Setting up OpenSSH on Windows 11 with a Microsoft Account

To enable the OpenSSH server on Windows 11 with a Microsoft Account, you must first install the optional feature via Settings or PowerShell, then configure the SSH service to start automatically. You should also ensure your account password is set rather than relying solely on a PIN, as standard SSH authentication typically requires a static password for remote access.

Installing the OpenSSH Server Feature

Windows 11 does not include the OpenSSH server components by default, although it includes the client. To remedy this, you need to add the feature through the system settings or command line. This process installs the necessary binaries and service definitions required to accept incoming SSH connections. The most straightforward method involves using the graphical interface. Navigate to Settings > Apps > Optional Features. From there, select View features and search for "OpenSSH Server." If it appears in the list, check the box and click Install. If it does not appear, it may already be installed, or you may need to use the package manager method below. Alternatively, you can use PowerShell to install the feature. Open PowerShell as an Administrator and run the following command:

Get-WindowsCapability -Online | Where-Object Name -like 'OpenSSH.Server~~~~*'

This command queries the system for available capabilities matching the OpenSSH server pattern. It will return the specific name of the capability currently available on your build of Windows 11. Once you have identified the correct name from the output, you can install it using:

Add-WindowsCapability -Online -Name <CapabilityName>

Replace <CapabilityName> with the exact string returned by the previous command, such as 'OpenSSH.Server~~~~0.0.1.0' if that version is present. Note that the version suffix varies depending on your Windows update status, so always rely on the dynamic query result rather than hardcoding a version number. After installation, verify that the service is listed by running:

Get-Service sshd

If the service exists but is stopped, proceed to the configuration steps below.

Configuring the SSH Service

Once the software is installed, the SSH daemon (sshd) service is usually in a "Stopped" state and set to "Manual" startup. For a persistent setup, you should change these defaults. Open PowerShell as Administrator again and execute:

Set-Service -Name sshd -StartupType Automatic

This ensures that the SSH server starts every time the computer boots. Next, start the service immediately with:

Start-Service -Name sshd

You can verify the service is running by checking its status or attempting a local connection. The default configuration file is located at C:\ProgramData\ssh\sshd_config. While the default settings are often sufficient for basic usage, you may need to adjust permissions or firewall rules depending on your security requirements.

Handling Microsoft Account Authentication

A common point of confusion when using a Microsoft Account (MSA) is the authentication mechanism. Unlike local accounts, MSAs do not have a traditional static password stored locally on the device in the same way. Instead, they rely on a PIN or biometric data for interactive logins. However, the OpenSSH server expects a password-based authentication method by default. To resolve this, you must ensure that a password is associated with your Microsoft Account. Go to Settings > Accounts > Sign-in options. Look for the Password section. If it says "Change" or "Add," click it to set a password. This password is used to sync your Microsoft Account across devices and serves as the credential for SSH login. It is important to note that you cannot use your PIN directly for SSH authentication unless you explicitly configure the SSH server to allow certificate-based or other non-password methods, which is complex and generally not recommended for standard setups. Therefore, setting a dedicated Microsoft Account password is the most reliable path. Additionally, ensure that the user account has the necessary permissions. By default, members of the Administrators group and Users group can log in via SSH. If you encounter permission denied errors, verify that the user is not disabled and that the password is correctly entered.

Firewall Configuration

Even with the service running, external connections will be blocked if the Windows Defender Firewall does not allow inbound traffic on port 22. Windows 11 typically creates a rule for OpenSSH Server during installation, but it is wise to verify it. Open Windows Security > Firewall & network protection > Allow an app through firewall. Ensure that "OpenSSH Server" is checked for both Private and Public networks. If the rule is missing, you can create it manually via PowerShell:

New-NetFirewallRule -Name sshd -DisplayName 'OpenSSH Server (sshd)' -Enabled True -Direction Inbound -Protocol TCP -Action Allow -LocalPort 22

This command explicitly allows inbound TCP connections on port 22. After applying this rule, you should be able to connect to your Windows 11 machine from another device using the command:

ssh username@your_windows_ip

Remember to replace username with your Microsoft Account email address or local username alias, and your_windows_ip with the local IP address of the machine.

Security Considerations

Enabling SSH exposes your system to potential brute-force attacks. It is highly recommended to disable password authentication for root-like access or limit access to specific users. You can edit C:\ProgramData\ssh\sshd_config to uncomment or add lines such as:

PermitRootLogin no
PasswordAuthentication yes

Restart the service after any config changes using Restart-Service sshd. Always keep your Windows 11 system updated to patch any vulnerabilities in the OpenSSH implementation.

Frequently Asked Questions

Why can't I log in with my Microsoft Account PIN?

The OpenSSH server does not support PIN authentication by default because it relies on standard password protocols. You must set a specific password for your Microsoft Account in Windows Settings to use it for SSH login. Using a PIN is only viable if you configure advanced authentication methods like certificates, which is beyond basic setup.

How do I find my Windows 11 IP address for SSH?

You can find your local IP address by opening Command Prompt or PowerShell and typing ipconfig. Look for the IPv4 Address under your active network adapter (usually Ethernet or Wi-Fi). Use this IP address when connecting from another device on the same network.

Is OpenSSH Server secure enough for production use?

While OpenSSH is widely used and generally secure, exposing Windows to the internet without additional hardening is risky. You should disable password authentication if possible, use key-based authentication, and consider placing the machine behind a VPN or reverse proxy. Regularly updating Windows ensures you have the latest security patches for the SSH component.

What if the OpenSSH Server option is missing in Optional Features?

If the feature is not listed in the GUI, use the PowerShell command Get-WindowsCapability to check availability. It might require a Windows Update to refresh the list of available features. Running wuauclt /detectnow or checking for updates in Settings can sometimes make the option appear.

Can I use SSH to connect to my own Windows PC remotely?

Yes, but you need to ensure your router forwards port 22 to your Windows machine's local IP address. Be aware that exposing port 22 directly to the internet increases security risks. It is safer to use a solution like Tailscale or WireGuard to create a private network tunnel before accessing SSH.