Microsoft has shipped a registry-based policy with the July 2026 cumulative update for Windows 11 that allows IT administrators to automatically accept single sign-on (SSO) permission prompts on managed devices. The update, KB5101650, applies to Windows 11 versions 24H2 and 25H2, and it targets a specific class of pop-up that asks users whether they want to reuse their work or school identity to sign into other Microsoft applications and services.

The change is small in scope but significant for enterprise environments, especially those operating in the European Economic Area (EEA), where the prompts have been appearing since Microsoft retooled the Windows sign-in experience to give users more control over account reuse.

A very specific registry tweak

When enabled, the policy tells Windows to automatically accept the SSO permission on behalf of the organization. The configuration lives in a single registry value:

  • Path: HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows\\AAD
  • Value name: AutoAcceptSsoPermission
  • Type: DWORD
  • Data: 1

Getting the path right is critical. The value goes under the Windows\\AAD subtree, not the shorter HKLM\\SOFTWARE\\Policies\\Microsoft\\AAD path. A misplaced entry will appear valid in Registry Editor but won’t change the sign-in behavior.

Only devices that have installed the July 2026 security update or a later cumulative update that contains the same code change support the policy. Since updates are cumulative, any subsequent monthly patch will include the functionality once it lands.

Enterprise-only: who actually benefits

The control is designed for managed enterprise PCs that use Microsoft Entra ID (formerly Azure AD) work or school accounts. Personal Microsoft accounts are excluded, and the policy has no effect on unmanaged consumer machines. That means:

  • IT departments with Intune, Configuration Manager, or Group Policy can deploy the setting to suppress the prompt on enrolled devices.
  • Employees who sign into Windows with a corporate identity won’t see an extra permission request the first time they open a Microsoft app after signing in.
  • The prompt remains for anyone using a personal Microsoft account on the same device if they sign out and sign in with that account.

This distinction matters. The policy is a management lever, not a universal “turn off all sign-in prompts” switch. It doesn’t tamper with application consent dialogs, multifactor authentication challenges, or Conditional Access triggers.

Why prompts started appearing at all

In early 2026, Microsoft adjusted the Windows sign-in flow for users in the EEA. Instead of automatically extending a user’s Windows sign-in to other Microsoft apps and services, Windows began asking users whether they wanted to reuse those credentials. The goal was to give individuals more transparency and choice over how their identity travels across the Microsoft ecosystem.

For unmanaged devices, that’s a perfectly reasonable privacy-conscious design. But inside an enterprise where the organization already controls device enrollment, compliance, Conditional Access, and identity governance, the prompt turned into an unnecessary speed bump. Users were being asked to affirm a decision their employer had already made – and sometimes they clicked the wrong button.

“We heard from customers that this prompt was causing confusion and support tickets,” Microsoft noted in the accompanying documentation. The new registry value is a direct response to that feedback.

What the new policy does not do

Administrators must not confuse the SSO permission prompt with the more familiar Microsoft Entra application consent flow. The former is about reusing Windows credentials for other Microsoft apps; the latter is about granting specific data permissions to third-party or custom-developed applications.

Enabling AutoAcceptSsoPermission does not:

  • Approve any app permissions or grant admin consent.
  • Skip multifactor authentication requirements.
  • Override Conditional Access policies.
  • Extend the automatic acceptance to non-Microsoft services.
  • Remove prompt challenges triggered by risky sign-ins, expired sessions, or device non-compliance.
  • Sign users into personal Microsoft accounts without prompts.

The setting is best understood as a user-experience refinement for a narrow, Windows-specific consent moment. Security teams should review it alongside existing identity controls, not as a replacement for any of them.

How to deploy the setting responsibly

Because the change is a registry value, it can be pushed through Group Policy Preferences, Microsoft Intune scripts, Configuration Manager compliance settings, or any endpoint management platform capable of writing to the local machine hive. For most organizations, a staged rollout remains the safest approach.

Confirm update readiness

Check that target devices are running Windows 11, version 24H2 or 25H2, with KB5101650 or a newer cumulative update installed. You can verify using PowerShell:

Get-HotFix -Id KB5101650

Or check the OS build number; the documentation correlates the fix with the July 2026 security update release.

Pilot in the affected region

Pilot the change on a small group of devices where users have reported seeing the SSO prompt. For many organizations, that will be EEA-based endpoints or users traveling in the region. Validate that:

  • First-run behaviors for Teams, Outlook, OneDrive, and other Microsoft 365 apps no longer trigger the permission box.
  • Work-account sign-in continuity remains smooth.
  • Shared devices still behave as expected if you choose to deploy there.

Deploy and monitor

For Intune-managed devices, a common method is to create a remediation script package that writes the registry value to the correct path and detects whether it remains in place. While third-party tools and graphical ADMX templates might eventually simplify this, for now a script is the most reliable route. Domain-joined PCs can use Group Policy Preferences set to update the key under Computer Configuration.

Keep a rollback path: removing the value or setting it to 0 reverts to the normal prompted experience. Test rollback scenarios before broad deployment to ensure the prompt reappears cleanly after the change.

Potential pitfalls and privacy considerations

Suppressing a user-facing prompt always carries a few risks. The main concern is that on shared or multi-user devices, one person might unknowingly reuse their work identity after another user signs in, leading to data leakage in apps that maintain their own sessions. The policy is device-wide and affects all Entra ID users on that machine; if your workforce includes contractors or guests who also use personal Microsoft accounts, plan your deployment scope carefully.

Microsoft’s explicit exclusion of personal accounts reduces the most likely misuse case, but administrators should still document the change, communicate it to users, and ensure that data loss prevention measures are in place for shared device scenarios.

On the plus side, the policy aligns perfectly with zero-touch provisioning and Windows Autopilot strategies. New devices can go from factory floor to employee desk without an extra identity consent hurdle, reducing help-desk calls and account-selection errors.

What’s next?

For now, the control remains registry-only. Many IT professionals will push for a native Settings Catalog entry in Intune or a dedicated Group Policy administrative template to make deployment simpler and more discoverable. The current implementation works, but it asks admins to maintain custom scripts for a setting that Microsoft clearly considers an enterprise-grade control.

Microsoft has not indicated whether a more refined management surface is planned, but the rapid response to EEA feedback suggests the company is listening. In the meantime, the KB5101650 update and its registry key give enterprises a supported, effective way to streamline the Windows 11 sign-in experience on managed PCs, without undermining the security or transparency the original prompt was designed to provide.