How to remove or hide or only owner of device should login in other users in windows login page using intune policy

To ensure only the assigned owner can sign in, deploy Allow Local Log On to that owner plus an emergency administrator account; hiding usernames only changes what appears on the sign-in screen and does not prevent other users from authenticating.

Restrict interactive sign-in

This is suitable when the same explicitly identified account or group should be allowed on every device receiving the policy.

1. In the Microsoft Intune admin center, go to: Devices → Manage devices → Configuration → Create → New policy.
2. Select:
   • Platform: Windows 10 and later
   • Profile type: Settings catalog
3. Select Add settings, search for Allow Local Log On, and add the User Rights setting.
4. Configure it with:
   • The authorized owner account or a dedicated group containing authorized owners.
   • A managed emergency administrator account or administrator group, to prevent administrative lockout.
5. Assign the profile first to a small device test group.
6. After synchronization and restart, test both outcomes:
   • The authorized account can sign in.
   • An unauthorized account receives a sign-in-rights error.

AllowLocalLogOn is a device-scoped policy supported on Windows Pro, Enterprise, Education, and IoT Enterprise starting with Windows 10 version 1803. It determines which users can sign in locally.^1^

Important: User-rights configuration replaces the existing assignment rather than adding to it. An incorrect assignment can lock every interactive administrator out of the device. Do not broadly deploy it until both owner and recovery-administrator access have been tested.

If the setting is unavailable in Settings Catalog, use a Windows custom configuration profile with this OMA-URI:

./Device/Vendor/MSFT/Policy/Config/UserRights/AllowLocalLogOn

For example, the CSP accepts Microsoft Entra accounts in the following form:

<![CDATA[
AzureAD\[Email]&#xF000;*S-1-5-32-544
]]>

Here, 0xF000 is the required separator and *S-1-5-32-544 represents the local Administrators group. Prefer SIDs for well-known groups because account-name strings can vary by Windows language.^1^

Intune creates Settings Catalog policies under Devices → Manage devices → Configuration, and creating them requires at least the Policy and Profile Manager built-in role.^2^

If “owner” differs on every device

The documented User Rights policy accepts explicit users or groups; it does not document a dynamic value meaning “this device’s Intune primary user/owner.” Therefore, one static policy cannot safely insert a different owner account on each device.

Use one of these designs:

• Create per-device or per-owner assignments containing the correct account.
• Create device-specific authorized-user groups and target matching device groups.
• If only administrators should sign in, allow the managed Administrators group—but this permits every account that is a member of that group, not just the Intune primary user.

Also review existing security baselines before deployment. The Windows 23H2 baseline configures Allow Local Log On for both Administrators and Users, which could conflict with a restrictive configuration profile.^3^ If two Intune configuration profiles configure the same setting differently, the setting is reported as a conflict and isn't applied.^4^

Hide account information only

If the requirement is visual privacy rather than access control:

1. Create another Windows 10 and later → Settings catalog policy.
2. Add and enable:
   • Hide last signed-in user
   • Optionally, Hide username at sign-in
3. Assign it to the required device group.

These settings hide the displayed username; they do not limit who can authenticate.^5^ The underlying Don’t display last signed-in policy is device-scoped and supported on applicable Windows editions from Windows 10 version 1709.^6^

Shared PC mode limitation

If these devices use Intune Shared PC mode, Windows displays Guest and Other user. The matching Microsoft Q&A case found no working policy or registry method to remove Other user or prevent tenant Entra users from signing in through it.^7^

In that scenario, do not treat hiding the tile as security enforcement. Test Allow Local Log On separately on a pilot Shared PC; if it does not meet the requirement, open an Intune support case rather than deploying unsupported registry modifications.

References

1. Policy CSP - UserRights
2. Use the Intune settings catalog to configure settings
3. Windows MDM security baseline settings reference for Microsoft Intune (mdm-23h2)
4. Walkthrough - Create an Intune settings catalog policy and compare with on-premises ADMX
5. Windows settings you can manage through an Intune Endpoint Protection profile
6. Policy CSP - LocalPoliciesSecurityOptions
7. Intune Shared Device Configuration - Restricting Entra Account Access - Microsoft Q&A