Microsoft accounts (original) (raw)

Understand how a Microsoft account works to enhance security and privacy for users and how you can manage consumer account types in your organization.

What is a Microsoft account?

Microsoft sites, services, properties, and computers running Windows 10 can use a Microsoft account as a way to identify a user. A Microsoft account previously was called a Windows Live ID. A Microsoft account has user-defined secrets and consists of a unique email address and a password.

When a user signs in with a Microsoft account, the device is connected to cloud services. The user can share many of their settings, preferences, and apps across devices.

How a Microsoft account works

A user can use a Microsoft account to sign in to websites that support this service by using a single set of credentials. A user's credentials are validated by a Microsoft account authentication server that's associated with a website. Microsoft Store is an example of this association. When a new user signs in to a website that's enabled to use Microsoft accounts, the user is redirected to the nearest authentication server, which asks for a username and password. Windows uses the Schannel Security Support Provider to open a Transport Level Security/Secure Sockets Layer (TLS/SSL) connection for this function. Users have the option to use Credential Manager to store their credentials.

When a user signs in to a website that's enabled to use a Microsoft account, a time-limited cookie is installed on their computer. The cookie includes a triple-DES encrypted ID tag. The encrypted ID tag has been agreed upon between the authentication server and the website. The ID tag is sent to the website, and the website places another time-limited encrypted HTTP cookie on the user’s computer. While the cookie is valid, the user isn't required to enter a username and password. If a user actively signs out of their Microsoft account, these cookies are removed.

Note

Local Windows account functionality is still an option you can use in a managed environment.

How a Microsoft account is created

To prevent fraud, the Microsoft system verifies a user's IP address when the user creates a Microsoft account. A user who tries to create multiple Microsoft accounts by using the same IP address is stopped from creating more accounts. Microsoft accounts aren't designed to be created in batches, such as for a group of domain users in your enterprise.

To create a Microsoft account, a user has two options:

How Microsoft account information is safeguarded

Credential information is encrypted twice. The first encryption is based on the account password. Credentials are encrypted again when they're sent across the internet. The credential data that's stored isn't available to other Microsoft services or to non-Microsoft services.

Microsoft account security information

A user can add security information to their Microsoft account through the Accounts interface on computers running supported versions of Windows. In Accounts, the user can update the security information that they provided when they created their account. This security information includes an alternate email address or phone number so that if their password is compromised or forgotten, a verification code can be sent to verify their identity. A user can potentially use their Microsoft account to store corporate data on a personal OneDrive or email app. A safe practice is for the account owner to keep this security information up-to-date.

Microsoft accounts in the enterprise

Although the Microsoft account was designed to serve consumers, you might have situations in which your domain users might benefit by using their personal Microsoft account in your enterprise. The following list describes some advantages:

Manage Microsoft accounts in the domain

Depending on your IT and business models, introducing Microsoft accounts into your enterprise might add complexity or it might provide solutions. You should address the following considerations before you allow the use of these account types in your enterprise:

Restrict the use of Microsoft accounts

The following Group Policy settings help control the use of Microsoft accounts in the enterprise:

Apps and services: Block Microsoft account user authentication

This setting controls whether a user can provide a Microsoft account for authentication for an app or service.

If this setting is enabled, all apps and services on a device are prevented from using a Microsoft account for authentication. This setting applies both to existing device users and to any new users.

Any app or service that has already authenticated a user who used a Microsoft account isn't affected by enabling this setting until the authentication cache expires. We recommend that you enable this setting before any user signs in to a device to prevent cached tokens from authenticating a Microsoft account.

If this setting is disabled or not configured, apps and services can use a Microsoft account for authentication. This setting is disabled by default.

This setting doesn't affect whether a user can sign in to a device by using a Microsoft account or the ability of a user to provide a Microsoft account via the browser for authentication with a web-based app.

The path to this setting is Computer Configuration\Administrative Templates\Windows Components\Microsoft account.

Accounts: Block Microsoft accounts

This setting prevents using the Settings app to add a Microsoft account for single sign-on authentication for Microsoft services and some background services or using a Microsoft account for single sign-on to other apps or services.

If this setting is enabled, a user has two options:

This setting doesn't affect adding a Microsoft account for app authentication. For example, if this setting is enabled, a user can still provide a Microsoft account for authentication with an app like Mail, but the user can't use the Microsoft account for single sign-on authentication for other apps or services. For other apps and services, the user is prompted to authenticate.

This setting isn't configured by default.

The path to this setting is Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options.

Configure connected accounts

A user can connect a Microsoft account to their domain account and sync the settings and preferences between the accounts. By syncing settings and preferences between accounts, the user sees the same desktop background, app settings, browser history and favorites, and other Microsoft account settings on their other devices.

Disconnect a connected account

A user can disconnect a Microsoft account from their domain account at any time: In PC settings, select Users > Disconnect > Finish.

Note

Connecting a Microsoft account to a domain account might limit access to some high-privileged tasks in Windows. For example, Task Scheduler evaluates the connected Microsoft account for access and fails. In this scenario, the account owner should disconnect the account.

Provision Microsoft accounts in the enterprise

A Microsoft account is a private user account. Microsoft doesn't provide a way to provision Microsoft accounts for an enterprise. Enterprises should use domain accounts.

Audit account activity

Because a Microsoft account is internet-based, Windows doesn't have a way to audit a Microsoft account unless the account is associated with a domain account. You can't audit the activity of accounts that aren't associated with your domain because a user can disconnect the account or leave the domain at any time.

Reset a password

Only the owner of a Microsoft account can change the password that's associated with the account. A user can change the password for their Microsoft account in the Microsoft account sign-in portal.

Restrict app installation and usage

Within your organization, you can set application control policies to regulate app installation and usage for Microsoft accounts. For more information, see AppLocker and Packaged apps and packaged app installer rules in AppLocker.

See also