Accounts

Like any modern personal computing platform, Windows 11 requires you to sign in to the system using an account that represents your identity on the PC and the settings, documents, and apps associated with that identity.

Defaults

Increasingly, that Windows 11 sign-in account is a so-called online account, which can be a Microsoft account (MSA, used by individuals) or a Microsoft Work or School account (MWSA, used by businesses, schools, and other managed organizations). Microsoft makes this difficult, but you can still sign in with a local account that is only available on that one PC. There are pros and cons to each.

Windows 11 sign-in accounts consist of some or all of the following:

• Account name. This is an email address like [email protected] for online accounts or any alphanumeric name like paul for a local account.
• Friendly name. This is typically your real name, like Paul Thurrott.
• Password. This may have complexity and length requirements for online accounts but is optional for local accounts.
• Permission level. The first sign-in account you create on a PC is given Administrator privileges so that person can complete any tasks, including those that may be destructive and could impact other users on the PC. Subsequent sign-in accounts are given Standard account privileges by default. This type of account can install some apps and configure the environment to their liking, But they cannot complete tasks that might be destructive or impact other users without getting authorization from someone on that PC with administrator privileges.
• PIN. If you sign in to Windows 11 with an online account or a local account with a password, you must make a PIN for additional security. It’s also easier to sign in with a PIN than a password, since a PIN is usually shorter and easier to remember.
• Biometric authentication. Optionally and depending on the capabilities of your PC, you can enroll in Windows Hello fingerprint and/or facial recognition, biometric authentication methods that make it even easier to sign in.
• Passkey. When you sign in to a PC using an online account–again, an MSA or MWSA–Windows 11 creates a device-bound passkey, a simple and secure alternative to a password. This passkey is used to simplify passthrough authentication so you can open apps like Microsoft Edge, Microsoft Store, OneDrive, and others and immediately use your identity in Windows with those apps without having to sign in again each time.

When you perform a clean install of Windows 11 on a new or recently reset PC, you have to sign in to an online account or create a local account during the Out-of-Box Experience (OOBE) to complete the process and begin using Windows.

If you are setting up Windows 11 Home, you only presented with a single option, to sign-in with a Microsoft account. This begins with the “Unlock your Microsoft experience” step.

But if you are setting up Windows 11 Pro, you will see the “How would you like to set up this device?” step.

Here, you can choose to sign in to Windows 11 with a:

• Microsoft account. Select “Set up for personal use,” the most common choice for individuals and then sign in to this online account and authenticate as necessary.
• Microsoft Work or School account. Select “Set up for work or school” and then sign in to this online account and authenticate as necessary.

However, you can also sign-in using a local account–with Windows 11 Home or Pro–though this option is not available by default. I explain how to sign in this way in the Install chapter, but you must supply an account name and, optionally, a password.

The type of account you sign in with impacts future OOBE steps. For example, while you will configure your privacy settings with each account type, only online accounts are given the option to restore the PC from a previous backup. When you complete the OOBE, you will land on the Windows 11 Desktop and from there, you can perform various initial configurations, some of which might be account-related, like doing the basics to secure your sign-in account.

Customize

Account customization occurs in the Settings app by navigating to Accounts.

What you see here will vary a bit by account type. If you sign in with a Microsoft account, there will be an expandable “Cloud storage” item at the top below the account information that lets you check in on your OneDrive usage, plus items for Microsoft 365 and other Microsoft subscriptions you have. But if you sign in with a local account, you will see an expandable “Microsoft account” item because Microsoft really wants you to sign in with an MSA.

The important account-related settings are below that.

The key settings to consider here are covered in the following sections.

Your info

If you sign in with an MSA or MWSA, there’s not much to do here as your profile picture are configured on the web and should appear correctly in Windows 11.

But if you sign in with a local account, you can use the Camera app or an image file you have on the PC to change the profile picture that appears for your account in Windows 11.

Tip: This page also provides an option to switch a Microsoft account sign-in to a local account or vice-versa, depending on how you signed in.

Sign-in options

This is one of the more important pages in the Settings app.

Here, you can configure:

Facial recognition (Windows Hello). If your PC supports Windows Hello facial recognition and you’ve already created a PIN, you can expand this item and enroll. If you sometimes wear glasses, be sure to click “Improve recognition” after you’re done to enroll again with or without glasses. And enable “Enhance facial recognition protection” when done (which requires a reboot).

Fingerprint recognition (Windows Hello). If your PC supports Windows Hello fingerprint recognition and you’ve already created a PIN, you can expand this item and enroll. When you’re done, consider enrolling at least one more finger using the “Add a finger” button.

PIN (Windows Hello). If you sign in to Windows 11 using any kind of account that has an associated password, you were forced to create a PIN during initial setup. But if you created a local account with no password, signed in that way initially, and then later added a password, you can create a PIN now. You can also use this interface to change your PIN

Password. This item only appears when you sign in with a local account. Here, you can create or change your password.

Tip: If your PC supports presence sensing functionality, you will find a link to Presence Settings setting at the bottom of this page, under “Related.” This is a set of capabilities that can make your PC more secure by locking Windows when you walk away and then waking it up again when you come back so you can authenticate more quickly and get back to work.

Your accounts

If you sign in to Windows 11 with a local account, you can use this page to configure one or more Microsoft accounts (MSAs) or Microsoft Work or School accounts (MWSAs) as app accounts. You can’t sign in to Windows 11 with an app account. Instead, it’s used to sign in to apps like Microsoft Store that support a sign-in and can provide access to additional rights or features. By signing in to Microsoft Store this way, for example, you get access to your purchases, downloaded app history, and more.

To add an app account, click the “Add a Microsoft account” or “Add a Work or school account” link and sign-in and authenticate as prompted. Once this is done, you can then click the “Profile” or similar button in any compatible app and sign-in to that app using the app account.

You can also expand this item in Your accounts to expose a “Sign in options” setting that’s configured to “Microsoft apps can ask me to sign in” by default. You can change this to “All apps need to ask me to use this account” to prevent apps from automatically just signing in with this MSA if desired.

Tip: While it’s not clear why this Settings page is unavailable when you sign in to Windows 11 with an MSA, you can still add an app account at any time. To do so, sign out of an app like Microsoft Store that’s already signed in with your MSA, sign in again, and choose the “Use a different account” option in the “Let’s get you signed in” dialog that appears. Then, sign-in and authenticate when prompted. Oddly, doing this doesn’t add the Your accounts page to Accounts settings in the Settings app.

Windows Backup

If you sign in with a Microsoft account (MSA) or Microsoft Work or School (MWSA), Windows 11 will automatically configure Windows Backup to sync certain system settings through that online account so you can restore from the most recent backup when you later sign in to Windows 11 on a different PC (or after you reset this PC). This page lets you configure Windows Backup to some degree.

Other users

This page lets you configure one or more other sign-in accounts on this PC. Each sign-in account is typically associated with a unique individual–a person in a family, for example–each has its own settings, documents, and apps, and each is given a specific permission level, meaning they have Administrator privileges or are a Standard user.

Access work or school

If you have a Microsoft Work or School account (MWSA) through a workplace, educational institution, or some other managed organization, you can use this page to connect that account to your personal PC without having to sign in with it and potentially allow that organization to manage the PC in some way. When you connect your MWSA here, you can optionally use those credentials to sign in to individual apps and, if available, access your company’s VPN (virtual private network) so you can remotely access work data.

Why you should consider signing in to Windows 11 with a Microsoft account

While Microsoft does use your Microsoft account (MSA) to upsell you and control your experience in some ways, this is still the safest and best way for most individuals to sign in to Windows 11. Some key benefits include:

• It’s more secure. Because you can configure your Microsoft account to require secure two-step verification and passwordless authentication methods, there’s no need to remember complicated passwords. Indeed, you can even remove the password from your Microsoft account if you’d like. Once it’s properly configured, a Microsoft account is more secure than a local account.
• Some Windows 11 experiences require a Microsoft account. Some of the built-in experiences in Windows 11, like OneDrive file system integration, require a Microsoft account. If you sign in to the PC with a Microsoft account, Windows will pass through your sign-in credentials and these experiences will work seamlessly. If you don’t, you may need to sign in to them individually.
• Many in-box apps require a Microsoft account. Many of the in-box apps that come bundled with Windows 11–like the Microsoft Store and Xbox–require a Microsoft account as well, as do many apps you download from the Microsoft Store. Yes, you can manually sign in to those apps as needed or create an app account, but when you sign in to Windows 11 with your Microsoft account, those apps work seamlessly.
• Backup and settings sync capabilities. With a Microsoft account, you can automatically sync key user folders like Desktop, Documents, Music, Pictures, and Videos with OneDrive. And some of your settings–including accessibility settings, saved passwords, language preferences, and more–are synced from PC to PC via your Microsoft account, providing a more consistent experience. There’s even a Windows Backup app in Windows 11 to help you manage these capabilities.

Tip: Some in-box Windows 11 apps don’t require a Microsoft account at all. For example, while the new Outlook app does require you to connect it with at least one online account, it doesn’t have to be a Microsoft account. In fact, you can use it exclusively with a Gmail account if you’d like.

Use a Microsoft Work or School account with your Microsoft account sign-in

While you can sign in to Windows 11 using a Microsoft Work or School account (MWSA), I focus on individuals in this book, not those using a PC that’s managed by an employer, school, or other organization. But those who sign in to Windows 11 with a Microsoft account (MSA) can connect their MWSA to their MSA in what’s called a “bring your own device” (BYOD) scenario. That is, you can use your personal PC with your personal MSA but still access your work or school resources on that PC by connecting your Microsoft work or school account. So you will sign in with an MSA, but you will also configure your MWSA to work within that personal sign-in account.

Connect to your MWSA

To get started, open the Settings app and navigate to Accounts > Access work or school.

Then, click the “Connect” button next to “Add a work or school account” to set up your WMSA.

Enter your work or school email address and password as prompted and then perform whatever other authentication is required. (Most MWSAs require some form of multi-factor authentication, or MFA, in addition to your account credentials.) Windows 11 will register your PC with your organization and apply some basic management policies so that your work or school has some control over its data.

When you click “Done,” your work or school account will now appear on the Access work or school page in Settings.

Tip: To later remove this connection, navigate to this page in Settings, click the MWSA item to expand it in place, and then click “Disconnect.”

With that complete, your organization can remotely deploy applications to your PC.

Use your MWSA with Windows 11 apps and experiences

And you can perform other tasks to connect with your work or school’s OneDrive (for Business) storage, email, and other apps. For example:

• Connect to your work or school OneDrive. OneDrive in Windows 11 supports multiple accounts, so you can configure it to work with your MSA and your MWSA. To do so, open the “Account” page in OneDrive settings, click “+ Add an account,” and sign-in to and otherwise authenticate your MWSA. After stepping through the OneDrive setup wizard and optionally enabling Folder backup, you will see two OneDrive icons in the system tray–the blue one is associated with your MWSA–and two OneDrive entries in the navigation bar in File Explorer. From here, the OneDrive files from each account will be available normally, side-by-side, in File Explorer and in other apps.

Tip: You can only use OneDrive’s Folder Backup feature with one account.

Tip: The two OneDrive items in File Explorer can look annoyingly similar. The personal account will usually be named something like “Username – Personal” while the school or work account will be named something like “Username – Organization name.”

• Connect Outlook to your MWSA. If you want to access the email, contacts, calendar, and tasks associated with your MWSA, you can configure this account in the Outlook in-box app. To do so, launch Outlook, click the “Settings” (gear) button in the title bar, and then click the “Add account” button in the “Settings” window that appears. Your MWSA will be pre-configured in the dialog that appears, so just click “Continue.” Now, you can access your MWSA data by selecting it in the navigation pane.

• Use an app with your connected Microsoft Work or school account. Though compatible apps like those provided by Microsoft 365 and others will automatically connect to your Microsoft account (if that’s how you sign-in), you can optionally connect any of them to your MWSA too. How you do so varies by app, but signing in is usually straightforward.

Use a local account safely and securely

A local account is a Windows 11 sign-in account that exists only on the PC on which it is created. Microsoft sometimes refers to this type of account as an offline account because it can be created and managed even when the PC is offline: When you initially sign in to Windows 11 with a Microsoft account or Work or school account, you must be online so that you can authenticate your user credentials with Microsoft or your organization.

I recommend that most people do not sign in to Windows 11 with a local account as you will have a better–and safer–overall experience using a Microsoft account. But more sophisticated users who know what they’re doing can use a local account securely. And doing so can eliminate some of the bad behaviors we see in Windows 11.

For the most part, Windows 11 looks and works much the same whether you sign in with a local account or a Microsoft account (MSA). But there are some key differences:

• No password required. You are not required to protect a local account with even a simple password, though doing so is obviously insecure. This is a particularly serious problem if you give the local account administrative capabilities, as a thief could access content in other Microsoft accounts or work or school accounts configured on that PC. We strongly recommend configuring a password, at which point you can configure a PIN and, if supported by your PC, Windows Hello PIN or facial or fingerprint recognition.
• No automatic device encryption. When you sign in to Windows 11 with an MSA, the PC’s storage is automatically protected with Device encryption, a full-disk encryption solution that helps protect the documents and other data it contains from being stolen or otherwise accessed by others. You can enable it after the fact when you sign in with a local account, but it’s easier if you’re using Windows 11 Pro.
• No settings sync. When you sign in to Windows 11 with an MSA, it uses a feature called Windows Backup to sync a limited set of settings–accessibility settings, saved passwords, language preferences, and more–to that account in the cloud so that they can be restored when you sign in with that same account on a different PC. This functionality is not available with a local account.
• No automatic sign-in to apps and Windows 11 experiences. When you sign in to Windows 11 with an MSA, you are automatically signed in to the Microsoft Store, OneDrive, Widgets, and other Windows 11 experiences. You can’t use some apps and experiences with a local account, and while you can sign in to them with a Microsoft account later, you must do so manually–one app at a time–or configure that Microsoft account as an app account in the Settings app under Accounts > Your accounts.

Tip: Some Microsoft Store apps work without a Microsoft account, and some provide a subset of the functionality you receive when you’re signed in with a Microsoft account. For example, the Microsoft Store app runs without a Microsoft account, and it even lets you download free apps and games without first signing in.

Use multiple sign-in accounts with a single PC

Windows 11 supports multiple sign-in accounts. This can be useful in many situations, the most obvious being a family in which one or more parents or caretakers and/or one or more children can each have their own account, each with its own customized Windows 11 experience.

Add a new sign-in account

Anyone with Administrator privileges can add additional sign-in accounts. These can be Microsoft accounts, Microsoft Work or School accounts, or local accounts. To do so, open Settings and navigate to Accounts > Other users. Then, click the “Add account” button next to “Add other user” in the “Other users section.” The Microsoft account window appears. From here you can:

• Add a Microsoft account sign-in. Enter the email address and authenticate against Microsoft’s servers as prompted.
• Add a local account sign-in. Click the “I don’t have this person’s sign-in information” link and then select the “Add a user without a Microsoft account” link in the Create account window that appears. Then add a username and, optionally, a password, as prompted.

Configure a sign-in account’s permissions level

Any user with Administrator privileges can change the account type–meaning the permissions level–for any other MSAs and local accounts that are configured on the PC. But be careful configuring other users as an Administrator, as doing so will give them full control over the PC, including access to any documents and other files in your account.

To do so, locate the account you wish to change to an Administrator in Other users settings and select it to expand the view. Then, click the “Change account type” button. The “Change account type” window appears. Select “Administrator” from the “Account type” drop-down and click OK.

Tip: Adding a Microsoft Work or School account sign-in is a bit trickier. To do so, open Settings and navigate to Accounts > Access work or school. Then, click the “Connect” button next to “Add a work or school account.” In the “Set up a work or school account” window that appears, click the “Join this device to Azure Active Directory” link and then sign-in and authenticate against your work or school account as prompted. Because work and school accounts are managed by your organization, there’s not much you can do locally on the PC: All you can really do is remove it from the PC.

Tip: There must always be at least one sign-in account with Administrator privileges in Windows 11.

{#multi-switch}

Switch between available sign-in accounts

Windows 11 lets you or another configured user sign in to the PC at any time. You can even do this while a current user account is still signed in, so that multiple sign-in accounts are active concurrently. Or, you can optionally sign out of one account first so that another user can sign in.

Tip: Only one sign-in account can be used interactively at a time.

There are three key ways to juggle multiple accounts:

• Switch. To switch user accounts–that is, sign in with a different account while leaving the current account signed in as well–open Start and click the “Profile” button (your user picture and name) in the bottom-left of Start. Then, click “More” (“…”) and select the user account you wish to use from the drop-down list. In the Sign-in screen that appears, select the user account you wish to switch to.

• Lock the screen. Windows 11 lets you “lock” the screen to prevent others from accessing your data when you’re away from the PC while retaining your user session. But you can also use this method to switch sign-in accounts. To do so, click the “Power” button at the bottom of Start and choose “Lock” from the pop-up menu that appears. The Lock screen will appear, and you can tap any key to select the sign-in account you wish to use in the bottom left of the Sign-in screen.

Keyboard shortcut: You can more quickly lock the PC by typing Windows key + L.

• Sign-out. If you want to sign out of the current account and sign in again with a different account, open Start, click the “Profile” button, and then click “Sign out.” The Lock screen will appear, and you can tap any key to select the sign-in account you wish to use in the bottom left of the Sign-in screen.

Presence sensing

Presence Sensing is a set of features that uses one or more hardware proximity sensors to improve security, save battery life, and make it easier and quicker to sign in to Windows 11. It isn’t supported on all PCs, but it offers features like turning off the display and locking the PC when you walk away, turning on the screen and waking up the PC when you return, dimming the screen when you look away, and detecting when others are looking at your screen.

Tip: Presence Sensing is best used in tandem with Windows Hello facial recognition as it will speed the process of signing into your PC: The PC can wake up as you approach and then the IR sensor will start scanning for your face as soon as possible.

Defaults

If your PC supports Presence sensing, you will see a “Presence sensing” option in the “Choose privacy settings for your device” stage in the Out-of-Box Experience (OOBE) during Windows Setup when you first set it up. Unless you configure it otherwise at that time, this feature is enabled by default.

Customize

Presence sensing is well hidden in the Settings app. You can toggle Presence sensing on or off globally–and determine whether individual apps can use Presence sensing–by navigating to Privacy & security > Presence Sensing.

Then, you can navigate to System > Power & battery, and expand the “Screen, sleep, & hibernate timeouts” item to see which Presence sensing features are available and toggle each on/off individually if desired.

To display Presence Sensing settings, click “Turn my screen off when I leave.”

The following options are available:

• Turn my screen off when I leave. When enabled, Windows 11 will turn off the display and lock the PC when you walk away from it. You can configure the distance and time frame individually, as well as one option related to multi-display configurations.
• Wake my device when I approach. When enabled, Windows 11 will wake the PC and turn on the screen as you approach. You can configure the distance and one option related to multi-display configurations.
• Dim my screen when I look away. Not available on all PCs with Presence sensing capabilities, this feature will dim the display if you look away from it to help preserve battery life and make it more difficult for those around you to see what’s on-screen. There is a single option related to multi-display configurations as well.
• Detect when other people are looking at my screen. Not available on all PCs with Presence sensing capabilities, this feature detects when other people are looking at your PC’s display. When enabled, Windows 11 will dim the display and notify you that there’s an onlooker. But you can configure it to just notify you, if you prefer.

Tip: Windows 11 provides a related feature called Dynamic lock that uses a Bluetooth-paired smartphone to automatically lock your PC when you walk away from it. Because this feature is unreliable, I don’t recommend enabling or using it. And if your PC supports Presence Sensing, Dynamic lock is superfluous as Presence sensing is far more reliable and secure. You can configure Dynamic lock in the Settings app if needed: Navigate to Accounts > Sign-in options > Dynamic lock.