I have a client who is experiencing an issue where users can't sign on to Office 365 applications on Windows 11 Multi-User OS. They receive the error message below the first time they click on an Office 365 application. However, it works fine the second time. I ran

dsregcmd /status

, and both

AzureADJoined

and

AzureADprt

are set to "Yes". They are using FSLogix, and Office activation is enabled. I'm not sure what the issue is. Has anyone else encountered this?

This happens for us when Office gets updated. Clearing out the path "AppData\Local\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy" before the application launches has improved the situation, but not entirely eliminated it. Some users still get an error, but a different one, but not all. It isn't totally consistent. I'm sure there is some set of authentication tokens that can be cleared, but I haven't been able to figure it all out.

Check your Entra ID sign in logs to see if there’s any pointers

Make sure the image is removed from Entra ID as part of a sealing process and also make sure the Workplace Join is modified for on startup along with on login. Check the Azure AD Connect and Zero machine settings of my site, here. https://www.jeffriechers.com/wiki/azuread-prt-with-fas-certificates/

thanks guys

Hi newbie1998, we are facing the same issues. We suspect the server is losing the ability to encrypt or decrypt keys. At the moment the user gets the error do you see a KeySignTest: Failed for dsregcmd /status ?

Is there any chance you are blocking http access to the internet? I ran into an issue today with huge delays on certain apps, and it ended up being Certificate Signing check to digicert and other external entitites.

Hi Jeff, we are not blocking outgoing traffic on port 80 or 443. BTW we do not have any sign-in logs about compliant device or similar. But we do experience the error 1001. FYI I just raised 2 tickets, 1 for Office 365 apps and 1 for Windows Server 2019.

Are you guys implementing this for the VDAs - https://docs.citrix.com/en-us/citrix-daas/install-configure/machine-identities/hybrid-azure-active-directory-joined

Sync the OU the VDAs are in. That has to happen or it will sit in an initializing state. It does a two stage check

@Ray Davis - thank you.