cannot login to azure ad joined computer

Keep in mind that the Azure AD PRT is a per user token, so you might see AzureAdPrt:NO if you are running the “dsregcmd /state” as local or not synchronized (on-premises AD user UPN doesn’t match the Azure AD UPN) user. Windows 10 OS version 1809 the Azure AD PRT info is stored in the SSO State section:īy the way you can use usual /? Switch to get help for the “dsregcmd” command (Windows 1809 and newer versions). To check if the Azure AD PRT is present for the signed into Windows 10 device user, you can use the “dsregcmd /status” command.

So when you see an Azure AD Conditional Access error stating that the device is NOT registered, it doesn’t necessary mean that the hybrid Azure AD join is not working in your environment, but might mean that the valid Azure AD PRT was not presented to Azure AD. If any of these two parts (user or device) didn’t pass the authentication step, no Azure AD PRT will be issued. In simple words, if the Cloud AP plugin is able to authenticate on behalf of the user (UPN and password or Windows Hello for Business PIN) to get the Azure AD access token and device is able to authenticate to Azure AD using the device registration state (MS-Organization-Access certificate) the Azure AD PRT will be issued to the user. The mentioned blog explains that the Azure AD PRT is initially obtained during user sign into the station.

Here is official Microsoft documentation about Azure AD PRT.Īs explained in this blog – the Azure AD Primary Refresh Token (Azure AD PRT) is used during Azure AD CA policies evaluation to get the information about Windows 10 device registration state. With Azure AD Conditional Access (CA) policies you can control that only managed devices can access resources protected by Azure AD – Īs mentioned in the article above, you might require the devices the sign in is taking place from to be hybrid Azure AD joined.

Cannot login to azure ad joined computer