Block Microsoft 365 account from logging on Windows machine?

Question

Hello! How can I block a user from logging on Windows with Azure AD on our machines, but still allow it to use Microsoft 365?

 

Basically we have a service account that should only be accessed from iOS MDM devices by default. A way to exempt some Windows machines would be nice, but the preference is ban the account from Windows logon altogether. 

We use Microsoft 365 with Intune. All machines are managed.

 

Thanks in advance!

Answer 1

@CeciNestPasLegal, Thanks for posting in Q&A. For the policy, it only applies to specific editions and OS. Please ensure the affected device is supported.

Meanwhile, please ensure the value we set is with AzureAD\userUPN . And go to one affected device to check the Event log under Applications and Services Logs > Microsoft > Windows > DeviceManagement-Enterprise-Diagnostic-Provider > Admin to see if any error exists.

If there's any update, feel free to let us know.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Blocking him from signing in to windows is wil not deny the account of logging on to cloud apps from the windows platform on unmanaged devices or devices that have been signed in by a different user. You can start by blocking the account of logging into any cloud apps on a windows device by creating a conditional access policy scoped on the user for all apps as so:

Now, if you want to go further and keep the account from signing into your managed windows devices you can user the settings catalog use the Deny Local Log On setting. Make sure you specify the account correctly. And you can add multiple accounts there if you like. Screenshot:

Hope this helps.

Answer 3

Hi @CeciNestPasLegal ,

There's no native way to do this using Entra ID. Conditional Access will block the cloud app logins but not the local logins. You can, however, achieve this through Custom Configuration Profiles (CSPs) in Intune.

Resources:

• Restrict which users can logon into a Windows 10 device with Microsoft Intune
• Can we restrict AAD user logins to be from specific devices for better privileged account security?
• how to stop users from logging into a device except specific accounts
• How to block any Windows Logins from an AAD Users except on 1 specific computer?

Let me know if this helps and if you have further questions.

If the information helped you, please Accept the answer. This will help us and improve searchability for others in the community who may be researching similar questions.