Hi Guys, We are moving off ADFS and started testing passthrough authentication. test users started having multiple logon prompts while launching office apps. our Citrix workers are 2022 server domain joined and PVS streamed. (and we also use Citrix FAS and FSLogix ODFC + UPM) I see a lot of people use Hybrid join these days. any gotchas with that - like cleaning hundreds of accounts from Azure AD every week? any additional steps like excluding or adding anything to Fslogix ODFC containers or UPM.

If you use FAS and you want sso into office apps you also need to enable certificate based authentication in entraid. That is how you get a PRT.

What Rob said. I never do M365 on Citrix without Hybrid join. You don't have to cleanup machine accounts on Entra, as long as you never sync your master / maintenance worker to Entra. Only OU's where your Test and Prod-VDA's are should be synced to entra, so they will automatically join after reboot and there are no duplicate machine identities on entra. As Rob mentioned, with Server 2022 as Worker-OS, use FAS with Entra ID CBA to get a Primary Refresh Token (PRT) - this is also secure by design. As soon as you will hop on Server 2025 as Worker-OS, use native Entra ID SSO, without any FAS.

we started testing Hybrid Join. and it works the first time but after reboot sits with error messages and not rejoining Azure AD. Looks like I am missing something identity related for these PVS streamed machines. any extra PVS setting required ? (our machine catalogs are not Hybrid joined) as we just started testing with a couple of servers) Diagnostics Reference : www.microsoft.com/aadjerrors User Context : SYSTEM Client Time : 2026-07-08 044153.000 UTC AD Connectivity Test : PASS AD Configuration Test : PASS DRS Discovery Test : PASS DRS Connectivity Test : PASS Token acquisition Test: SKIPPED Fallback to Sync-Join : ENABLED Previous Registration : 2026-07-08 043739.000 UTC Registration Type : sync Error Phase : join Client ErrorCode : 0x801c005b Server ErrorCode : invalid_request Server ErrorSubCode : error_computer_signature_check_failure Server Operation : DeviceRenew Server Message : The verification of the signature failed for device cac6d24e-4715-47d5-82ce-0d04ce368bde in domain bf124a02-151b-433a-bec2-5fcb54bf8861. Https Status : 400 Request ID : 6a25d3d5-ce96-40bb-8540-259c806c29c2

Hiding "Use a certificate or a smart card" sadly isn't possible. But the first screenshot, so entra always wants a Cert, you can change that. MS switched CBA from 8th place to the third place in priority. You can switch that back, go to entra and disable this setting here, so the "normal" Auth-Priorities are hitting. You can disable it for your tenant or just for the same group you are filtering or using for CBA.

Thank you. We will try that.