Managing Windows devices in environments like schools, libraries, or retail stores often requires a secure, multi‑user setup. Microsoft Intune’s Shared PC mode simplifies this by ensuring each user gets a clean, temporary session while administrators retain control over accounts, storage, and policies. In this guide, we’ll walk through how to configure a shared multi‑user device profile in Intune, covering account management, deletion thresholds, power policies, and education‑specific settings. By the end, you’ll be able to deploy shared devices that are secure, efficient, and easy to maintain.
Create a Shared Multi-User Device Profile in Intune
Microsoft Intune allows administrators to configure Shared PC mode (multi‑user devices) through the Intune settings catalog. In organizational environments, Shared PC mode can be set up to support both guest accounts and domain accounts. When using domain accounts, user data is retained until the configured account deletion threshold is reached. This threshold can automatically remove older accounts when disk space is low or when accounts remain inactive for a defined period. As a result, storage is freed up automatically without requiring manual intervention from administrators, keeping shared devices secure and efficient.
Follow the steps below to create a shared multi-user device profile in Microsoft Intune.
Create a Shared Multi‑User Device Profile in Intune
- Sign in to the Microsoft Intune Admin Center.
- Navigate to Devices > Windows > Configuration.
- Select Create.
- In the Create a Profile flyout window, provide the following details:
- Platform: Windows 10 and later
- Profile type: Templates
- Template name: Shared multi‑user device
- Click Create to generate the profile.
Configure Profile Basics in Intune
On the Profile Basics page, enter a clear profile name and a descriptive profile description (e.g., Shared Multi‑User Device – Library PCs).
Ensure the name and description make it easy to identify the profile later in the Intune console.
Click Next to continue to the Configuration settings page.
Configure Shared PC Settings in Intune
On the Configuration settings page, configure the following options:
- Shared PC mode
- Select Enable or Disable.
- When enabled, the device is optimized for shared use, allowing only one user to log in at a time.
- Guest account
- Choose one of three options: Guest, Domain, or Guest and Domain.
- Account Management
- Select Enabled or Disabled.
- When enabled, accounts are automatically deleted during sign‑out or scheduled maintenance.
- Account Deletion Options Shared PC mode can be configured to delete accounts:
- At storage space threshold
- At storage space threshold and inactive threshold
- Immediately after logout
- Start Delete threshold (%)
- The account manager begins deleting old accounts once device free space falls below the defined threshold.
- Stop Delete threshold (%)
- The account manager stops deleting accounts once free space rises above the defined threshold.
- Inactive account threshold
- Define the number of consecutive days an account can remain inactive.
- Local storage
- When enabled, users can save files to the local hard disk and access them later.
- Power policies
- By default, this policy is not configured.
- If disabled, users cannot change power settings on the device.
- Sleep timeout
- Define the number of inactive seconds before the device automatically enters sleep mode.
- Maintenance start time (minutes from midnight)
- Specify when automatic maintenance tasks (such as software updates) should run.
- Enter the number of minutes from midnight.
- Example: 60 minutes = 01:00 AM.
- Education policies
- Recommended for devices in schools.
- Applies education‑specific settings to optimize shared PC mode for classroom environments.
Assign the Shared PC Policy in Intune
- On the Assignments page, choose how to deploy the policy:
- All users
- All devices
- Specific Entra ID (Azure AD) user or device groups
- Optionally, apply Intune assignment filters for more granular targeting (e.g., by device type, OS version, or tags).
Review and Create the Shared PC Policy
On the Review + Create page, carefully review all configured settings (Basics, Configuration, Assignments).
Confirm that the policy details are correct and aligned with your deployment requirements.
Click Create to complete the policy creation process.
End User Experience
Since the Guest account option was configured as “Guest and Domain”, the Windows login screen will display both Other user and Guest options:
- Other user: Allows users to enter their organization’s email ID and password to sign in with their domain account.
- Guest: Provides a temporary session for guest users, with no data retained after sign‑out.
This configuration ensures flexibility — domain users can access organizational resources securely, while guest users can log in quickly without leaving behind persistent data.
When you click on Guest user, the device automatically signs in using a guest account.
A new guest account is created every time someone logs in with the Guest option.
Guest accounts are temporary — no data or settings are retained after sign‑out.
This ensures that shared devices remain clean and secure, while providing quick access for users who don’t require persistent profiles.
Guest vs Domain Accounts in Shared PC Mode
| Feature / Behavior | Guest Account | Domain Account |
|---|---|---|
| Login Option | Selected via Guest on login screen | Selected via Other user on login screen |
| Account Creation | A new guest account is created at each login | Existing domain account is used |
| Data Retention | No data retained after sign‑out | Data is retained until the deletion threshold is reached |
| Persistence | Temporary, session‑based | Persistent until cleanup rules apply |
| Use Case | Quick access for temporary users (e.g., library visitors) | Secure access for organizational users with credentials |
| Management | Automatically deleted at logout | Managed via account deletion thresholds (storage/inactivity) |
Best Practices for Shared PC Mode
- Use Guest accounts
- Ideal for kiosks, libraries, training labs, or retail demo devices.
- Ensures no data is retained after sign‑out, keeping devices clean and secure.
- Simplifies management since accounts are automatically deleted.
- Use Domain accounts
- Recommended for staff PCs, classrooms, or environments where users need access to organizational resources.
- Data is retained until deletion thresholds are met, allowing continuity for domain users.
- Provides secure authentication with organizational credentials.
- Mixed Mode (Guest and Domain)
- Best for environments with both temporary and permanent users (e.g., schools with students and visiting guests).
- Offers flexibility while maintaining security and efficiency.
Conclusion
Configuring Shared PC mode in Intune provides organizations with a secure and efficient way to manage multi‑user devices. By tailoring account options, deletion thresholds, storage policies, and education‑specific settings, administrators can ensure that shared devices remain clean, optimized, and easy to maintain. Whether deployed in schools, libraries, retail environments, or training labs, Shared PC mode balances flexibility with control — allowing guest users quick access while enabling domain users to securely connect to organizational resources. With the right configuration, Intune helps reduce administrative overhead and delivers a seamless end‑user experience across shared environments.
Related Posts
- How to Allow Copilot in Microsoft Edge Using Intune
- Configure Microsoft Edge Sleeping Tabs using Microsoft Intune
- How to Configure Google Chrome settings using Administrative templates | Intune
- Manage Desktop Wallpaper with Microsoft Intune
- Manage Edge Chromium Favorites with Intune
Subscribe to Techuisitive Newsletter
Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news.