Block adding Microsoft accounts in Windows 11

This article shows you how to prevent a Microsoft account from being added as a user account in Windows 11.

Using a Microsoft account offers several benefits, such as seamless integration with various services and easy access to cloud storage. However, some users prefer a more controlled environment, where they can control exactly which accounts are used on their system. By blocking Microsoft accounts, users can maintain this control and ensure that only local accounts are used.

There are several ways in which adding a Microsoft account can be blocked. The first way is via a local security policy, which has the advantage that you can enforce it via policy settings, for example via a domain in a work or school environment.

The second way is through the Windows registry. This may be more useful in a local environment such as a home computer. I explain both ways in this article.

Block adding Microsoft accounts in Windows 11

Via Local Security Policy

As indicated, the first way is through a local security policy.

1. Right-click on the Start button.
2. Then click “run” in the menu.
3. In the run window, type: secpol.msc

In the local security policy, go to: Local policies > Security options > Accounts: Block Microsoft accounts. Double-click the policy to change.

This setting prevents the Settings app from being used to add a Microsoft account for single sign-on (SSO) authentication for Microsoft services and some background services, or from using a Microsoft account for single sign-on to other applications, or services.

If this setting is enabled, there are two options:

• Users can't add Microsoft accounts: This means existing linked accounts can still sign in to the device (and appear on the sign-in screen). However, users cannot use the Settings app to add new linked accounts (or link local accounts to Microsoft accounts).
• Users can't add or sign in to Microsoft accounts: This means users can't add new linked accounts (or link local accounts to Microsoft accounts) or use existing linked accounts through Settings.

This setting does not affect adding a Microsoft account for application authentication. For example, if this setting is enabled, a user can still provide a Microsoft account for authentication with an application such as Mail, but the user cannot use the Microsoft account for single sign-on authentication for other applications or services (with other words, the user is prompted for authentication for other applications or services).

By default, this setting is Not defined.

Via Windows registry

To begin open the Windows registry. Go to key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System

Double-click on the value “NoConnectedUser”. Change the value to:

1 – To prevent Microsoft accounts from being added.

3 – To prevent Microsoft accounts from being added and signed in.

0 – To disable the policy and allow the use of Microsoft accounts.

If you don't see the “NoConnectedUser” value, create it by adding a new “DWORD 32-bit” value.

I hope to have informed you with this. Thank you for reading!