Deny Local Log On for Azure AD accounts

Windows can be setup in shared PC or Kiosk mode. I have already written a blogpost about this. The aim is to provide a Windows experience for multiple users on one device, where the user may not even has his own (AAD) account.

Now on these devices you may want to restrict the ability to log in with certain accounts. If the device should be fully restricted for any domain/Azure AD accounts, you can follow this guide. This may be considered as a workaround, but I did not find a better solution to achieve it. It includes to create:

  • Azure AD group — that holds members which should be restricted from sign-in
  • Intune endpoint security profile — to add our group to the local guests group
  • Intune configuration policy — to set the “Deny Log On” setting for a specific security identifier (SID), in our case the guest users

Just create a normal Azure AD group, this may be assigned or dynamic. If you want to block all Azure AD users from signing in, define the rule for example: include all users except your backup user.

Azure AD group

The configuration is a settings catalog item “Deny Local Log On”, here we insert: *S-1–5–32–546 this is a well known SID which stands for the guest users. (see more)

Intune settings catalog

Last we will add our group to the local guests group with an endpoint security>account protection>Local user group membership profile.

Account protection profile

For the end user this will be the result, when trying to sign in:

Restricted sign-in
  • It may also make sense to leverage another local group instead of the guest users
  • From my experience it is not possible to add Azure AD group SID to the Deny Local Log On settings, maybe because this group is unknown (Azure AD Object ID to SID Converter)
  • Shared PC Guest accounts will not be prevented from sign-ins, even if you block the guest users SID


-- | #EnterpriseMobility #Security #MEM #ModernWorkplace

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store