Only allow device authentication for the Microsoft Account Sign-In Assistant
- Policy ID
- MicrosoftAccount_RestrictToEnterpriseDeviceAuthenticationOnly
- Scope
- Computer Configuration
- Supported on
- At least Windows 11 Version 22H2
- Source
- Administrative Templates (.admx) for Windows 11 2026 Update (26H2) (version 1.0)
- Category
- Windows Components › Microsoft account
Description
This setting determines whether to only allow enterprise device authentication for the Microsoft Account Sign-in Assistant service (wlidsvc). By default, this setting is disabled and allows both user and device authentication. When the value is set to 1, only allow device authentication, and block user authentication.
Registry
ComputerHKEY_LOCAL_MACHINE
- EnterpriseDeviceAuthOnlyREG_DWORD