Hello there, we are using Citrix UPM on random non persistent VDI's with Office 365. i'm thus using SharedComputerLicensing key on the vdi's and as stated in https://support.citrix.com/external/article/CTX216129/office-365-activation-error-cannot-verif.html we are excluding Licensing folders... but users need to logon everytime on Microsoft, and sometimes they receive that error window how do you configure it on your side ? is that CTX216129 outdated now ? do you change the licensing folder with the SCLCacheOverride and SCLCacheOverrideDirectory keys ?

Are you federating your auth to an outside provider? Like Okta? Or Duo? If not if you get Hybrid Joined working correctly then proper Azure PRT will handle those SSO connections automatically.

Hello, not federating, but i don't think it's not about SSO here, the user is connected inside office, it's more about licensing and that Licensing token folder...

Are the desktops Azure AD Joined or Hybrid Azure AD Joined, and are users receiving a valid Azure AD PRT?

dsregcmd /status

The Azure AD PRT handles the licensing sign in and activation process.

Yup, I'm operating off the assumption they're not Azure AD joined/in a new OU if hybrid that wasn't configured to sync.

I have a client that struggled with this and they started storing the License token on their home drive instead. Problem went away after they did that GPO; that and it makes the issue of resetting profiles just that much less painful.

Classic Domain joined with Azure connect. no PRT i think

+----------------------------------------------------------------------+
| Device State                                                         |
+----------------------------------------------------------------------+

             AzureAdJoined : NO
          EnterpriseJoined : NO
              DomainJoined : YES
                DomainName : Domain
           Virtual Desktop : YES
               Device Name : VDIName001.domain.internal

+----------------------------------------------------------------------+
| User State                                                           |
+----------------------------------------------------------------------+

                    NgcSet : NO
           WorkplaceJoined : NO
             WamDefaultSet : NO

+----------------------------------------------------------------------+
| SSO State                                                            |
+----------------------------------------------------------------------+

                AzureAdPrt : NO
       AzureAdPrtAuthority : NO
             EnterprisePrt : NO
    EnterprisePrtAuthority : NO

+----------------------------------------------------------------------+
| Diagnostic Data                                                      |
+----------------------------------------------------------------------+

     Diagnostics Reference : www.microsoft.com/aadjerrors
              User Context : UN-ELEVATED User
               Client Time : 2026-04-08 05:06:59.000 UTC
      AD Connectivity Test : PASS
     AD Configuration Test : FAIL [0x80070002]
        DRS Discovery Test : SKIPPED
     DRS Connectivity Test : SKIPPED
    Token acquisition Test : SKIPPED
     Fallback to Sync-Join : ENABLED

     Previous Registration : 2026-04-08 05:05:04.000 UTC
               Error Phase : discover
          Client ErrorCode : 0x801c001d
    Executing Account Name : DOMAIN\testUser, testUser@azureDomain.be

+----------------------------------------------------------------------+
| IE Proxy Config for Current User                                     |
+----------------------------------------------------------------------+

      Auto Detect Settings : YES
    Auto-Configuration URL :
         Proxy Server List : 10.10.10.10:8080
         Proxy Bypass List : *.domain.local;<local>

+----------------------------------------------------------------------+
| WinHttp Default Proxy Config                                         |
+----------------------------------------------------------------------+

               Access Type : PROXY
         Proxy Server List : 10.10.10.10:8080
         Proxy Bypass List : <local>

+----------------------------------------------------------------------+
| Ngc Prerequisite Check                                               |
+----------------------------------------------------------------------+

            IsDeviceJoined : NO
             IsUserAzureAD : NO
             PolicyEnabled : YES
          PostLogonEnabled : NO
            DeviceEligible : YES
        SessionIsNotRemote : YES
            CertEnrollment : none
              PreReqResult : WillNotProvision

+----------------------------------------------------------------------+
| Virtual Desktop Settings                                             |
+----------------------------------------------------------------------+

                  Provider : Citrix
                      Type : 1 (Non-persistent)
                 User mode : 1 (Single-user)
                Extensions : 0

For more information, please visit <https://www.microsoft.com/aadjerrors>

you can ignore it if you have a prt, otherwise you can log in once and store it. You'd be better off with a PRT though. Is FAS in play here?

no FAS fot that no