Map Windows accounts to people (SID)

To know which phone to send the request to, each Windows account (its SID) must be mapped to a person. An unmapped account is refused with the same screen as any other refusal, and nothing is sent to any phone.

Domain accounts: on every computer

1. Open «Manage» › «Computers» › «Windows accounts on every computer».
2. Fill in «Windows account SID», «Person (email)» and, if you like, «Note» (up to 64 characters).
3. Choose «Map account». «The Windows account was mapped.» appears.

«A domain account (its SID) belongs to one person on every computer. A computer's own mapping, in its details, wins.»

Local accounts: on one computer

1. Open the computer's «Details».
2. Under «Windows accounts on this computer», map the local account's SID to the person.

How do I get the SID?

• In the person's session: whoami /user.
• For a local account: (Get-LocalUser ana).SID.
• A SID looks like S-1-5-21-…-1001. Anything else is refused: «Type a Windows SID such as S-1-5-21-…-1001.»

Accounts that should not ask for a second factor

Service accounts that sign in with a password only are set in the computer policy, under «Service accounts that sign in with a password only (SIDs, one per line)». See Offline and break-glass policy.

Removing a mapping

Choose «Remove» on the row. «The mapping was removed.» appears. From then on, that account is refused on that computer or computers.

The person gets no request

Check the mapping and the computer's history: the reason «unknown Windows account» means a missing mapping.