Edit

Policy CSP - Accounts

  • Article

AllowAddingNonMicrosoftAccountsManually

Scope Editions Applicable OS
✅ Device
❌ User		 ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC		 ✅ Windows 10, version 1507 [10.0.10240] and later 
./Device/Vendor/MSFT/Policy/Config/Accounts/AllowAddingNonMicrosoftAccountsManually

Specifies whether user is allowed to add non-MSA email accounts. Most restricted value is 0.

Note

This policy will only block UI/UX-based methods for adding non-Microsoft accounts. Even if this policy is enforced, you can still provision non-MSA accounts using the EMAIL2 CSP.

Description framework properties:

Property name Property value
Format int
Access Type Add, Delete, Get, Replace
Default Value 1

Allowed values:

Value Description
0 Not allowed.
1 (Default) Allowed.

AllowMicrosoftAccountConnection

Scope Editions Applicable OS
✅ Device
❌ User		 ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC		 ✅ Windows 10, version 1507 [10.0.10240] and later 
./Device/Vendor/MSFT/Policy/Config/Accounts/AllowMicrosoftAccountConnection

Specifies whether the user is allowed to use an MSA account for non-email related connection authentication and services. Most restricted value is 0.

Description framework properties:

Property name Property value
Format int
Access Type Add, Delete, Get, Replace
Default Value 1

Allowed values:

Value Description
0 Not allowed.
1 (Default) Allowed.

AllowMicrosoftAccountSignInAssistant

Scope Editions Applicable OS
✅ Device
❌ User		 ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC		 ✅ Windows 10, version 1703 [10.0.15063] and later 
./Device/Vendor/MSFT/Policy/Config/Accounts/AllowMicrosoftAccountSignInAssistant

Allows IT Admins the ability to disable the Microsoft Account Sign-In Assistant (wlidsvc) NT service.

Note

If the MSA service is disabled, Windows Update will no longer offer feature updates to devices running Windows 10 1709 or higher. See Feature updates aren't being offered while other updates are.

Note

If the MSA service is disabled, the Subscription Activation feature won't work properly and your users won't be able to "step-up" from Windows 10 Pro to Windows 10 Enterprise, because the MSA ticket for license authentication can't be generated. The machine will remain on Windows 10 Pro and no error will be displayed in the Activation Settings app.

Description framework properties:

Property name Property value
Format int
Access Type Add, Delete, Get, Replace
Default Value 1

Allowed values:

Value Description
0 Disabled.
1 (Default) Manual start.

DomainNamesForEmailSync

Scope Editions Applicable OS
✅ Device
❌ User		 ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC		 ✅ Windows 10, version 1607 [10.0.14393] and later 
./Device/Vendor/MSFT/Policy/Config/Accounts/DomainNamesForEmailSync

Description framework properties:

Property name Property value
Format chr (string)
Access Type Add, Delete, Get, Replace

RestrictToEnterpriseDeviceAuthenticationOnly

Scope Editions Applicable OS
✅ Device
❌ User		 ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC		 ✅ Windows 11, version 22H2 [10.0.22621] and later 
./Device/Vendor/MSFT/Policy/Config/Accounts/RestrictToEnterpriseDeviceAuthenticationOnly

This setting determines whether to only allow enterprise device authentication for the Microsoft Account Sign-in Assistant service (wlidsvc). By default, this setting is disabled and allows both user and device authentication. When the value is set to 1, only allow device authentication, and block user authentication.

Most restricted value is 1.

Description framework properties:

Property name Property value
Format int
Access Type Add, Delete, Get, Replace
Default Value 0

Allowed values:

Value Description
0 (Default) Allow both device and user authentication. Don't block user authentication.
1 Only allow device authentication. Block user authentication.

Group policy mapping:

Name Value
Name MicrosoftAccount_RestrictToEnterpriseDeviceAuthenticationOnly
Friendly Name Only allow device authentication for the Microsoft Account Sign-In Assistant
Location Computer Configuration
Path Windows Components > Microsoft account
Registry Key Name Software\Microsoft\Windows\CurrentVersion\Policies\System
Registry Value Name EnterpriseDeviceAuthOnly
ADMX File Name MSAPolicy.admx

Policy configuration service provider