SSO not working for end-users first time after pre-provisioning 24h2

Question

After pre-provisioning a user registers for Windows Hello For Business. However when trying to access Teams, Edge, OneDrive for the first time, the users are prompted for username and password for every single app. This is a broken SSO experience.

Have anyone else experienced this and how did you resolve it?

dsregcmd.exe /status:

AzureAdPrt: YES

Answer 1

Fix: Force Full Sign-In Cycle Post-Provisioning

1. Have the user sign out and sign in again

• A full interactive sign-out and sign-in (not just lock/unlock) triggers proper token initialization.
• This restores SSO across apps.

2. Clear Web Account Manager (WAM) Cache

Sometimes stale WAM tokens block SSO:

cmdkey /list

cmdkey /delete:<AzureAD resource>

Then restart the device.

3. Verify WHfB and SSO Readiness

Check these in dsregcmd /status:

• AzureAdJoined: YES
• AzureAdPrt: YES
• SSO State: AzureADJoined + WHfB + PRT

If SSO State is missing WHfB or PRT, the sign-in cycle is incomplete.

4. Optional: Disable WHfB during pre-provisioning

If this issue is widespread, consider disabling WHfB setup during pre-provisioning and letting users enroll post-login. This avoids token misalignment.