The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Enable Fast First Sign In is a device-scoped Windows Authentication policy for Shared PCs. When enabled, Windows can automatically connect a newly signing-in, non-administrator Microsoft Entra account to a candidate local account that was already preconfigured or added on the device.
In Intune, the reported Settings Catalog path is Configuration settings > Authentication > Enable Fast First Sign In. The setting is not documented as a universal faster-login switch, and Microsoft does not publish a guaranteed sign-in time reduction for it.
As an Amazon Associate I earn from qualifying purchases.
What Enable Fast First Sign In actually does
Microsoft describes this policy as intended for Shared PCs “to enable a quick first sign-in experience for a user.” Its specific mechanism is account connection: a new, non-admin Microsoft Entra user can be automatically connected to a candidate local account that is already configured on the computer.
That definition matters. The policy is not a general Windows performance setting, a replacement for Windows Hello, or a promise that every first login will be faster. It applies to the first-sign-in account relationship on a Shared PC. If no suitable candidate local account exists, enabling the policy does not create one and does not provide the documented connection behavior.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Microsoft’s documentation does not provide a measured percentage or number of seconds saved. Treat “fast” as Microsoft’s description of the first-sign-in workflow, not as a benchmark.
Policy values and their behavior
The Policy CSP exposes the setting as an integer. The three documented values are:
| Value | Behavior | When it makes sense |
|---|---|---|
0 |
Default behavior based on the existing Windows SKU and the device’s capabilities. | Use when you want Windows to follow its built-in behavior rather than forcing the policy on or off. |
1 |
Enables automatic connection of new non-admin Microsoft Entra accounts to preconfigured candidate local accounts. | Use for a Shared PC design that has candidate local accounts ready before users sign in. |
2 |
Disables the automatic connection behavior. | Use when the organization does not want this Shared PC first-sign-in behavior. |
Value 0 is the documented default. Do not describe it as equivalent to either enabled or disabled in every situation: Microsoft defines it as behavior determined by the device’s existing SKU and capabilities.
Supported Windows editions and scope
Microsoft lists support for Windows 10 version 1809 and later, with these editions:
- Windows 10 Pro
- Windows 10 Enterprise
- Windows 10 Education
- Windows 10 IoT Enterprise
The policy is device-scoped, not user-scoped. Assigning it to a device affects the Windows installation on that computer; it is not a per-user preference that follows an employee to other devices. A device assignment is therefore the appropriate model for a Shared PC, kiosk-like station, classroom computer, or other shared endpoint.
The available documentation does not verify every current tenant or Windows release label in the Intune portal. Check the operating-system and edition requirements for the devices in your own deployment before assigning the profile.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Prerequisite: candidate local accounts must exist
The automatic connection depends on candidate local accounts that are already preconfigured or added on the device. This is the key prerequisite and the most important boundary on what the setting can do.
Free tools Windows power users keep installed
One-click scans. No signup required.
- Prepare the candidate local account or accounts as part of the device build or Shared PC configuration.
- Confirm that the account is present on the target computer before testing a new Microsoft Entra user’s first sign-in.
- Make sure the account design matches your organization’s local-account and access-control requirements.
- Do not expect value
1to manufacture a local account, convert an administrator account, or repair an unrelated sign-in problem.
The policy is specifically about a new non-admin Microsoft Entra account. That qualifier should be included in test plans and documentation; results from an administrator account do not establish the documented behavior.
Find the setting in Intune’s Settings Catalog
A Microsoft Q&A answer identifies this navigation path:
- Open the Microsoft Intune admin center.
- Create or edit a Windows configuration profile that uses the Settings catalog.
- Open Configuration settings.
- Search for or expand Authentication.
- Select Enable Fast First Sign In.
- Choose the integer value required by your design:
0,1, or2. - Complete the profile assignment to the target device group and save the profile.
Portal labels and placement can change between Intune updates or differ by tenant. The path above is the documented/reported route, not a guarantee that every tenant will display identical screens. If the setting is not visible, verify that the profile is a Windows Settings Catalog profile and that the target operating system and edition are in the supported range.
Because this is device-scoped, assign the profile to device groups rather than treating it as a user-only policy. A user group can still be involved in broader Intune administration, but the effect of this setting belongs to the enrolled Windows device.
Deploying the policy through the Policy CSP
Windows identifies the setting with this Policy CSP URI:
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
./Device/Vendor/MSFT/Policy/Config/Authentication/EnableFastFirstSignIn
The data type is an integer. A CSP-based deployment should therefore send one of the documented values:
0for the default behavior determined by SKU and device capabilities1to enable automatic connection for new non-admin Microsoft Entra accounts2to disable the automatic connection behavior
Use the Settings Catalog when it exposes the setting cleanly in your tenant. A custom CSP profile is an alternative for administrators who manage Policy CSP settings directly, but the URI and integer value must be entered exactly. The URI does not change the prerequisite that candidate local accounts be present on the device.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What a first sign-in should look like when value 1 is used
- A Windows device receives the assigned policy and applies value
1. - The device already contains one or more candidate local accounts.
- A new, non-administrator Microsoft Entra user signs in for the first time.
- Windows uses the policy’s automatic connection behavior to connect that account to a suitable preconfigured candidate local account.
This sequence describes the documented purpose, not a guaranteed result for every configuration. A missing candidate account, unsupported edition, policy conflict, failed enrollment, or an account that does not meet the non-admin condition can prevent the expected outcome.
There is no published performance test showing that value 1 reduces login time by a particular amount. Record operational outcomes in your own environment rather than quoting an unverified speed claim.
Choosing the right value for a Shared PC
Choose value 1 when the account model is deliberate
Value 1 is the direct choice when the computer is designed for successive users and the administrator has intentionally prepared candidate local accounts. It aligns with Microsoft’s Shared PC use case and the automatic connection behavior described in the Policy CSP.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Leave value 0 when Windows should decide
Value 0 preserves the documented default behavior. This is useful when the organization does not want to force a setting across mixed hardware or editions, or when the device’s built-in SKU and capability behavior is preferred.
Use value 2 to turn the behavior off
Value 2 explicitly disables the automatic connection behavior. It is the appropriate state when local-account connection is not part of the sign-in design or when administrators need to remove that behavior while investigating a deployment.
Relationship to OneDrive and first-run setup
A common question is whether an Intune OneDrive policy should take effect when a person receives a computer and signs in for the first time. The available Microsoft Q&A discussion does not establish that Enable Fast First Sign In is a fix for OneDrive silent sign-in or first-run OneDrive configuration.
One Shared PC administrator reported that disabling the policy was associated with a setup that worked, while other participants continued to report OneDrive sign-in problems. Those are mixed, anecdotal reports, not a controlled test and not proof of causation. Do not promise that changing value 1 to 2 will resolve OneDrive behavior.
Keep the policies conceptually separate:
- Enable Fast First Sign In governs the Shared PC account-connection behavior documented by Microsoft.
- OneDrive sign-in and silent configuration have their own policy requirements and troubleshooting path.
- If OneDrive fails, document the exact symptom and test the relevant OneDrive configuration independently instead of treating this Authentication setting as a universal remedy.
Validation checklist before assigning the profile broadly
Use a small pilot of representative devices first. Check each item explicitly:
Recommended Free Tools
- The Windows edition and version meet Microsoft’s listed support statement: Windows 10 version 1809 or later and Pro, Enterprise, Education, or IoT Enterprise.
- The profile contains the intended integer and not a similarly named Authentication setting.
- The profile is assigned to the correct device group.
- The device has enrolled, synchronized, and received the profile before testing.
- At least one candidate local account was preconfigured or added on the test device.
- The test identity is a new, non-administrator Microsoft Entra account.
- The observed result is recorded as account connection behavior, not merely as a subjective impression that sign-in felt faster.
If the test does not match the documented outcome, first compare the device scope, integer value, account type, and candidate-account prerequisite. Those checks address the conditions stated by Microsoft without assuming that an unrelated sign-in component is controlled by this policy.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Common interpretation errors
“Fast” means every login is accelerated
It does not. The name refers to the Shared PC first-sign-in experience and the automatic connection of a new non-admin Microsoft Entra account to a candidate local account. No measured time saving is published.
It is a user policy
It is device-scoped. A profile assigned to one computer does not automatically configure another computer where the same user signs in.
Value 1 creates the local account
It does not. Candidate local accounts must already be preconfigured or added on the device.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsIt fixes OneDrive silent sign-in
The Microsoft Q&A thread contains conflicting user reports and does not prove that relationship. Treat OneDrive as a separate configuration issue.
Value 0 is the same as value 2
It is not. Value 0 leaves behavior to the existing SKU and device capabilities; value 2 explicitly disables the automatic connection behavior.
Security and administration considerations
Because this setting connects identities to local-account candidates on a shared endpoint, document which local accounts are eligible and who administers them. Keep the local-account design consistent with least-privilege requirements: the documented behavior targets new non-admin Microsoft Entra users, and the policy should not be used as a reason to grant unnecessary local administrator access.
Use separate device groups or profiles when different Shared PC populations require different values. For example, one group may use value 1 for a controlled classroom deployment, while another retains value 0 during a migration. Explicitly setting value 2 is preferable when the organization needs to demonstrate that automatic connection is disabled.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Bottom line for administrators
Enable Fast First Sign In is a narrowly defined Shared PC Authentication policy, not a general fast-login toggle. In Intune, configure it under Configuration settings > Authentication > Enable Fast First Sign In when that path is available, assign it at device scope, and choose the value that matches your account model. Value 1 enables the documented automatic connection for new non-admin Microsoft Entra accounts, but only when candidate local accounts are already present. Value 0 keeps the default SKU- and capability-based behavior, and value 2 disables the connection behavior. Do not use the setting as a guaranteed OneDrive fix or claim a specific time saving that Microsoft has not published.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
