounts in Local Policies Security Options among the three options as shown below in the image.

Using Scope tags, you can assign a tag to filter the profile to specific IT groups. One can add scope tags (if required). More details on Intune Scope Tags Implementation Guide.

• Click Next to continue.

Now in Assignments, in Included Groups, you need to click on Add Groups, choose Select Groups to include one or more groups.

• Click Next to continue.

In the Review + Create tab, I review settings. After clicking on Create, changes are saved, and the profile is assigned.

After successfully creating the “Block Microsoft Accounts Policy,” a notification will appear in the top right-hand corner confirming the action. You can also verify the policy’s existence by navigating to the Configuration Profiles list, where it will be prominently displayed.

Your groups will receive your profile settings when the devices check in with the Intune service. The Policy applies to the device.

Intune Report for Blocking Microsoft Accounts Policy

From the Intune Portal, you can view the Intune settings catalog profile report, which provides an overview of device configuration policies and deployment status.

To track the assignment of the policy, you need to select the relevant policy from the Configuration Profiles list. Then, you can review the device and user check-in status to determine whether the policy has been successfully applied.

• If you require more detailed information, you can click on “View Report” to access additional insights.

Intune MDM Event Log related to Block Microsoft Accounts Policy

To verify the successful implementation of String or integer policies for Blocking Microsoft Accounts Policy on Windows 10 or 11 devices through Intune, you can leverage event IDs 813 and 814.

These event IDs provide valuable insights into the application status of the Blocking Microsoft Accounts Policy as well as the specific value assigned to the policy on those devices. In the case of this particular policy, the value is an Integer and is linked to the event ID 813.

By analyzing these event IDs, you can gain a clear understanding of the policy’s application status and the corresponding value associated with it on the devices in question.

To confirm this, you can check the Event log path – Applications and Services Logs – Microsoft – Windows – Devicemanagement-Enterprise-Diagnostics-Provider – Admin.

MDM PolicyManager: Set policy string, Policy: (Accounts_BlockMicrosoftAccounts), Area: (LocalPoliciesSecurityOptions), EnrollmentID requesting merge: (5B88AEF1-09E8-43BB-B144-7254ACBBDF3E), Current User: (Device), Int: (0x1), Enrollment Type: (0x6), Scope: (0x0).

When I opened the above Event log, I found that the Block Microsoft Accounts Policy I have applied to the device has been successfully implemented.

• By reviewing the log entry shown in the above image, the Event Viewer, I came across essential information, including the Area and Enrollment ID.

These details play a significant role in identifying the corresponding registry path. To locate the specific information, please consult the table provided below:

Area	Policy	Integer	Scoped	Event ID
LocalPoliciesSecurityOptions	Accounts_BlockMicrosoftAccounts	1	Device	813

The details presented in the table above for the Block Microsoft Accounts Policy Utilizing Intune can be employed to access the registry settings that hold the group policy configurations on a specific computer. To accomplish this, you can execute “REGEDIT.exe” on the target computer and navigate to the precise registry path where these settings are stored.

• Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\providers\5B88AEF1-09E8-43BB-B144-7254ACBBDF3E\default\Device\LocalPoliciesSecurityOptions

When you navigate the above path in the Registry Editor, you will find the registry key named Accounts_BlockMicrosoftAccounts. Also, when I navigated to the above path, I saw that the Registry Key was created successfully.

Registry Name	Value
Accounts_BlockMicrosoftAccounts	Enabled

Windows CSP Details Accounts_BlockMicrosoftAccounts

We will see Windows CSP Details for this Policy setting Accounts_BlockMicrosoftAccounts. The primary objective of this policy is to manage and restrict the use of Microsoft accounts on a specific computer.

Microsoft accounts are linked to various services and functionalities, and in some enterprise environments, there might be a need to control their usage for security or administrative reasons.

Enforcing stringent restrictions on Microsoft account usage may be necessary in enterprise environments to ensure compliance with security policies and to prevent unauthorized access. System administrators need to balance security requirements with the operational needs of users to find an appropriate configuration for this policy.

CSP URI – ./Device/Vendor/MSFT/Policy/Config/LocalPoliciesSecurityOptions/Accounts_BlockMicrosoftAccounts

We are on WhatsApp. To get the latest step-by-step guides and news updates, Join our Channel. Click here – HTMD WhatsApp.

Author

Abhinav Rana is working as an SCCM and Intune Admin with several years of experience. He loves to help the community by sharing his knowledge. He is a B.Tech graduate in Information Technology.