Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Enable Fast First Sign In is a device-scoped Windows Authentication policy for Shared PCs. When enabled, Windows can automatically connect a newly signing-in, non-administrator Microsoft Entra account to a candidate local account that was already preconfigured or added on the device.
In Intune, the reported Settings Catalog location is Configuration settings > Authentication > Enable Fast First Sign In. The tenant interface can change, so treat that path as the documented navigation rather than a guarantee that every portal view uses identical labels. This policy is not a general-purpose login accelerator, and the available evidence does not establish it as a fix for OneDrive silent sign-in.
What Enable Fast First Sign In actually does
Microsoft describes this policy as intended for Shared PCs “to enable a quick first sign-in experience for a user.” Its specific mechanism is account connection: a new, non-admin Microsoft Entra account can be automatically connected to a candidate local account on the Windows device. The local account must already be preconfigured or added before the policy can use it.
That definition matters. The setting does not promise a measured reduction in authentication time, remove the Windows sign-in screen, or make every first login faster. It automates the relationship between an eligible Entra identity and an existing local account in a Shared PC design. If the device has no suitable candidate local account, enabling the policy alone does not create one.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Supported devices and policy scope
Windows versions and editions
Microsoft lists Windows 10 version 1809 and later for this policy. Supported editions listed by Microsoft are Pro, Enterprise, Education, and IoT Enterprise. Confirm the edition and build on the target device before assigning the profile, especially when a mixed fleet includes Home or older Windows installations.
Device-scoped, not user-scoped
The policy applies to the Windows device. In Intune, plan assignment around device groups and Shared PC hardware rather than assigning it as a user-only preference. A user-targeted deployment strategy can produce confusing results because the behavior belongs to the device’s Authentication configuration and affects eligible users who sign in there.
Required local-account preparation
A candidate local account has to exist in advance. Prepare the local accounts through your organization’s Shared PC provisioning process, then deploy the Authentication policy to the same devices. Enabling the policy without that prerequisite leaves Windows with nothing to which a new Entra account can be connected.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Policy values and their effects
The Policy CSP exposes the setting as an integer. Microsoft documents three values:
| Value | Meaning | When to use it |
|---|---|---|
0 |
Default behavior based on the existing Windows SKU and the device’s capabilities. | Use when you want Windows to follow its normal, SKU-dependent behavior rather than explicitly enabling or disabling the feature. |
1 |
Enables automatic connection of new non-admin Microsoft Entra accounts to preconfigured candidate local accounts. | Use on Shared PCs where the account-connection workflow is intentional and the local accounts are prepared. |
2 |
Disables the automatic connection behavior. | Use when your Shared PC design requires administrators or another provisioning process to control account connections explicitly. |
Do not treat 1 as a universal “fast sign-in” switch. It enables the documented account-connection behavior; it does not provide a published speed percentage or guaranteed elapsed-time improvement.
Configure it in the Intune Settings Catalog
The following procedure uses the navigation reported for the Settings Catalog. Microsoft can revise portal names and placement, so search for the policy by its full name if the labels in your tenant differ.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
- Open the Microsoft Intune admin center and start a new Windows configuration profile using the Settings Catalog. Select the Windows platform and the Settings Catalog profile type used by your tenant.
- Open the configuration settings picker. Search for Enable Fast First Sign In, or browse to Authentication and locate that setting. The reported path is Configuration settings > Authentication > Enable Fast First Sign In.
- Choose the policy value. Select the enabled state corresponding to value
1when you want automatic connection, or select the disabled state corresponding to value2when you want to prevent it. Leaving the setting at its default corresponds to value0. - Review the profile. Confirm that the profile is intended for Shared PC devices, that its Windows requirements match the target fleet, and that candidate local accounts will be present before users sign in.
- Assign the profile to device groups. Use a pilot group first, then expand to the production Shared PC device group after validating the result on representative hardware. Because this is device-scoped, device-group assignment is the appropriate control point.
- Allow the device to sync. On a test PC, trigger an Intune sync from Windows or the Company Portal, then restart or sign out as required by your normal configuration-management process. The policy’s effect should be evaluated on a device that has received the profile and has the candidate account already prepared.
Use the Policy CSP URI when a custom profile is required
For deployments that use a custom OMA-URI profile instead of the Settings Catalog, Microsoft identifies this setting with:
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →./Device/Vendor/MSFT/Policy/Config/Authentication/EnableFastFirstSignIn
The data type is an integer. Set the value to 0, 1, or 2 according to the behavior in the policy table. A custom profile still needs to be assigned to the intended Windows devices, and the local-account prerequisite remains unchanged. Use one configuration method for a given device where possible so that a Settings Catalog profile and a custom profile do not compete to write different values.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
What a first sign-in should look like on a Shared PC
With value 1, the expected scenario is a new non-admin Microsoft Entra user signing in to a Shared PC that already has a candidate local account. Windows performs the documented automatic connection between the new Entra account and that local account. The policy is therefore most relevant to environments in which many people use the same physical computer and administrators want a repeatable first-use setup.
The behavior depends on all three conditions being true: the device must receive the policy, the account must be a new non-admin Microsoft Entra account for that device, and a candidate local account must already be available. A failure to observe automatic connection does not by itself prove that Intune is broken; first check those conditions and the device’s supported Windows edition and version.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteDo not confuse this setting with a OneDrive silent sign-in fix
A Microsoft Q&A discussion includes a question about whether an Intune OneDrive policy should take effect when a user receives a computer and logs in for the first time. The same discussion mentions one Shared PC administrator who associated disabling Fast First Sign In with a setup that worked, while other participants continued to report OneDrive sign-in problems.
Best Value
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
Those reports are anecdotal and mixed. They do not establish that Fast First Sign In causes OneDrive behavior, nor that setting the value to 2 universally fixes silent sign-in. Microsoft’s documented purpose remains the Shared PC account-connection workflow. If your issue is OneDrive provisioning or silent authentication, investigate the OneDrive policy and identity prerequisites separately, and treat any change to Fast First Sign In as a controlled troubleshooting experiment rather than a guaranteed remedy.
Validate a deployment before broad assignment
Check the policy target
- Verify that the test computer is running Windows 10 version 1809 or later and one of the listed Pro, Enterprise, Education, or IoT Enterprise editions.
- Confirm the device, not only the user’s account, appears in the assignment scope.
- Check that the profile reports a successful device sync and no conflicting configuration profile is writing another value.
Check the local-account prerequisite
- Confirm that a candidate local account was preconfigured or added before the Entra user attempted the first sign-in.
- Use a non-admin Microsoft Entra test account so the test matches the policy’s documented eligibility.
- Repeat the test only after the device has received the profile; changing the assignment immediately before sign-in can leave the result ambiguous.
Check the selected value
- For automatic connection, the effective integer should be
1. - For an explicitly blocked connection, the effective integer should be
2. - If the setting is not configured, Windows follows the default value
0, whose behavior depends on the SKU and device capabilities.
Common failure modes and appropriate responses
The setting cannot be found
Search the Settings Catalog for the full phrase Enable Fast First Sign In and browse the Authentication category. The reported navigation is not a promise that every tenant exposes the same current layout. If your organization uses custom OMA-URI profiles, use the Policy CSP URI and integer data type instead.
Nothing changes after enabling value 1
Check the device scope, sync status, supported Windows edition and version, and the presence of a candidate local account. Also verify that the test identity is a new non-admin Microsoft Entra account. The policy cannot connect an account to a local account that was never created or prepared.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteValue 2 appears to affect a OneDrive issue
Record the result, but do not generalize it. The available Q&A reports contain conflicting experiences and do not prove causation. Keep OneDrive troubleshooting separate, document the exact policy values and device state, and test on more than one representative PC before changing production assignments.
Operational and security considerations
Because this setting links a new cloud identity to a local account on a shared device, document which local accounts are candidates, who manages them, and how they are removed or reissued. Apply the policy only to devices designed for shared use; a personal, single-user PC may not need this account-connection behavior.
Use a pilot ring and retain a rollback plan. Setting the policy back to 0 returns control to the default SKU- and capability-based behavior; setting it to 2 explicitly disables automatic connection. Neither choice deletes existing accounts or replaces broader Windows, Entra, or OneDrive configuration.
Quick Recap
When to enable, leave default, or disable
| Environment | Recommended policy state | Reason |
|---|---|---|
| Shared PC fleet with prepared candidate local accounts and a designed first-use workflow | 1 (enabled) |
Activates the documented automatic connection for new non-admin Entra users. |
| Devices where the organization wants Windows to determine behavior from SKU and capabilities | 0 (default) |
Avoids an explicit override while retaining the platform’s default behavior. |
| Shared PCs where account connections must be controlled manually or by another process | 2 (disabled) |
Prevents the automatic connection behavior. |
| Personal PCs with no Shared PC account-connection requirement | Usually leave unconfigured unless a documented design calls for a specific state | The policy is intended for Shared PCs, not as a general login-speed setting. |
Key takeaways
- Enable Fast First Sign In is a Windows Authentication policy for Shared PCs, not a universal performance switch.
- Value
1enables automatic connection of new non-admin Microsoft Entra accounts to candidate local accounts that already exist. - Value
0preserves default SKU- and capability-based behavior; value2disables automatic connection. - The setting is device-scoped and is listed for Windows 10 version 1809 and later on Pro, Enterprise, Education, and IoT Enterprise editions.
- Reports about disabling it to resolve OneDrive silent sign-in are mixed and anecdotal, so they should not be treated as a guaranteed solution.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
