{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-005-check-exchange-activesync-policy-when-an-autopilot-kiosk-fails-to-sign-in/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260917-005-check-exchange-activesync-policy-when-an-autopilot-kiosk-fails-to-sign-in/", "slug": "dse-20260917-005-check-exchange-activesync-policy-when-an-autopilot-kiosk-fails-to-sign-in", "url": "https://update.dsesecurity.com/updates/dse-20260917-005-check-exchange-activesync-policy-when-an-autopilot-kiosk-fails-to-sign-in/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260917-005-check-exchange-activesync-policy-when-an-autopilot-kiosk-fails-to-sign-in.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-005-check-exchange-activesync-policy-when-an-autopilot-kiosk-fails-to-sign-in/" }, "title": "Check Exchange ActiveSync policy when an Autopilot kiosk fails to sign in automatically", "summary": "Which policy interaction can break automatic sign-in after self-deploying Autopilot provisioning?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "cyber-defense", "label": "Cyber defense", "alt": "Layered glass and metal cyber-defense structure with controlled blue and gold signal paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-17T16:34:55+00:00", "modified_at": "2026-09-17T16:35:03+00:00", "reviewed_on": "2026-09-17", "reading_minutes": 1, "word_count": 212, "potentially_affected": "Use this diagnostic check for a Windows kiosk or digital-signage deployment that uses Autopilot self-deploying mode and an intended local-account automatic sign-in configuration. Confirm the actual deployment mode before applying the guidance.", "dse_recommendation": "DSE recommends checking the kiosk's effective assignments for the documented EAS interaction before repeatedly resetting it.", "primary_source": { "name": "Windows Autopilot self-deploying mode | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/autopilot/self-deploying", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft documents that self-deploying Autopilot can be combined with MDM policy to create a local account configured for automatic sign-in. It specifically warns that deploying Exchange ActiveSync policies in self-deploying kiosk scenarios causes automatic sign-in to fail. Self-deploying mode supports Microsoft Entra join and does not support Microsoft Entra hybrid join. Microsoft Learn.

\n

Applicability

\n

Use this diagnostic check for a Windows kiosk or digital-signage deployment that uses Autopilot self-deploying mode and an intended local-account automatic sign-in configuration. Confirm the actual deployment mode before applying the guidance.

\n

DSE recommendation

\n

DSE recommends checking the kiosk’s effective assignments for the documented EAS interaction before repeatedly resetting it. Record the desired sign-in behavior and identify the owner of every applicable policy. If EAS policy is implicated, agree on a supported assignment correction and its security implications with that owner; avoid weakening unrelated controls as a troubleshooting shortcut.

\n

Verification

\n

Use a representative test kiosk to compare the assigned policies with the observed post-provisioning sign-in behavior. Verify that the expected kiosk application starts under the intended account and that support can still use the approved maintenance route. Keep the before-and-after assignment evidence with the result, and distinguish a reproduced policy interaction from an unconfirmed hypothesis.

\n

Official references

\n

Microsoft Learn: Windows Autopilot self-deploying mode. Source reviewed September 17, 2026.

", "content_text": "Source facts\nMicrosoft documents that self-deploying Autopilot can be combined with MDM policy to create a local account configured for automatic sign-in. It specifically warns that deploying Exchange ActiveSync policies in self-deploying kiosk scenarios causes automatic sign-in to fail. Self-deploying mode supports Microsoft Entra join and does not support Microsoft Entra hybrid join. Microsoft Learn.\nApplicability\nUse this diagnostic check for a Windows kiosk or digital-signage deployment that uses Autopilot self-deploying mode and an intended local-account automatic sign-in configuration. Confirm the actual deployment mode before applying the guidance.\nDSE recommendation\nDSE recommends checking the kiosk’s effective assignments for the documented EAS interaction before repeatedly resetting it. Record the desired sign-in behavior and identify the owner of every applicable policy. If EAS policy is implicated, agree on a supported assignment correction and its security implications with that owner; avoid weakening unrelated controls as a troubleshooting shortcut.\nVerification\nUse a representative test kiosk to compare the assigned policies with the observed post-provisioning sign-in behavior. Verify that the expected kiosk application starts under the intended account and that support can still use the approved maintenance route. Keep the before-and-after assignment evidence with the result, and distinguish a reproduced policy interaction from an unconfirmed hypothesis.\nOfficial references\nMicrosoft Learn: Windows Autopilot self-deploying mode. Source reviewed September 17, 2026.", "content_markdown": "## Source facts\n\nMicrosoft documents that self-deploying Autopilot can be combined with MDM policy to create a local account configured for automatic sign-in. It specifically warns that deploying Exchange ActiveSync policies in self-deploying kiosk scenarios causes automatic sign-in to fail. Self-deploying mode supports Microsoft Entra join and does not support Microsoft Entra hybrid join. [Microsoft Learn](https://learn.microsoft.com/en-us/autopilot/self-deploying).\n\n## Applicability\n\nUse this diagnostic check for a Windows kiosk or digital-signage deployment that uses Autopilot self-deploying mode and an intended local-account automatic sign-in configuration. Confirm the actual deployment mode before applying the guidance.\n\n## DSE recommendation\n\nDSE recommends checking the kiosk’s effective assignments for the documented EAS interaction before repeatedly resetting it. Record the desired sign-in behavior and identify the owner of every applicable policy. If EAS policy is implicated, agree on a supported assignment correction and its security implications with that owner; avoid weakening unrelated controls as a troubleshooting shortcut.\n\n## Verification\n\nUse a representative test kiosk to compare the assigned policies with the observed post-provisioning sign-in behavior. Verify that the expected kiosk application starts under the intended account and that support can still use the approved maintenance route. Keep the before-and-after assignment evidence with the result, and distinguish a reproduced policy interaction from an unconfirmed hypothesis.\n\n## Official references\n\n[Microsoft Learn: Windows Autopilot self-deploying mode](https://learn.microsoft.com/en-us/autopilot/self-deploying). Source reviewed September 17, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260917-005-check-exchange-activesync-policy-when-an-autopilot-kiosk-fails-to-sign-in/", "url": "https://update.dsesecurity.com/updates/dse-20260917-005-check-exchange-activesync-policy-when-an-autopilot-kiosk-fails-to-sign-in/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-17" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260917-005-check-exchange-activesync-policy-when-an-autopilot-kiosk-fails-to-sign-in/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Check Exchange ActiveSync policy when an Autopilot kiosk fails to sign in automatically", "item": "https://update.dsesecurity.com/updates/dse-20260917-005-check-exchange-activesync-policy-when-an-autopilot-kiosk-fails-to-sign-in/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260917-005-check-exchange-activesync-policy-when-an-autopilot-kiosk-fails-to-sign-in/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260917-005-check-exchange-activesync-policy-when-an-autopilot-kiosk-fails-to-sign-in/", "url": "https://update.dsesecurity.com/updates/dse-20260917-005-check-exchange-activesync-policy-when-an-autopilot-kiosk-fails-to-sign-in/", "headline": "Check Exchange ActiveSync policy when an Autopilot kiosk fails to sign in automatically", "description": "Which policy interaction can break automatic sign-in after self-deploying Autopilot provisioning?", "abstract": "Which policy interaction can break automatic sign-in after self-deploying Autopilot provisioning?", "articleBody": "Source facts\nMicrosoft documents that self-deploying Autopilot can be combined with MDM policy to create a local account configured for automatic sign-in. It specifically warns that deploying Exchange ActiveSync policies in self-deploying kiosk scenarios causes automatic sign-in to fail. Self-deploying mode supports Microsoft Entra join and does not support Microsoft Entra hybrid join. Microsoft Learn.\nApplicability\nUse this diagnostic check for a Windows kiosk or digital-signage deployment that uses Autopilot self-deploying mode and an intended local-account automatic sign-in configuration. Confirm the actual deployment mode before applying the guidance.\nDSE recommendation\nDSE recommends checking the kiosk’s effective assignments for the documented EAS interaction before repeatedly resetting it. Record the desired sign-in behavior and identify the owner of every applicable policy. If EAS policy is implicated, agree on a supported assignment correction and its security implications with that owner; avoid weakening unrelated controls as a troubleshooting shortcut.\nVerification\nUse a representative test kiosk to compare the assigned policies with the observed post-provisioning sign-in behavior. Verify that the expected kiosk application starts under the intended account and that support can still use the approved maintenance route. Keep the before-and-after assignment evidence with the result, and distinguish a reproduced policy interaction from an unconfirmed hypothesis.\nOfficial references\nMicrosoft Learn: Windows Autopilot self-deploying mode. Source reviewed September 17, 2026.", "datePublished": "2026-09-17T16:34:55+00:00", "dateModified": "2026-09-17T16:35:03+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260917-005-check-exchange-activesync-policy-when-an-autopilot-kiosk-fails-to-sign-in/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260917-005-check-exchange-activesync-policy-when-an-autopilot-kiosk-fails-to-sign-in/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Check Exchange ActiveSync policy when an Autopilot kiosk fails to sign in automatically" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 212, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Windows Autopilot self-deploying mode | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/autopilot/self-deploying" } } ] } }