Windows 11 SSO prompt: IT admins finally get control via Intune and Group Policy

Anyone managing Windows 11 24H2 or 25H2 in an Entra ID environment will recognise the scenario: an employee signs in on a new or freshly reset device, and almost immediately a dialog appears. 'Do you want to use your Windows sign-in credentials for Microsoft Teams, Outlook, and other apps?' The employee clicks 'No' or dismisses the window, and the day begins with a message to the helpdesk.

That prompt is not a bug. Microsoft introduced it deliberately as part of compliance with the EU Digital Markets Act, the DMA. Yet it is a persistent source of confusion for end users and an unnecessary burden for IT support. With the July 2026 update, Microsoft finally provides a formal management option: the AutoAcceptSsoPermission registry key, available via KB5101650.

Why did the SSO prompt appear in the first place?

The European Digital Markets Act requires so-called 'gatekeepers', large technology companies that function as access points for markets and consumers, to allow competitors fair access. For Microsoft this meant that Windows may not automatically ensure seamless sign-in to its own services such as Teams, Outlook, and OneDrive. Users in the European Economic Area must explicitly consent before their Windows credentials are passed to other Microsoft apps.

The result: on every new installation or after a device reset, the consent prompt appears. For home users this is relatively one-time. For organisations that roll out multiple devices daily or where employees regularly receive new hardware, helpdesk tickets accumulate quickly. The prompt is technically correct but a poor user experience without context.

What does the AutoAcceptSsoPermission setting do?

The AutoAcceptSsoPermission registry key gives IT administrators the ability to automatically accept the SSO consent prompt on managed devices. When the key is set, Windows silently uses the user's sign-in credentials for supported Microsoft apps and services without showing a dialog. The setting works as follows:

Registry path: HKLM\SOFTWARE\Policies\Microsoft\Windows\AAD. Value: AutoAcceptSsoPermission, type DWORD, set to 1. Applies only to managed devices enrolled in Entra ID. Personal Microsoft accounts (MSA) continue to see the regular prompt regardless of the setting. The key has no effect on devices not managed by the organisation.

The setting replaces the choice that would otherwise be presented to the user. Organisations deploying this key make the decision on behalf of their employees that SSO is permitted on managed devices. That is a deliberate choice that aligns with the policy already enforced via Conditional Access and Entra ID.

Which Windows 11 versions are required?

The AutoAcceptSsoPermission setting is available from the July 2026 security update for Windows 11, specifically via KB5101650 for versions 24H2 and 25H2. Devices on Windows 11 23H2 or earlier do not receive the setting and continue to display the prompt regardless of whether the registry key is configured.

This is an additional reason to steer towards a current Windows 11 version across the organisation. Devices on 23H2 reach end-of-support by late 2025, and with both the SSO management option and the broad security benefits of 24H2, including improved kernel isolation and Virtualisation Based Security, migrating to the latest version is more than justified.

How do you deploy this via Intune?

There is currently no dedicated Settings Catalog entry in Intune for AutoAcceptSsoPermission. This means the registry key must be deployed via alternative methods. The most common approach is an Intune platform script or an Intune Remediation.

Using an Intune Windows platform script, you can run a PowerShell script that creates or updates the registry key. A simple script looks like this: New-Item -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\AAD' -Force; Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\AAD' -Name 'AutoAcceptSsoPermission' -Value 1 -Type DWord. This script runs once as system and remains in effect until the key is actively removed.

A second option is an Intune Remediation, where a detection script checks whether the key is present and correctly set, and a remediation script enforces the value if it is not. The advantage of Remediations over a platform script is that Intune periodically checks whether the setting is still correct and automatically corrects it if a user or another process has changed the key.

Organisations that continue to use on-premises Group Policy for Windows settings can simply include the registry path in a GPO via Computer Configuration > Preferences > Windows Settings > Registry. The key is then applied via Group Policy processing to domain-joined machines that are also registered with Entra ID.

Are there considerations or risks?

The setting has a limited attack surface: it works exclusively on managed devices in combination with Entra ID accounts. An attacker trying to connect via an unmanaged device will not encounter the automatic acceptance. That said, there are a few points worth documenting before deployment.

First, DMA compliance. Microsoft has designed the setting so that IT organisations can grant consent on behalf of the organisation, similar to other administrator decisions about app permissions. As long as the setting is restricted to managed devices and documented in your security policy, this is legally correct use.

Second, the scope of the key deserves attention on devices also used by external parties, such as shared workstations or contractor devices. On such devices it may be undesirable for SSO to be automatically accepted for an external user who signs in occasionally. The recommendation is to restrict the Intune group receiving the setting to permanent employee devices and leave shared devices out of scope.

Third, suppressing the setting on a device or for a specific user group is straightforward by leaving the DWORD value unconfigured or setting it to 0. There is no lock that makes rollback difficult.

What should you do this week?

Two actions for the next seven days. First, check which Windows 11 versions are active in your environment. This is easily visible in the Intune admin centre under Devices > Reports > Version compliance. All devices on 24H2 or 25H2 that have received KB5101650 are ready for the setting.

Then set up the Intune platform script or a Remediation and assign it to a test group of ten to twenty devices. After three days, verify that the registry key has been created and that users no longer see the SSO prompt. Then expand the assignment to the full fleet of 24H2 and 25H2 devices.

Want support setting up the Intune configuration, arranging a detection and remediation strategy for Windows settings, or planning a Windows 11 version update for your organisation? Zarioh helps IT teams with the complete Microsoft 365 environment. Contact us for a no-obligation conversation.