The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →For assigned, one-to-one Windows education devices, configure Intune’s Enable Web Sign In For Primary User policy to let users authenticate through a federated identity provider. In the Settings Catalog, enable Is Education Environment and Enable Web Sign In For Primary User, then allow the domains the identity-provider sign-in flow needs.
This is not the shared-device configuration: Microsoft documents a separate Enable Web Sign In setting for shared devices, which have no primary user. Choose the policy based on how the device is assigned, not merely because both flows use a browser-based sign-in.
As an Amazon Associate I earn from qualifying purchases.
Confirm the device and identity prerequisites
Microsoft’s education guidance covers federated sign-in on Windows 11 SE 22H2 and Windows 11 Pro Education or Education 22H2 with KB5022913 or later. Check the device’s edition, build, and support lifecycle before rollout; these requirements and supported configurations can change. The device must have internet connectivity because authentication takes place online.
Each user needs an account with the third-party identity provider and a matching Microsoft Entra ID account, with licenses assigned. Confirm these prerequisites before applying the policy, and verify that the identity provider’s sign-in flow can reach its required domains.
#1 Best Overall
- 14" diagonal, 1366x768 resolution, HD BrightView LED, Glossy NON-TOUCH Display
See Microsoft’s federated sign-in guidance for Windows devices for the applicable editions and deployment details.
Configure the primary-user policy in Intune
- In the Intune admin center, create a new policy under Devices > Configuration and choose the Windows 10 and later platform and Settings catalog profile type.
- In the settings picker, add Education > Is Education Environment and set it to Enabled.
- Add Federated Authentication > Enable Web Sign In For Primary User and set it to Enabled.
- Add Authentication > Configure Web Sign In Allowed Urls. Enter the domains needed during the identity provider’s sign-in and redirect flow, with each domain in its own Settings Catalog row.
- If the sign-in process requires webcam access, add Authentication > Configure Webcam Access Domain Names and enter the domains that need that access. Leave this setting out if webcam access is not part of the flow.
- Complete the policy, assign it to a group containing the target devices or users, and monitor deployment and sign-in results.
Microsoft’s example allowed-domain entries include samlidp.clever.com, clever.com, and mobile-redirector.clever.com. These are examples for a particular identity-provider flow, not universal values. Determine the domains for your own provider by checking its documented requirements and the actual redirects users encounter.
Rank #2
- 256 GB SSD of storage.
- Multitasking is easy with 16GB of RAM
- Equipped with a blazing fast Core i5 2.00 GHz processor.
Choose the right sign-in scenario
| Device scenario | Policy approach | Primary-user behavior |
|---|---|---|
| Assigned 1:1 education device | Enable Is Education Environment and Enable Web Sign In For Primary User; configure required allowed domains. | The first federated user to sign in becomes the primary user. |
| Shared device | Use the separate Enable Web Sign In configuration and the shared-device settings in Microsoft’s education guidance. | There is no primary user; by default, the device shows the last user. |
Microsoft explicitly distinguishes these configurations. Do not apply the primary-user setting to shared devices by assumption. The general Web Sign-In documentation describes the broader feature and its credential-provider behavior.
Free tools Windows power users keep installed
One-click scans. No signup required.
Use OMA-URI or a provisioning package instead
Custom OMA-URI policy
If you need a custom policy rather than the Settings Catalog, Microsoft documents these OMA-URI settings for the primary-user scenario:
Rank #3
- WINDOWS 11 | STABLE PERFORMANCE: Powered by Intel Celeron N4020 processor and Windows 11 system, this laptop delivers stable performance for everyday computing tasks. It supports web browsing, online learning, document editing, email communication, and basic office work with optimized power efficiency, providing a practical and reliable experience for essential daily use for daily use.
- 15.6” FHD IPS DISPLAY: Features a 15.6-inch Full HD IPS display with narrow bezels, offering wider viewing angles and clearer image details compared to standard panels. The improved screen-to-body ratio enhances visual experience for study, reading, document work, and video playback, making it suitable for both productivity and entertainment use.
- 4GB DDR4 + 128GB eMMC STORAGE: Equipped with 4GB DDR4 memory and 128GB eMMC storage for everyday basics such as browsing, documents, email, and online learning platforms. The built-in TF card slot supports storage expansion up to 1TB, giving you more flexibility for files, photos, videos, and daily documents. TF card not included.
- CONNECTIVITY & PORTS: Includes 1× TF card slot, 2× USB 3.2 Gen1 ports, and 2× full-featured Type-C ports (USB 3.2 Gen1). The Type-C ports support data transfer, charging, and video output, enabling flexible connection with external devices such as monitors, storage, and peripherals for daily work and study use.
- LIGHTWEIGHT DESIGN | ONLINE COMMUNICATION: Designed with a slim, portable profile, this laptop is easy to carry for school, commuting, and travel. A built-in 1MP front camera supports online classes, video meetings, remote communication, and everyday conferencing. The 3300mAh battery works with the low-power system design to support practical daily use, while thermal optimization helps maintain quieter operation during extended tasks.
| OMA-URI | Data type and value | Purpose |
|---|---|---|
./Vendor/MSFT/Policy/Config/Education/IsEducationEnvironment |
Integer: 1 |
Marks the configuration as an education environment. |
./Vendor/MSFT/Policy/Config/FederatedAuthentication/EnableWebSignInForPrimaryUser |
Integer: 1 |
Enables federated Web Sign-In for the primary user. |
./Vendor/MSFT/Policy/Config/Authentication/ConfigureWebSignInAllowedUrls |
String: semicolon-separated domain list | Allows the domains needed for the sign-in flow. |
./Vendor/MSFT/Policy/Config/Authentication/ConfigureWebCamAccessDomainNames |
Optional string: semicolon-separated domain list | Allows webcam access for specified domains when required. |
Provisioning package
Microsoft also documents provisioning-package settings under Education/IsEducationEnvironment, FederatedAuthentication/EnableWebSignInForPrimaryUser, and Policies/Authentication for allowed URLs and webcam-access domains. For Windows 11 22H2 provisioning during OOBE, Microsoft notes an issue fixed by KB5020044; check the applicable guidance and build before using this deployment path.
Plan for online sign-in and credential-provider behavior
Web-based authentication cannot complete when the device is offline. General Web Sign-In does not support cached credentials for offline sign-in. Also, once general Web Sign-In is enabled, Microsoft says it becomes the default credential provider for new users signing in to the device. The ADMX-backed DefaultCredentialProvider policy can change that default. Review the Web Sign-In configuration guidance before changing credential-provider behavior.
Troubleshoot failed sign-ins
- A domain cannot be reached: Inspect the sign-in and redirect path, then compare the domains it uses with Configure Web Sign In Allowed Urls. Do not assume Microsoft’s sample domains apply to your identity provider.
- The user cannot complete sign-in offline: Restore internet access; this flow does not provide cached-credential sign-in.
- A shared device was configured as a primary-user device: Replace the primary-user configuration with the separate shared-device setup, including the applicable SharedPC settings in Microsoft’s education guidance.
- PIN reset has a separate domain issue: Microsoft’s PIN reset guidance discusses allowed domains for federated PIN-reset flows and lists
login.microsoftonline.usas a workaround for a known Azure US Government cloud PIN-reset issue. That is PIN-reset troubleshooting context, not a universal domain to add for primary-user sign-in.
Check Windows 11 SE lifecycle implications
Microsoft’s federated sign-in guidance states that Windows 11 SE support ends in October 2026. Organizations deploying this configuration on SE devices should account for that lifecycle date when planning device support and migration. Verify the current wording and lifecycle information in Microsoft’s education guidance.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
