for folks using CItrix and fslogix on prem and using outlook/onedrive auth'ing to M365 are you adding a HKLM reg key in your non persistent images for LoadCredKeyFromProfile? this key is new to me...

No I have not used this key, and have deployed it successfully in many environments in this configuration. But I can't see how setting it would hurt either.

do you recall if you are using 'roam identity' setting in fslogix? or if that is set to disabled? Do your users get prompted to auth into m365 services if they don't sign in for a while?

no I do not set that, as Microsoft recommends against using roaming identity. it's disabled by default, I believe. Most environments I work with leverage hybrid joined, so they rarely get manual applicaiton sign on requests

for environments that are just using entra connect, to sync up the computer accounts to entra, are you still supposed to do dsregcmd /leave as part of the 'sealing' process for non persistent VMs, including win11/server 2025?

I still run it in my finalize script.

thx for the input, appreciate it

as far as I know (and do) you only have to do the dsregcmd /leave part in the sealing proces if you hybrid join your master image. I don't do that, but the dsregcmd /leave doesn't hurt either. What issue are you seeing Steve?

just seeing some auth prompts, like after a certain period of not logging in, like weeks...no SAML, doing Entra Connect to sync the computer accounts accounts, the auth comes from m365 whether it's onedrive or outlook, people who are daily users dont seem to be affected. Doing a dsregcmd /status shows PRT = NO, and that the 'device authentication failed'...i'll start tracking this down a bit more, just wanted to get some high level specifics on entra connnect sync with dsregcmd /leave, roam identity, and that new key i found while googling