How to Completely Disable ‘Microsoft Accounts’ (Block Microsoft Accounts) via Group Policy in Windows 11

By default, Windows 11 heavily encourages users to sign in using a Microsoft Account (an online account such as Outlook, Hotmail, or Live). While a Microsoft Account provides seamless synchronization of settings, Edge bookmarks, and OneDrive files across multiple devices, it also inherently ties the local machine to Microsoft’s cloud infrastructure. In enterprise environments, strict regulatory compliance scenarios, or highly secure air-gapped deployments, authenticating via an external cloud provider is strictly prohibited. Organizations require users to authenticate exclusively against a local Active Directory domain or a localized offline account to maintain absolute control over identity management and telemetry.

This guide explains how to completely disable the use of Microsoft Accounts system-wide using the Group Policy Editor in Windows 11, forcing the operating system to rely solely on local or domain authentication.

Block Microsoft Accounts via Group Policy

To enforce a strict block that prevents users from adding new Microsoft Accounts or logging in with existing ones, we must deploy a security policy. Note that this requires Windows 11 Pro, Enterprise, or Education editions.

1. Log into Windows 11 with an Administrator account.
2. Press the Windows Key + R to open the Run dialogue box.
3. Type secpol.msc (or gpedit.msc) and press Enter to launch the Local Security Policy editor.
4. In the left-hand navigation pane, strictly follow this exact path:

   Security Settings > Local Policies > Security Options

5. In the right-hand pane, scroll down and locate the policy named Accounts: Block Microsoft accounts.
6. Double-click the policy to open its configuration window.
7. Open the dropdown menu and select Users can’t add or log on with Microsoft accounts.
8. Click Apply, then click OK.

Verify the Configuration Lockdown

To enforce the change immediately across the system without requiring a full reboot, open an elevated Command Prompt and execute gpupdate /force.

To verify the restriction is active, navigate to Settings > Accounts > Your info. The option to “Sign in with a Microsoft account instead” will be completely absent or greyed out. Furthermore, if a user attempts to add an account via Settings > Accounts > Email & accounts, the operating system will return an error stating that this feature has been blocked by the administrator. The endpoint is now cryptographically isolated from Microsoft’s consumer identity infrastructure, ensuring all authentications remain local to your managed domain.