Intune has this built in now. No need to create a custom profile. https://www.petervanderwoude.nl/post/restricting-the-local-log-on-to-specific-users/ You can point to groups instead of users. Just add one user or group per line and you will be fine.

I also need a way to apply this to a specific group, rather than each machine and individual user. I have 61 machines that I need to restrict login to with any account other than the ones in a specific group, and don’t want to go through and create a configuration profile for each one

Thank you for this; it really helped me. But the question is, how do we reverse this? E.g., we only allow user1@aad.com to log in and block everyone else, let’s say user2@aad.com; how do we revert this to allow user2@aad.com to log in again after being blocked by this?

I am getting the same error message. Were you able to resolve this issue? If so, can you let me know what method was used? Thank you!

So this method suggests we need 400 profiles and 400 groups containing one laptop each.

Wow! MS really need to provide a proper solution.

Hi Peter,

I am not sure the exact value that needs to go in it says AdministratorsAzureAD\user@xyz.com. What is the question mark symbol betweek Administrators and AzureAD and can I specify this policy as user@xyz.com or how do I do this for all user? Let us say I login to the device as User1 and User3 my User1 is jon.doe@xyz.com and User3 is don.king@xyz.com.

How would I put this value for all users? I do not want to be specific and it cannot be as it has to be generic for all users. I hope I am clear in that I asking for?

Do you know if this works on Windows Holographic ?
I’ve tried but have no success at all, the policy doesn’t seem to be affected to the device on Intune..