Windows 11 Adds a Registry Policy for Automatic SSO Approval: How IT Admins Can Configure It

Microsoft’s July 2026 Windows 11 monthly security update introduced an administrative option for controlling the single sign-on (SSO) permission prompt on managed devices. The new registry policy allows an organization to automatically accept SSO permissions for eligible Windows 11 devices that use Microsoft Entra ID accounts.

The change addresses a sign-in behavior introduced to give users more explicit control over how their Windows credentials are used by other Microsoft applications and services. In the European Economic Area (EEA), Windows asks users whether they want to use their Windows sign-in credentials to access additional Microsoft apps and services. Some enterprise administrators wanted a way to avoid repeated consent prompts on devices where the organization already manages identity and sign-in policy.

What does the new Windows 11 SSO policy do?

When configured, the policy automatically accepts the SSO permission on eligible managed devices. Users can then access supported Microsoft apps and services with the credentials from their Windows sign-in without being asked to approve the same SSO permission prompt.

This is an administrative control for the managed-device experience. It does not disable authentication, remove the need for valid credentials, or turn off Microsoft Entra ID security controls. It changes how the SSO permission is accepted in the supported enterprise scenario.

Supported Windows versions and limitations

• Supported operating systems: Windows 11 version 24H2 and version 25H2.
• Required servicing: the July 2026 monthly security update or later. Microsoft identifies the July 2026 update as KB5101650 for this capability.
• Device scope: managed enterprise devices using Microsoft Entra ID accounts.
• Personal Microsoft accounts: the policy does not suppress prompts for personal Microsoft account scenarios.
• Unmanaged devices: not affected; users continue to receive the normal permission prompts.

Registry path and value

The policy is configured under the following registry key:

Registry path:
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\AAD

Value name: AutoAcceptSsoPermission
Value type: REG_DWORD
Value data: 1

Setting AutoAcceptSsoPermission to 1 enables automatic acceptance of SSO permissions in the supported scenario. Deploy the value through an enterprise management tool rather than asking users to edit the registry manually.

Deploy the policy to managed Windows devices

Method 1: Create a registry file for controlled testing

For a small pilot, an administrator can create a .reg file and import it on a test device with appropriate administrative permissions:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\AAD]
"AutoAcceptSsoPermission"=dword:00000001

Save the content as Enable-AutoAcceptSsoPermission.reg. Review the file before importing it, and test with a non-production device first.

Method 2: Configure it with PowerShell

Run the following command in an elevated PowerShell session on a pilot device:

$Path = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\AAD"

New-Item -Path $Path -Force | Out-Null

New-ItemProperty `
  -Path $Path `
  -Name "AutoAcceptSsoPermission" `
  -PropertyType DWord `
  -Value 1 `
  -Force

This creates the policy key if it does not exist and writes the DWORD value. For production fleets, deploy the same configuration through your approved endpoint-management platform so that the setting remains centrally managed.

Method 3: Deploy through Group Policy Preferences

1. Open Group Policy Management on an administrative workstation.
2. Create or edit a GPO linked to the OU containing the intended Windows 11 pilot computers.
3. Navigate to Computer Configuration → Preferences → Windows Settings → Registry.
4. Create a new Registry Item with action Update.
5. Set Hive to HKEY_LOCAL_MACHINE.
6. Set Key Path to SOFTWARE\Policies\Microsoft\Windows\AAD.
7. Set Value name to AutoAcceptSsoPermission, Value type to REG_DWORD, and Value data to 1.
8. Apply the GPO to the pilot OU and verify policy application before expanding deployment.

Method 4: Deploy through Microsoft Intune

Use an Intune configuration profile or remediation approach that can write the required registry value. For a simple pilot, a PowerShell script can create the key and DWORD value shown above. Assign it to a device group containing only eligible Windows 11 24H2 and 25H2 devices, monitor deployment status, and expand the assignment after validation.

Microsoft also lists Configuration Manager and other management tools that support registry policy deployment as supported delivery options. Choose one authoritative deployment method for the setting to avoid conflicting configuration from multiple tools.

Verify that the registry policy is applied

On a pilot device, open PowerShell and query the registry value:

Get-ItemProperty `
  -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\AAD" `
  -Name "AutoAcceptSsoPermission"

Confirm that AutoAcceptSsoPermission returns 1. If the value is missing, verify the device assignment, GPO scope or Intune script status, and confirm the device has the required Windows update.

Then test the sign-in experience using an eligible Microsoft Entra ID work or school account and the relevant Microsoft application. Validate that the expected SSO permission prompt behavior has changed. Also test a personal Microsoft account or unmanaged device, where the normal prompt behavior should remain unaffected.

Security and rollout considerations

Automatic SSO permission acceptance reduces user prompts, but it also changes the consent experience on managed devices. Before enabling it broadly, confirm that the organization’s identity, device-management, and access policies are appropriate for the affected device population.

• Scope the configuration to organization-managed devices that need this behavior.
• Use a pilot deployment group before assigning the setting to the full fleet.
• Document the reason for enabling automatic acceptance and the change owner.
• Keep authentication controls such as Conditional Access and multifactor authentication aligned with organizational requirements.
• Monitor sign-in behavior and help-desk reports after rollout.

Microsoft says it is evaluating additional administrative controls and transparency features for authentication experiences. Administrators should consult the official Windows IT Pro Blog for later changes rather than assuming this single value controls every future SSO prompt.

Final thoughts

The AutoAcceptSsoPermission registry policy gives IT teams a targeted way to streamline SSO permission prompts on supported, managed Windows 11 24H2 and 25H2 devices using Microsoft Entra ID. Deploy it through GPO, Intune, Configuration Manager, or another supported management tool, but start with a pilot and verify both the registry state and the actual sign-in experience. Personal accounts and unmanaged devices remain outside the policy’s documented scope.

References and official documentation

1. Microsoft Windows IT Pro Blog — Now available: Admin control for SSO prompts in Windows
2. Microsoft Support — July 2026 monthly security update information
3. Microsoft Learn — Policy configuration service provider
4. Microsoft Learn — Group Policy overview