Problem:
User credentials for O365 are not persisting on hybrid joined machines.
Description:
User credentials for O365 are not persisting on hybrid joined Windows 11 machines.
The issue seems to occur even with Portability rules and\or with ProfileDisks in place.
Factors to check for:
- O365 is installed with Shared Computer Licensing: Verify the following reg value exists:
HKLM\Software\Microsoft\Office\ClickToRun\Configuration | SharedComputerLicensing = 1 - Running dsregcmd /status shows:
- AzureAdJoined : YES
- DomainJoined : YES
- AzureAdPrt : NO
AzureAdPrt: NO shows that an Azure AD Primary Refresh Token (PRT) was not issued at user sign-in. Without a PRT, Windows cannot perform silent single sign-on (SSO) to Microsoft Entra ID–backed services. Web Account Manager (WAM) relies on the presence of a valid PRT to silently acquire access tokens without user interaction.
In this state, WAM attempts a user-level Azure AD Workplace Join (AAD Registered) during sign-in. When registration attempt fails, it results in WAM falling back to interactive authentication. This causes O365 to prompt for credentials on each session.
Solution:
NOTE: This workaround does not resolve the underlying cause (PRT not being issued).
Until you are able to resolve getting a PRT (AzureAdPrt: YES), set the following registry setting on the machine:
HKLM\SOFTWARE\Policies\Microsoft\Windows\WorkplaceJoin | BlockAADWorkplaceJoin = DWORD:1
This setting prevents Azure AD Workplace Join for the user. By blocking this, the session will use O365 tokens that are:
- Saved\restored with Portability
- Present in the user's profile (ProfileDisk).
Setting this in the base image would give the most reliable result. However you can also set this in a ProfileUnity startup config.