[Feature Request] - Control automatic Microsoft-account SSO for app-added accounts

[saravejo]

💡 Describe the solution you'd like

I maintain a local Windows account but need a Microsoft account (MSA) for Minecraft/Xbox.

During Minecraft sign-in with Microsoft Account, Windows can offer options such as “Use this account everywhere on your device” or “Microsoft apps only.” Choosing Microsoft apps only keeps the Windows user account local, but the Microsoft account can still become available to other applications through Windows' account broker.

To my surprise, after adding my Microsoft account for Minecraft, Microsoft Word also associated that account and logged in automatically without asking.

My Word installation is LTSC and intentionally configured for local/offline use. I do not want an unrelated Microsoft account that I added specifically for Minecraft to be automatically reused or associated with Word or other applications sharing data with Microsoft.

Microsoft documents Windows Web Account Manager (WAM) as integrating applications with accounts known to Windows and supporting silent SSO.

Applications using MSAL/WAM commonly attempt something similar to:

try AcquireTokenSilent(...)
if that fails:
    show interactive authentication

This means an application can attempt to obtain authentication without an interactive sign-in prompt when an appropriate Windows-known account/session is already available.

Microsoft reference:

https://learn.microsoft.com/en-us/entra/identity-platform/scenario-desktop-acquire-token-wam

The Git Credential Manager project's Windows broker documentation also explains that choosing Microsoft apps only does not convert the Windows login itself to a Microsoft account, while the account can still remain available for use by applications in Windows.

Reference:

https://github.com/git-ecosystem/git-credential-manager/blob/main/docs/windows-broker.md

Windows also provides an additional control under:

Settings → Accounts → Email & accounts → Accounts used by other apps

Depending on the Windows version/account state, the account can be configured so that applications need to ask before using it instead of automatically using it for SSO.

A recent Microsoft Q&A example involving Copilot also demonstrates that this setting affects whether another Microsoft application can automatically use an existing Microsoft account:

https://learn.microsoft.com/en-us/answers/questions/5857909/cant-sign-into-windows-copilot-with-another-msa

Could WinUtil expose or safely automate this Windows account/SSO privacy control?

Possible implementations

1. Detect app-added Microsoft accounts

   Show Microsoft accounts listed under Accounts used by other apps and, if practical, distinguish between:

   • the Microsoft account used to sign into Windows

   • Microsoft accounts added only for applications

2. Expose “Require apps to ask”

   Provide a privacy option such as:

   Require apps to ask before using this Microsoft account

   If Windows provides a supported API, policy, or other reliable interface for changing this setting, WinUtil could automate it.

   If there is no safe supported interface, WinUtil could instead open the appropriate Email & accounts Settings page and explain which option should be changed.

3. Explain the different account scopes

   It could be useful to briefly explain the difference between:

   • Use this account everywhere

   • Microsoft apps only

   • Apps need to ask before using this account

   These options have materially different effects on how the Microsoft account becomes available for SSO, and the current Windows UI does not make that distinction very clear.

4. Optional future enhancement

   Provide an informational warning/help entry explaining that signing into services such as Xbox or Minecraft with a Microsoft account can register that identity with Windows' account broker, making it available to other compatible applications for SSO.

5. Require apps to ask

   Keeps the Microsoft account registered in Windows but restricts automatic SSO. Other apps should need explicit user interaction before using that account, while Minecraft/Xbox can remain signed in. Preserving the account for Minecraft while reducing silent reuse by Word, Edge, Copilot, and other Microsoft apps.

6. Detach Windows identity
   Removes the Microsoft account from Windows’ shared identity registration, ideally without deleting Xbox/Minecraft-specific authentication state. The goal is to stop other apps from discovering the account while preserving the game session if possible. For Achieve stronger account isolation, with the risk that Minecraft/Xbox may lose authentication or re-register the account with Windows . Reference: https://learn.microsoft.com/en-us/answers/questions/5557571/how-do-i-get-rid-of-the-account-that-linked-to-my

7. Reset Microsoft SSO

   Clears shared Microsoft authentication caches such as OneAuth, IdentityCache, and TokenBroker. This can sign out or disrupt Office, Edge, Copilot, Store, and other Microsoft apps, but does not necessarily remove the account from Windows. Remove stale or shared SSO sessions so apps must rebuild authentication state, at the cost of broader Microsoft-app sign-outs. Reference: https://learn.microsoft.com/en-us/answers/questions/5935573/xbox-live-sign-in-suspended-error-for-6-months-enf

[github-actions]

mewclouds requested maintainer triage for this issue.