Windows SSO: How to Manage Single Sign-On Prompts with Microsoft Intune

With recent changes introduced for users in the European Economic Area (EEA), Windows 11 users may see an additional consent prompt when Microsoft apps attempt to use the account already signed in to Windows. For managed environments, this extra prompt can create unnecessary user interaction. Microsoft has introduced a new policy that allows administrators to automatically approve this permission on supported devices. In this post, I'll show you how to deploy this configuration using Microsoft Intune Remediations.

📌 Prerequisites

Before you begin, make sure the following requirements are met:

• Windows 11 version 24H2 or later
• July 2026 security update installed (KB5101650 or later)
• Device enrolled and managed by Microsoft Intune
• User signed in with a Microsoft Entra ID account
• Microsoft Intune Remediations license

📦 Deployment Options

There are several ways to deploy this configuration across Windows devices:

• Group Policy (GPO) – Suitable for traditional Active Directory environments.
• PowerShell scripts – Provides a flexible way to configure the required registry settings.
• Win32 app – Can be used to package and deploy the configuration through Microsoft Intune.
• Microsoft Intune Remediations – Provides proactive detection and automatic remediation of device settings.

For this implementation, I have chosen Microsoft Intune Remediations because it provides a scalable and automated approach. The detection script evaluates the current device configuration, and the remediation script automatically applies the required setting when needed.

This approach allows administrators to maintain the desired configuration state across managed Windows devices without manually verifying each device.

🔎 Detection Script

The detection script checks whether the required registry configuration is already present. If the expected value is detected, the device is considered compliant. Otherwise, the remediation script will be triggered.

Detection Script

$ErrorActionPreference = "Stop"

$RegistryKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\AAD"
$PolicyName  = "AutoAcceptSsoPermission"
$TargetValue = 1

try {
    $ConfiguredValue = (Get-ItemProperty `
        -Path $RegistryKey `
        -Name $PolicyName).$PolicyName

    if ($ConfiguredValue -eq $TargetValue) {
        Write-Output "Policy detected and correctly configured."
        exit 0
    }

    Write-Output "Policy found but configured with unexpected value: $ConfiguredValue"
    exit 1
}
catch {
    Write-Output "Policy not configured."
    exit 1
}

🛠️ Remediation Script

Remediation Script

$ErrorActionPreference = "Stop"

$RegistryKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\AAD"
$PolicyName  = "AutoAcceptSsoPermission"
$DesiredValue = 1

try {

    if (-not (Test-Path $RegistryKey)) {
        New-Item `
            -Path $RegistryKey `
            -Force | Out-Null

        Write-Output "Created registry path."
    }

    Set-ItemProperty `
        -Path $RegistryKey `
        -Name $PolicyName `
        -Value $DesiredValue `
        -Type DWord

    $VerifyValue = (Get-ItemProperty `
        -Path $RegistryKey `
        -Name $PolicyName).$PolicyName

    if ($VerifyValue -eq $DesiredValue) {
        Write-Output "SSO policy successfully configured."
        exit 0
    }

    Write-Output "Configuration verification failed."
    exit 1
}
catch {
    Write-Output "Remediation error: $($_.Exception.Message)"
    exit 1
}

🚀 Deploy Using Microsoft Intune Remediations

To deploy the policy, create a new remediation package in Microsoft Intune. Navigate to:

Devices > Scripts and remediations > Create

Upload the detection script and remediation script created above, configure the assignment settings, and deploy the remediation to your Windows 11 devices.

Figure 1: Creating a new remediation package in Microsoft Intune.

✅ Validation

After deployment, devices should have the following registry value configured:

HKLM\SOFTWARE\Policies\Microsoft\Windows\AAD

AutoAcceptSsoPermission = 1 (DWORD)