What is a WSI Account in Windows 11 and How Does It Affect Your PC
If you have spotted an account called WsiAccount on a Windows 11 PC — in the list of user folders, in an account listing, or flagged by security software — it can look suspicious. It is not an account you created, and it is not a sign that someone else has been using the PC. WsiAccount is a legitimate, system-managed local account that Windows itself creates to support Web Sign-In. This article explains what it is, why it appears, and why you should leave it alone.
What WSI stands for
WSI stands for Web Sign-In. Web Sign-In is a credential provider in Windows — one of the components that offers a way to sign in at the lock screen, alongside familiar options such as password, PIN and Windows Hello. Instead of checking a password locally, the Web Sign-In provider presents a web-based sign-in experience on the lock screen and authenticates you against your organisation's cloud identity in Microsoft Entra ID, returning a sign-in token to Windows so you can unlock the device.
The WsiAccount is the helper account behind that provider. Microsoft's documentation describes it as a system-managed local account: Windows creates it automatically when Web Sign-In is enabled, it is enabled each time someone uses the Web Sign-In credential provider, and it is disabled again after the user has signed in. It does not appear in the normal user selection list on the sign-in screen, and it is not an account a person signs in with directly.
Why the account appears on the PC
Because WsiAccount is a real local account under the hood, traces of it can show up where accounts or profiles are listed — for example a WsiAccount folder under the Users folder. On most personal PCs you will never see it. It is most likely to be noticed on a work or school device, because Web Sign-In is a feature organisations enable deliberately, usually through device management policy. Seeing it simply means Web Sign-In has been enabled or used on that device; the account does the temporary behind-the-scenes work the sign-in flow needs before your own profile loads.
When would you actually encounter Web Sign-In?
Web Sign-In was first introduced in Windows 10 with a single supported scenario: the Temporary Access Pass. A Temporary Access Pass is a time-limited passcode an IT administrator issues to a user — for example, to let a new employee sign in for the first time and set up their own sign-in methods, or to recover access when a PIN or other method is not working. The user picks the Web Sign-In option at the lock screen and enters the pass instead of a password they do not yet have.
Starting with Windows 11 version 22H2 with update KB5030310, Microsoft expanded Web Sign-In on Microsoft Entra joined devices to cover more passwordless scenarios, including:
- Signing in with the Microsoft Authenticator app
- Resetting a Windows Hello for Business PIN
- Signing in through a federated identity provider that uses SAML-P
Microsoft's documentation sets conditions for the feature: the device must be Microsoft Entra joined, it needs an internet connection because authentication happens online, and Web Sign-In is not supported on Microsoft Entra hybrid joined or domain joined devices. In practice, that means Web Sign-In — and therefore WsiAccount — belongs to modern work and school PCs managed in the cloud, not to a typical home PC signed in with a personal Microsoft account.
Should you delete the WSI account?
No. Microsoft's guidance is clear that these accounts should not be removed, because system functions depend on them. The account is managed by Windows itself: it is created automatically, switched on only while Web Sign-In is being used, and switched off again afterwards. Deleting it or deleting its folder does not improve performance or security, and it can break the Web Sign-In flow the next time someone on that device needs it — which tends to be exactly the stressful moment, such as a first-day sign-in or an account recovery, when a Temporary Access Pass is the only way in.
If the PC belongs to your employer or school and sign-in is behaving oddly — for example, Web Sign-In appearing when it should not — contact your IT administrator rather than removing accounts yourself. Web Sign-In is controlled by organisational policy, so only the administrator can change it properly. On a personal PC where sign-in works normally, there is nothing to do: it is a dormant system account, not an intruder.
Frequently asked questions
Is WsiAccount a virus or a hacked account?
No. WsiAccount is a legitimate account created and managed by Windows to support Web Sign-In. Its presence on an Entra joined work or school device is expected.
Can I sign in as WsiAccount?
No. It is not displayed in the user selection list and is not meant for interactive sign-in. Windows enables it temporarily while the Web Sign-In provider runs, then disables it.
What does WSI stand for?
Web Sign-In — the Windows credential provider that provides a web-based sign-in experience at the lock screen, used for scenarios such as Temporary Access Pass sign-in on Microsoft Entra joined devices.
Can I safely delete the WsiAccount folder to save space?
You should not. The account and its profile are system-managed, take negligible space, and are needed for Web Sign-In to work. Leave them in place.