How to Completely Disable ‘Account Info’ Access via Group Policy in Windows 11

Windows 11 includes a privacy-centric permission system that governs which installed applications are allowed to access your “Account Info.” This includes your Microsoft account name, profile picture, and other identifying metadata associated with your local or domain login. By default, Windows allows users to manage these permissions on a per-app basis. However, in corporate environments, strictly regulated healthcare settings, or shared kiosk deployments, permitting any third-party application to silently request and read the logged-in user’s identifying metadata is a violation of the principle of least privilege and a potential privacy risk.

This guide explains how to completely disable Account Info access system-wide using the Group Policy Editor in Windows 11, enforcing a strict block that blinds all applications to the user’s profile data.

Disable Account Info Access via Group Policy

To enforce a strict block that overrides user preferences and explicitly denies all Universal Windows Platform (UWP) apps access to Account Info, we must deploy an administrative template. Note that this requires Windows 11 Pro, Enterprise, or Education editions.

1. Log into Windows 11 with an Administrator account.
2. Press the Windows Key + R to open the Run dialogue box.
3. Type gpedit.msc and press Enter to launch the Local Group Policy Editor.
4. In the left-hand navigation pane, strictly follow this exact path:

   Computer Configuration > Administrative Templates > Windows Components > App Privacy

5. In the right-hand pane, locate the policy named Let Windows apps access account information.
6. Double-click the policy to open its configuration window.
7. Select the radio button next to Enabled. (Note: You must Enable the policy object to configure the restriction).
8. In the “Options” panel below, locate the “Default for all apps” dropdown menu and change it to Force Deny.
9. Click Apply, then click OK.

Verify the Configuration Lockdown

To enforce the change immediately across the system without requiring a full reboot, open an elevated Command Prompt and execute gpupdate /force.

To verify the restriction is active, navigate to Settings > Privacy & security > Account info. The master toggle switch for “Account info access” will be forced to the Off position and entirely greyed out. A message stating “Some of these settings are managed by your organization” will be displayed at the top of the window. No application on the system can now query or read the profile metadata of the currently logged-in user.