> ## Knowledge Base Index
> Fetch the complete knowledge base index at: https://help.myndr.nl/sitemap.xml
> Use this file to discover available pages before exploring further.
> Pure-Markdown content can be obtained by appending a '.md' suffix to the content URLs listed in the sitemap (without the trailing slash).

# Prevent signing in to a Windows laptop with a personal Microsoft account

|| The setting below is required for Myndr to work properly!
Some students get around the rules you set with the Myndr Switch by signing in to the Windows laptop with a personal Microsoft account. This is easy to prevent by configuring in the Intune admin center that only a school account may be used to sign in on the school's laptops.

In the Intune admin center, go to:

|| Devices > Windows > Configuration > ➕ Create > ➕ New policy
As **Platform**, select **Windows 10 and later**. As **Profile type**, select **Settings catalog** and click **Create** at the bottom.

Give the new profile a name, e.g. "School login only", and click **Next** at the bottom.

Click **+ Add settings**
Type "Microsoft account" in the search box and click **Search**.
In the categories found, click **Accounts**. 3 results appear; tick the following:
✅ **Allow Microsoft Account Sign-In Assistant**
✅ **Allow Microsoft Account Connection**

Now type "Accounts Block Microsoft Accounts" in the search box and click **Search**.
Select the category **Local Policies Security Options** and tick the only result:
✅ **Accounts Block Microsoft Accounts**

Now type "profile" in the search box and click **Search**.
Select the category **Microsoft Edge** and tick the following result:
✅ **Configure whether a user always has a default profile automatically signed in with their work or school account**

Now type "chrome" in the search box and click **Search**.
Select the category **Google Google Chrome** and tick the following result:
✅ **Add restrictions on managed accounts (User)**

Now click the cross in the top right above the Search button.

Choose the following, respectively

| Name | Setting |
| ---- |
| **Accounts** |  |
| Allow Microsoft Account Sign-In Assistant | **Block** |
| Allow Microsoft Account Connection | **Disabled** (If your students sign in with a Microsoft account rather than their own school account, you must set this option to **Enabled**) |
| **Local Policies Security Options ** |  |
| Accounts Block Microsoft Accounts | **Users can't add or log on with Microsoft accounts** |
| **Edge** |  |
| Configure whether a user always has a default profile automatically signed in with their work or school account | **Enabled** |
| **Google Chrome** |  |
| Add restrictions on managed accounts (User) | **Enabled**, and then select **A Managed account must be a primary account and have no secondary accounts** |

Click **Next** at the bottom and click **Next** again under Scope tags

Under "Included groups", click **Add groups** and select the device group(s) containing the student devices.

Click **Next**, check the settings and click **Create**

Intune will now distribute this setting to the student devices. From now on, those devices can only be signed in to with a school account.