# Local account or Microsoft account: what actually differs

> Device encryption, account recovery, settings sync and app access depend on this choice — and switching later has a cost.

**Tested on**

- Build: 26300.9457
- Edition: Pro (26H2)
- Architecture: x64
- Evidence: E1
- Verified: 2026-10-29

## The short answer

The account type decides four things, and only one of them is about privacy:

| | Local account | Microsoft account |
|---|---|---|
| **Password recovery** | none (you reinstall or use a reset disk) | self-service online |
| **Device encryption** | needs a separate key escrow | key attaches to the account |
| **Settings/theme sync** | no | yes |
| **Store / subscriptions** | separate sign-in | automatic |

A local account is not "more secure" by default and an MSA is not "more convenient" by default. The right answer depends on whether you can afford to lose access to the machine.

## What the MSA actually keys

- **BitLocker/device encryption recovery key** — when the OS enables device encryption automatically, the key is escrowed to the Microsoft account. On a local account there is no escrow: you must save the key yourself or you lose the data when the TPM changes.
- **Windows Hello PIN** — bound to the device and TPM, not to the account type.
- **Find my device / device history** — MSA only.
- **Store purchases, Office/Microsoft 365, Game Pass** — MSA.

```powershell
# which account type is signed in
whoami
Get-CimInstance Win32_ComputerSystem | Select-Object UserName
dsregcmd /status | Select-String 'AzureAdJoined|WorkplaceJoined'
```

`AzureAdJoined : YES` means Entra (work/school) join — a third case, covered below.

## The three account kinds, not two

| Kind | Typical use | Where credentials live |
|---|---|---|
| **Local** | offline machines, labs, kiosks | SAM database on the device |
| **Microsoft account** | home PCs | Microsoft identity platform |
| **Entra ID (work/school)** | managed devices | your organisation |

A machine can be Entra-joined **and** have a local administrator — that is the normal managed configuration, not a contradiction.

## Switching later

**Local → MSA** is easy and mostly reversible ("sign in with a local account instead"), but Windows pushes back on the reverse path and may require disconnecting the account first.

**MSA → local** keeps your files, but:

- **device encryption** may stay on with a key you no longer have easy access to — check before switching;
- **Store apps** may require re-sign-in;
- **Windows Hello PIN** usually needs to be re-created.

```powershell
# check encryption state before switching anything
manage-bde -status C:
```

> **Caution: Do not switch accounts on a BitLocker machine without the recovery key**
>
> If device encryption is on and the key lives only in the Microsoft account, signing out of that account can leave the drive encrypted with a key you cannot retrieve. Export the key first — see the [BitLocker recovery drill](https://windows.homes/en/windows/hardening/bitlocker-recovery-drill/).

## Practical recommendations

| Machine | Recommendation |
|---|---|
| Home PC, one user | MSA, with the recovery key exported to a safe place |
| Lab/VM, no personal data | local account |
| Machine that must work offline forever | local account + documented password |
| Shared family PC | MSA per person (separate profiles) |
| Kiosk / single-app | local account with assigned access |

## Related

- [Windows Hello, PIN and password](https://windows.homes/en/windows/account/hello-pin/)
- [A corrupt profile: create a user and migrate](https://windows.homes/en/windows/account/profile-corruption/)
- [BitLocker recovery drill](https://windows.homes/en/windows/hardening/bitlocker-recovery-drill/)

## Lab boundary

E1. Account behaviour is documented by Microsoft; the lab VMs use local accounts only, so no MSA sign-in flow was exercised here.

## Sources

- [Microsoft Learn — Accounts CSP](https://learn.microsoft.com/en-us/windows/client-management/mdm/accounts-csp)
- [Microsoft Learn — Identity protection](https://learn.microsoft.com/en-us/windows/security/identity-protection/)
- [Microsoft Learn — Windows 11 overview](https://learn.microsoft.com/en-us/windows/whats-new/windows-11-overview)

---

Source: https://windows.homes/en/windows/account/local-vs-msa/