To allow or block Microsoft account connections on managed Windows devices, create a Windows 10 and later Settings Catalog profile in Intune, configure Accounts > Allow Microsoft Account Connection, assign it to the intended targets, and check its deployment status after devices check in. The policy controls Microsoft account use for non-email-related connection authentication and services; it is device-scoped.
What the policy controls
Microsoft defines AllowMicrosoftAccountConnection as controlling whether a user may use a Microsoft account (MSA) for non-email-related connection authentication and services. It applies at the device level rather than the individual-user level. Microsoft lists Windows Pro, Enterprise, Education, and IoT Enterprise editions, including IoT Enterprise LTSC, with Windows 10 version 1507 and later. Microsoft’s Accounts Policy CSP reference documents the scope and supported editions.
As an Amazon Associate I earn from qualifying purchases.
The CSP value 1 means allowed and is the default; 0 means not allowed. In Intune’s Settings Catalog, the corresponding choices are Allow and Block. The CSP reference defines the values, while Microsoft’s device-restriction configuration reference identifies the Intune setting under Accounts as Allow Microsoft Account Connection.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Configure the setting in Intune
You need an Intune account with at least the built-in Policy and Profile Manager role. The profile applies when the targeted devices next check in for configuration updates.
#1 Best Overall
- 14" diagonal, 1366x768 resolution, HD BrightView LED, Glossy NON-TOUCH Display
- In the Microsoft Intune admin center, go to Devices > Manage devices > Configuration > Create > New policy.
- Choose Windows 10 and later as the platform and Settings catalog as the profile type.
- Name the profile, then open Configuration settings and select Add settings.
- Search for Allow Microsoft Account Connection. Add the setting from the Accounts category. Its CSP path is
Accounts/AllowMicrosoftAccountConnection. - Set the value to Allow to permit the covered use, or Block to prevent it.
- Continue through scope tags if your organization uses them. Assign the profile to the intended users or groups, review the configuration, and create the profile.
- After devices check in, open the profile’s reporting view and inspect the setting’s status for success, conflict, or error.
For the current catalog workflow, assignment behavior, check-in timing, and reporting, see Microsoft’s guide to configuring settings with the Intune Settings Catalog.
Choose the right policy value and targets
Use Allow or Block according to the intended account-use rules for the targeted devices. Because the setting is device-scoped, it can affect other accounts using the same device; assigning it to a user or group does not change the policy’s device-level scope. Microsoft’s Enterprise State Roaming guidance cautions that its MDM policies apply device-wide and recommends using them only on corporate-owned devices. That guidance is specific to its Enterprise State Roaming context, but the device-wide impact is relevant when deciding which managed devices to target. See Microsoft’s Enterprise State Roaming policy guidance.
Rank #2
- 256 GB SSD of storage.
- Multitasking is easy with 16GB of RAM
- Equipped with a blazing fast Core i5 2.00 GHz processor.
Do not assume that a Block value shown in a baseline is the general Windows default. Microsoft documents Block in its HoloLens 2 advanced security baseline; the Accounts Policy CSP lists Allow (1) as the default.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsCheck deployment and resolve conflicts
In the profile’s reporting view, inspect the per-setting status on affected devices. A conflict can occur when another configuration also sets this setting to a different value. Use Intune’s conflict reporting to identify overlapping policy assignments and align the intended value.
Rank #3
- WINDOWS 11 | STABLE PERFORMANCE: Powered by Intel Celeron N4020 processor and Windows 11 system, this laptop delivers stable performance for everyday computing tasks. It supports web browsing, online learning, document editing, email communication, and basic office work with optimized power efficiency, providing a practical and reliable experience for essential daily use for daily use.
- 15.6” FHD IPS DISPLAY: Features a 15.6-inch Full HD IPS display with narrow bezels, offering wider viewing angles and clearer image details compared to standard panels. The improved screen-to-body ratio enhances visual experience for study, reading, document work, and video playback, making it suitable for both productivity and entertainment use.
- 4GB DDR4 + 128GB eMMC STORAGE: Equipped with 4GB DDR4 memory and 128GB eMMC storage for everyday basics such as browsing, documents, email, and online learning platforms. The built-in TF card slot supports storage expansion up to 1TB, giving you more flexibility for files, photos, videos, and daily documents. TF card not included.
- CONNECTIVITY & PORTS: Includes 1× TF card slot, 2× USB 3.2 Gen1 ports, and 2× full-featured Type-C ports (USB 3.2 Gen1). The Type-C ports support data transfer, charging, and video output, enabling flexible connection with external devices such as monitors, storage, and peripherals for daily work and study use.
- LIGHTWEIGHT DESIGN | ONLINE COMMUNICATION: Designed with a slim, portable profile, this laptop is easy to carry for school, commuting, and travel. A built-in 1MP front camera supports online classes, video meetings, remote communication, and everyday conferencing. The 3300mAh battery works with the low-power system design to support practical daily use, while thermal optimization helps maintain quieter operation during extended tasks.
If you change the setting to Not configured in the Settings Catalog profile, that profile stops managing it. Another policy or the device user may then change the setting. Microsoft documents this Not configured behavior and reporting options in its Settings Catalog guide.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Keep this separate from the Sign-In Assistant service policy
AllowMicrosoftAccountConnection is not the same as AllowMicrosoftAccountSignInAssistant. The latter controls the Microsoft Account Sign-In Assistant service, wlidsvc. Microsoft warns that disabling that service can prevent Windows feature updates from being offered in some Windows 10 circumstances and can disrupt subscription activation or initial digital-license activation. Those documented consequences concern the service policy; they should not be attributed to the connection policy discussed here. Microsoft documents both policies in the Accounts Policy CSP.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
