# Check Exchange ActiveSync policy when an Autopilot kiosk fails to sign in automatically

> Which policy interaction can break automatic sign-in after self-deploying Autopilot provisioning?

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-005-check-exchange-activesync-policy-when-an-autopilot-kiosk-fails-to-sign-in/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:34:55+00:00
- Modified: 2026-09-17T16:35:03+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, IT
- Reading time: 1 minutes

## What you need to know

Which policy interaction can break automatic sign-in after self-deploying Autopilot provisioning?

## Potentially affected

Use this diagnostic check for a Windows kiosk or digital-signage deployment that uses Autopilot self-deploying mode and an intended local-account automatic sign-in configuration. Confirm the actual deployment mode before applying the guidance.

## DSE recommendation

DSE recommends checking the kiosk's effective assignments for the documented EAS interaction before repeatedly resetting it.

## Article

## Source facts

Microsoft documents that self-deploying Autopilot can be combined with MDM policy to create a local account configured for automatic sign-in. It specifically warns that deploying Exchange ActiveSync policies in self-deploying kiosk scenarios causes automatic sign-in to fail. Self-deploying mode supports Microsoft Entra join and does not support Microsoft Entra hybrid join. [Microsoft Learn](https://learn.microsoft.com/en-us/autopilot/self-deploying).

## Applicability

Use this diagnostic check for a Windows kiosk or digital-signage deployment that uses Autopilot self-deploying mode and an intended local-account automatic sign-in configuration. Confirm the actual deployment mode before applying the guidance.

## DSE recommendation

DSE recommends checking the kiosk’s effective assignments for the documented EAS interaction before repeatedly resetting it. Record the desired sign-in behavior and identify the owner of every applicable policy. If EAS policy is implicated, agree on a supported assignment correction and its security implications with that owner; avoid weakening unrelated controls as a troubleshooting shortcut.

## Verification

Use a representative test kiosk to compare the assigned policies with the observed post-provisioning sign-in behavior. Verify that the expected kiosk application starts under the intended account and that support can still use the approved maintenance route. Keep the before-and-after assignment evidence with the result, and distinguish a reproduced policy interaction from an unconfirmed hypothesis.

## Official references

[Microsoft Learn: Windows Autopilot self-deploying mode](https://learn.microsoft.com/en-us/autopilot/self-deploying). Source reviewed September 17, 2026.

## Primary reference

- Name: Windows Autopilot self-deploying mode | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/autopilot/self-deploying
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Check Exchange ActiveSync policy when an Autopilot kiosk fails to sign in automatically,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-005-check-exchange-activesync-policy-when-an-autopilot-kiosk-fails-to-sign-in/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.