Check Exchange ActiveSync policy when an Autopilot kiosk fails to sign in automatically

Source facts

Microsoft documents that self-deploying Autopilot can be combined with MDM policy to create a local account configured for automatic sign-in. It specifically warns that deploying Exchange ActiveSync policies in self-deploying kiosk scenarios causes automatic sign-in to fail. Self-deploying mode supports Microsoft Entra join and does not support Microsoft Entra hybrid join. Microsoft Learn.

Applicability

Use this diagnostic check for a Windows kiosk or digital-signage deployment that uses Autopilot self-deploying mode and an intended local-account automatic sign-in configuration. Confirm the actual deployment mode before applying the guidance.

DSE recommendation

DSE recommends checking the kiosk’s effective assignments for the documented EAS interaction before repeatedly resetting it. Record the desired sign-in behavior and identify the owner of every applicable policy. If EAS policy is implicated, agree on a supported assignment correction and its security implications with that owner; avoid weakening unrelated controls as a troubleshooting shortcut.

Verification

Use a representative test kiosk to compare the assigned policies with the observed post-provisioning sign-in behavior. Verify that the expected kiosk application starts under the intended account and that support can still use the approved maintenance route. Keep the before-and-after assignment evidence with the result, and distinguish a reproduced policy interaction from an unconfirmed hypothesis.

Official references

Microsoft Learn: Windows Autopilot self-deploying mode. Source reviewed September 17, 2026.