Solved How can I prevent W11Pro users from signing into a personal Microsoft account, OneDrive, etc?

Scenario: Each Windows 11 Pro PC in a small 4 seat office has two Local users:

• PCADMIN has admin privs
• (Username like "Office" or "Bookkeeping") has Regular privs

The latter User has a Microsoft 365 Business Standard account for company email, the Office Suite, and access to a single Sharepoint folder shared by the boss for document collaboration (which I believe requires that OneDrive be signed into the MS365 biz account).

The challenge is Microsoft pushing users toward signing in with a Microsoft account, displaying a tempting "Backup Files" button in File Explorer, encouraging use of a personal OneDrive, and the dastardly "Allow my organization to manage my device" option. It is like an octopus constantly trying to grab the user.

The old GPO "Accounts: Block Microsoft accounts" seems to just remove any Microsoft accounts from the Sign-in Screen; it definitely does not prevent the user from signing into OneDrive.

Any solutions?

There's a GPO to disable OneDrive access (separate from banning MS Accounts):

depends on how much you want to block. in addition to @garlin response, you can also block Microsoft accounts via secpol

The GPO templates for OneDrive that come with Windows are outdated. If you grab the new templates (OneDrive.admx and the corresponding .adml) from the folder where OneDrive is installed and add them to your policy store, you get a lot more options, including:

Thanks to all three of you for responding!

The tutorial @garlin referred to says to go to this section in GPEDIT:


whereas

@pseymour points to this section in his screenshot:


Am I correct in guessing that by adding the OneDrive admx/l files per @pseymour 's suggestion this gave OneDrive its own section, and I can use GPOs in either section?

@dacrone, my concern about using "Accounts: Block Microsoft Accounts" is an article that Google found, where enabling the GPO for that in


will disable "Windows 10 Synchronization". I don't know if that applies to Windows 11 or to OneDrive, but if the latter I definitely need the MS365 OneDrive to sync the Sharepoint folder.

Otherwise, the list of what this SECPOL prevents is compelling.



I'm always looking out for unintended consequences.

Thank you again.

@pseymour's ADMX template adds on extra domain-level settings. The lowest level "Windows Components > OneDrive" still applies as an absolute on/off switch, if needed.

If your client wants to use O365 services, allowing MSA sign-on is mandatory. But OneDrive service can be disabled on its own, regardless of whether they're logged on with MSA. For the domain level controls, you need to know what type of domain are they signed up for (tenant vs. Personal) to see if the policy is applicable or not.

@garlin, thank you for the clarification. The only O365 service my client needs is OneDrive/Sharepoint. They will not be using Entra ID.

An earlier test today revealed that even after enabling "Account:Block Microsoft Accounts" using GPEDIT I was able to perform the initial OneDrive setup, So am I correct in understanding that tasks like signing into OneDrive or signing into Word will NOT be prevented if I enable that GPO? When you wrote, "If your client wants to use O365 services, allowing MSA sign-on is mandatory", please cite an example of what services will be impacted.

I'm presuming for Sharepoint, they're using their MS Account to get access since they're not Entra ID. So you can't disable MS Account for them.

garlin said:

@pseymour's ADMX template adds on extra domain-level settings. The lowest level "Windows Components > OneDrive" still applies as an absolute on/off switch, if needed.

If your client wants to use O365 services, allowing MSA sign-on is mandatory. But OneDrive service can be disabled on its own, regardless of whether they're logged on with MSA. For the domain level controls, you need to know what type of domain are they signed up for (tenant vs. Personal) to see if the policy is applicable or not.

Click to expand...

They're not domain-level settings, whatever that means. They control the OneDrive client whether you're connected to a domain or not.

Solution possibly found

I enabled this GPO.

Local Group Policy > Computer Configuration > Administrative Templates > Windows Components > Microsoft Account > Block all consumer Microsoft account user authentication.

I also have configured this GPO:
Local Computer Policy > Computer Configuration > Windows Setup > Security Settings > Local Policies > Security Options > Accounts: Block Microsoft Accounts = Users can't add or log on with Microsoft accounts.
I did this because it prevents someone from creating a new Microsoft User Profile. If this GPO is not enabled, you can create one but then that user cannot sign in because of the "Block all consumer..." GPO.

As a result, if a user tries to sign into OneDrive using an MS account they're blocked. They CAN sign in to OneDrive if they use an MS365 for Biz account, which is what I want. User compliance with other prompts/promotions to sign in or switch to using a Microsoft account are also blocked.

I welcome other people testing to verify that this works and to find any unintended consequences.