Hide “Account Protection” in Windows Security Using Intune

If you manage sign-in and identity security settings with Intune, you have probably seen this scenario before:

A user opens the Windows Security app, clicks Account protection, and starts poking around. Next thing you know, you are dealing with tickets about “missing settings,” “something changed,” or “why does my device keep asking me to set up Hello.”

The good news is you can clean this up with a simple Intune policy that hides the Account protection section in Windows Security. Users stop seeing the button, and your environment stays consistent with how you want identity controls managed.

This post walks you through exactly how to set it up, how it behaves, and how to verify it worked.

---

What This Policy Actually Does

This setting is all about the user interface.

When enabled, it:

• Removes “Account protection” from the Windows Security home screen and sidebar
• Reduces user-driven changes and confusion around identity-related options
• Helps keep endpoints aligned with the security posture you enforce through Intune

What it does not do:

• It does not turn off features like Windows Hello for Business or Credential Guard
• It does not remove every possible place a user might find sign-in options in Windows

Think of it as: “Hide the dashboard button,” not “disable the engine.”

---

Why You Might Want to Hide Account Protection

Here are the most common reasons admins enable this:

• Fewer helpdesk tickets: Less clicking around means fewer “I changed something and now it is broken” situations.
• Cleaner ownership: If identity settings are managed by IT, it makes sense to keep those controls out of the end user’s hands.
• Consistency: Users see the same simplified Windows Security layout across managed devices.
• Reduced confusion during rollouts: When you are rolling out Hello for Business or other identity changes, you can keep the UI tidy while policies settle.

---

Step-by-Step: Create the Policy in Intune

1) Go to the right place

In the Intune admin center:

• Go to Endpoint security
• Select Antivirus
• Click + Create policy

2) Pick the profile

Use these options:

• Platform: Windows 10, Windows 11, and Windows Server
• Profile: Windows Security experience

3) Name the policy

Use a clear naming convention, for example:

• WSEC_AccountProtection_Hide

If you manage multiple tenants or use RBAC and scope tags, consistent naming saves a lot of time later.

4) Configure the setting

In the policy settings:

• Expand Windows Defender Security Center
• Expand Account protection
• Find the setting that looks like:
  • Hide the Account protection area
  • or Account protection area visibility
• Set it to Enabled (or Yes, depending on the wording)

Once enabled, the Account protection section disappears from the Windows Security app.

---

Assign It the Right Way

This should be treated like a device policy, not a user preference.

• Assign it to a device group
• Avoid mixing user-based assignments unless you have a specific reason
• Use scope tags if your organization separates duties across different admin teams

---

What Users Will See

After the policy applies:

• Windows Security opens normally
• The Account protection tile is simply gone
• Users do not get a button to click into that area

It feels clean and intentional, not broken.

---

How to Verify It Worked

1) Trigger a sync

On the device, you can run a manual sync:

• From Company Portal, or
• From Windows Settings under work or school account sync

2) Check the Windows Security app

Open Windows Security and confirm:

• Account protection is missing from the home screen and sidebar

3) Confirm via registry (optional but reliable)

If you want a quick admin-level check, you can validate the setting in the registry:

• Location:
  • HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Account protection
• Value:
  • UILockdown

If UILockdown is set to 1, the UI is hidden.

4) Confirm via event logs (great for troubleshooting)

If you want proof the policy arrived through MDM:

• Open Event Viewer
• Go to the MDM diagnostics logs (Device Management area)
• Look for entries that show the setting was applied successfully

This is especially useful when the policy is assigned correctly, but the endpoint is slow to reflect the UI change.

---

Rollback: Make It Visible Again

If you ever need to restore access:

• Set the policy setting back to Not Configured or Disabled
• Sync the device again

The Account protection section will return to its default visible state.

---

Final Thoughts

Hiding Account protection is a small change that makes a big difference in real-world environments. It keeps Windows Security cleaner for end users, reduces unnecessary changes, and reinforces a simple message: identity and security controls are managed by policy, not by clicking around.

If you are already managing Hello for Business, Credential Guard, or sign-in hardening through Intune, this is one of those “quiet wins” that helps everything feel more stable.

Done right, users never notice it. And that is the point.