Prevent signing in to a Windows laptop with a personal Microsoft account
Some students get around the rules you set with the Myndr Switch by signing in to the Windows laptop with a personal Microsoft account. This is easy to prevent by configuring in the Intune admin center that only a school account may be used to sign in on the school's laptops.
In the Intune admin center, go to:
As Platform, select Windows 10 and later. As Profile type, select Settings catalog and click Create at the bottom.
Give the new profile a name, e.g. "School login only", and click Next at the bottom.
Click + Add settings
Type "Microsoft account" in the search box and click Search.
In the categories found, click Accounts. 3 results appear; tick the following:
✅ Allow Microsoft Account Sign-In Assistant
✅ Allow Microsoft Account Connection
Now type "Accounts Block Microsoft Accounts" in the search box and click Search.
Select the category Local Policies Security Options and tick the only result:
✅ Accounts Block Microsoft Accounts
Now type "profile" in the search box and click Search.
Select the category Microsoft Edge and tick the following result:
✅ Configure whether a user always has a default profile automatically signed in with their work or school account
Now type "chrome" in the search box and click Search.
Select the category Google Google Chrome and tick the following result:
✅ Add restrictions on managed accounts (User)
Now click the cross in the top right above the Search button.
Choose the following, respectively
Name | Setting |
|---|---|
Accounts | |
Allow Microsoft Account Sign-In Assistant | Block |
Allow Microsoft Account Connection | Disabled (If your students sign in with a Microsoft account rather than their own school account, you must set this option to Enabled) |
**Local Policies Security Options ** | |
Accounts Block Microsoft Accounts | Users can't add or log on with Microsoft accounts |
Edge | |
Configure whether a user always has a default profile automatically signed in with their work or school account | Enabled |
Google Chrome | |
Add restrictions on managed accounts (User) | Enabled, and then select A Managed account must be a primary account and have no secondary accounts |
Click Next at the bottom and click Next again under Scope tags
Under "Included groups", click Add groups and select the device group(s) containing the student devices.
Click Next, check the settings and click Create
Intune will now distribute this setting to the student devices. From now on, those devices can only be signed in to with a school account.
Updated on: 03/11/2026
Thank you!