How to Add a Separate User Account in Windows 11 and Choose the Right Access Level

Separate user accounts keep each person’s files, settings, and application access distinct on a shared Windows 11 device. They also help separate personal activity from work or school activity. Microsoft recommends limiting administrator accounts because administrators can change system settings, install software, and access files across the device. [1]

Choose the account type first

• Microsoft account: useful when the person needs Microsoft services and account synchronization.
• Work or school account: appropriate when the device or organization uses Microsoft Entra ID and managed work resources.
• Local account: works only on the device and can be useful for a limited-purpose local profile.
• Standard user: the safer default for day-to-day work.
• Administrator: reserve for people who genuinely need to install software or change device-wide settings.

1. Add the account in Windows Settings

1. Open Settings.
2. Select Accounts, then Other users.
3. Under Add other user, select Add account.
4. If the person already has a Microsoft account, enter its email address.
5. If you want to create a local account, choose I don’t have this person’s sign-in information, then select Add a user without a Microsoft account.
6. Follow the prompts to finish creating the profile.

Microsoft recommends a Microsoft account for most Windows sign-ins because it supports Microsoft-service integration, security features, and synchronization. Choose a local account deliberately rather than treating it as the default for every shared device. [1]

2. Set the account to Standard user

1. Return to Settings > Accounts > Other users.
2. Open the account’s options.
3. Select Change account type.
4. Choose Standard User, then select OK.

Use a standard account for children, guests, and most employees on a shared workstation. If an administrator action is needed, Windows can request administrator credentials without making the daily profile permanently privileged.

3. Connect a work or school account separately

If the device is personal or shared but also needs access to organizational resources, open Settings > Accounts > Access work or school and select Connect. Enter the work or school account and follow the organization’s sign-in prompts. Microsoft notes that the organization must support personal-device or BYOD access for this connection to work as intended. [1]

4. Verify the new profile

1. Sign out of the current Windows session.
2. Select the new user from the sign-in screen.
3. Complete the first-sign-in setup.
4. Confirm that the user can access only the files, apps, and resources intended for that account.
5. Test a routine task that requires elevation only if the account is supposed to have administrator rights.

5. Remove an account safely

To remove the local profile from the device, go to Settings > Accounts > Other users, open the account options, and select Remove. Removing the profile removes its sign-in information and data from that device; it does not delete the person’s Microsoft account. Before removing a profile, copy any files the person still needs. [1]

Practical account policy

For a family or small business device, create one account per person, use standard access for normal work, reserve administration for a controlled account, and keep work or school access separate from personal profiles. This simple structure reduces accidental changes and makes it easier to identify who owns a file or setting.

Sources

1. Microsoft Support: Manage user accounts in Windows