With MS changing some of the SSO around AzurePRT, ...
# citrix-vadj
Jeff Riechers
10/02/2026, 12:50 PMWith MS changing some of the SSO around AzurePRT, WAM, CloudAP, has anyone noticed situations where non-persistent sessions are taking longer to sign-in to MS resources? With FSLogix I have seen it taking minutes. With UPM, I have seen it where first login to the machine doesn't work. Sign out and sign right back in, and it works sometimes? Just started happening a few days ago.
m
Matt Nation
10/02/2026, 1:59 PMi'm having to use psexec to run dsregcmd /leave as local system right before i seal the image and don't have any issues
j
Jeff Riechers
10/02/2026, 2:08 PMYeah, we do that as well. MS is thinking it is something with the Web Account Manager not validating the token. This client does federate to pingidentity, so I am thinking it is something with that validation. And after that fails, it then fails back to WAM over Entra, which works.
Jeff Riechers
10/02/2026, 3:05 PMIt's really weird. We see the PRT working correctly, but you see WAM errors on profile logins. But if you sign out and sign in again then it works. Nothing changed on the local images at all.
Jeff Riechers
10/05/2026, 4:29 PMSo it looks like the AAD.brokerplugin is not registering into the user profile automatically. We have to run Get-AppxPackage Microsoft.AAD.BrokerPlugin | Reset-AppxPackage then MS apps will work. Anyone else seen this with federated entra AD?
m
Matt Nation
10/06/2026, 2:49 AMstinks that you're having to deal with this but glad it's not more widespread. please let us know if you find a fix
3 Views