Entra Admin Control for Windows SSO Prompts: What MSPs Should Do Now
Microsoft added a registry-based admin control that can automatically accept SSO prompts on managed Windows 11 devices. MSPs should verify KB5101650, scope this to Entra-managed devices, and add the registry check to tenant baselines and remediation workflows.
July 2026 change: an admin switch for Windows SSO prompts
Microsoft added a supported registry policy that lets administrators automatically accept the Windows SSO permission prompt on managed devices. The capability requires the July 2026 monthly security update (KB5101650) and applies only to Windows 11, versions 24H2 and 25H2 devices that are managed with Microsoft Entra ID.
What matters to MSPs
- Scope is narrow. This control only affects Entra ID-managed enterprise devices. Personal Microsoft accounts (MSA) and unmanaged devices still show the prompt.
- How it works. Deploy a DWORD at HKLM\SOFTWARE\Policies\Microsoft\Windows\AAD named AutoAcceptSsoPermission and set it to 1 to automatically accept the SSO permission prompt.
- Delivery. The registry policy is valid once devices have the July 2026 security update installed. You can deploy it via Intune, Group Policy, Configuration Manager, or any management tool that sets registry policies.
Operational checklist for tenants you manage
- Confirm OS and update: ensure devices are Windows 11 24H2 or 25H2 and have KB5101650 applied.
- Targeting: limit rollout to devices enrolled and managed by Entra ID; do not apply to groups containing personal or unmanaged devices.
- Deploy and test: push the registry via Intune or GPO to a pilot group, then verify SSO behavior end-to-end (Edge, M365 apps, Company Portal, OneDrive).
- Baseline and remediation: add two checks to your tenant baseline - presence of the KB/security update and the registry value - and create one-click remediation for non-compliant devices.
- Audit and logging: track deployment success and user-reported auth issues; validate Conditional Access and device compliance flows after enabling the setting.
Practical takeaway: this is a focused, supported control that reduces friction on managed Entra devices, but it must be deployed carefully. Add the KB and registry checks to your baselines, pilot before broad rollout, and monitor for unexpected changes in authentication behaviour. Have you added this to your TenantForge baselines yet?