Windows 365 Token Validation Failure

Overview

Windows 365 Cloud PCs can fail during sign-in when the authentication token between Entra ID, Windows 365, and the session broker becomes invalid or corrupted. In this incident, users could not access their Cloud PC even though licensing and account access were in place.

The recovery path was to validate the device state, confirm that the issue was identity-related, and then run a targeted remediation on the affected Cloud PC instead of forcing reprovisioning.

Problem Statement

Users reported that the Windows 365 Cloud PC would not load after authentication. The session remained stuck in a loading state, despite valid credentials and an assigned license.

Symptoms

• Cloud PC stayed on a connecting or loading screen.
• Token validation or authentication errors appeared during sign-in.
• The problem reproduced across browsers and devices.
• Windows 365 health still showed the Cloud PC as healthy.

Environment

This structure is intentionally simple so the reader can quickly identify what the fix applies to and what tools were used.

Root Cause

The root cause was an expired or corrupted authentication token between Entra ID, Windows 365 services, and the Cloud PC session broker. This is commonly triggered by password resets, MFA changes, Conditional Access updates, or sync delays.

In practice, the device needed a registration-state reset rather than classic troubleshooting for a domain-joined workstation.

Investigation Process

The goal was to eliminate simple causes first, then confirm whether the problem lived in identity, policy, or the Cloud PC itself.

1. Confirmed the issue could be reproduced consistently by the affected user.
2. Checked licensing, provisioning status, and Cloud PC health in the admin portal.
3. Reviewed sign-in logs to see whether the failure aligned with identity or policy events.
4. Validated that browser resets and user sign-out did not change the outcome.
5. Narrowed the problem to token state instead of device corruption or reprovisioning failure.

Troubleshooting Steps

These checks help separate an identity-token problem from a broader Windows 365 or Intune issue.

1. Retry sign-in after a full sign-out from the client and browser.
2. Verify that licensing, provisioning, and access policies are still assigned.
3. Review Azure AD / Entra sign-in logs for token or authentication failures.
4. Check the device join state with dsregcmd /status.
5. Only use dsregcmd /leave when you intentionally want to reset the join state.

Solution

The issue was resolved by running Run Remediation from the Windows 365 Admin Portal against the affected Cloud PC.

1. Open the Windows 365 Admin Portal.
2. Go to Cloud PCs.
3. Select the affected user or Cloud PC.
4. Choose Run Remediation.
5. Wait for the repair to finish, then retry sign-in.

Detection script

This checks whether the device is Entra joined before running repair logic.

$status = & dsregcmd /status

if ($status -match 'AzureAdJoined\s*:\s*YES') {
  Write-Output 'Device is Entra joined.'
  exit 0
}

Write-Output 'Device is not correctly joined.'
exit 1

Remediation script

The remediation clears the current join state, logs the action, and reboots the Cloud PC so the next sign-in can establish cleanly.

$logPath = Join-Path $env:ProgramData 'Windows365-Remediation.log'

Start-Transcript -Path $logPath -Append
try {
  Write-Output 'Running dsregcmd /leave'
  & dsregcmd /leave | Out-String | Write-Output

  Write-Output 'Restarting Cloud PC'
  shutdown.exe /r /t 0 /f

  exit 0
}
catch {
  Write-Error $_
  exit 1
}
finally {
  Stop-Transcript | Out-Null
}

Validation

After remediation, confirm the recovery by checking the following outcomes:

• The Cloud PC signs in successfully without token validation errors.
• The user reaches the desktop without reprovisioning.
• Token state is regenerated and the session broker accepts the connection.
• Cloud PC health remains stable after the next sign-in attempt.

Lessons Learned

• Token issues may not surface as unhealthy Cloud PCs.
• Targeted remediation is better than immediate reprovisioning.
• Identity and Conditional Access changes can trigger Cloud PC sign-in failures.
• Good case studies should separate investigation, solution, and validation.

Key Takeaways

• Start with the identity layer before expanding scope.
• Keep the repair scoped to the affected Cloud PC.
• Use remediation before reprovisioning.

References

Related Articles