Why am I seeing "Windows Sign-in" activity for an Azure AD registered (not joined) device?

Question

Why am I seeing "Windows Sign-in" activity for an Azure AD registered (not joined) device?

Naija R C 20

Hi,

My device is only Azure AD registered, not Azure AD joined. However, I am still seeing Windows Sign-in activities showing up in the Azure AD sign-in logs.

Could someone please explain why this is happening? Is it expected behavior for Azure AD registered devices to generate Windows Sign-in events, and what exactly triggers these events?

Thanks in advance for your help!

Accepted answer

0 additional answers

Your answer

Answer 1

Kancharla Saiteja 4,195 Microsoft External Staff Moderator

Hi @Naija R C,

Based on your query, here is my understanding: You would like to know the factors of when "Windows sign in" triggers in the sign in logs.

Windows sign in logs mainly triggers when you have Cloud Kerberos working in the background. This includes the services like Windows hello for business, Intune policies applied on the device (Even if it is registered). Entra ID registered device also contains a PRT which triggers SSO for you on the applications, this may not be seen in the logs or the device, but it is the reason for SSO on Entra ID devices. Regardless of your device registration status if the device has any requirement with cloud Kerberos, the device will definitely have windows sign in activities available in sign in logs.

Here is the document which shows key capabilities and device sign in options of Entra ID registered device which are reasons for Windows sign in logs: Microsoft Entra registered devices

I hope this information is helpful. Please feel free to reach out if you have any further questions.

If the answer is helpful, please click "Accept Answer" and kindly "upvote it". If you have extra questions about this answer, please click "Comment"

Jacek Leo 0 Reputation points

2025-04-18T17:53:27.25+00:00

Could you please explain it in the simplest way to implement?
Jacek Leo 0 Reputation points

2025-04-18T18:04:08.18+00:00

Could you please explain it in the simplest way to implement?
Naija R C 20 Reputation points

2025-04-21T10:55:53.1+00:00

Thank you for your quick response.

Based on your explanation, I understand that a "Windows sign-in" event can be triggered not only during the initial sign-in or unlock of a device using azure ad user account, but also when the device refreshes the Primary Refresh Token (PRT) in the background.

This PRT refresh should typically occur only on devices that are Azure AD registered, Azure AD joined, or Hybrid Azure AD joined — is my understanding correct?

In order to validate whether my device is requesting a PRT, I referred to the output of the dsregcmd /status command on the device where I am observing "Windows sign-in" events.

However, according to the output, the AzureAdPrt status is NO.

Could you kindly help clarify whether the device can still trigger "Windows sign-in" events under these conditions, or if there is another mechanism involved that I might be overlooking?

Thank you for your assistance.
Kancharla Saiteja 4,195 Reputation points Microsoft External Staff Moderator

2025-04-21T18:28:07.1066667+00:00

Hi @Naija R C,

Thank you for your response,

Entra ID registered (Azure Ad registered) device does not show up the PRT token from dsregcmd /status which is by design. This device has an entry, and the token will be retrieved from Entra itself which means it has to reach the cloud for the token that makes an entry for the sign in. This is how the flow works for Entra ID registered device. But the only thing here is you cannot see Azure AD PRT for the device but works for the device in backend to provide SSO for the applications.

Please let me know if you have any further queries on the same.
Naija R C 20 Reputation points

2025-04-22T06:18:17.13+00:00

Hi @Kancharla Saiteja ,

As per our previous discussion, I understand that for an Entra ID registered (Azure AD registered) device, the Primary Refresh Token (PRT) is not visible through dsregcmd /status, which is by design.

However, I was expecting to see Primary Refresh Token listed under the Authentication Method in the Windows sign-in event in the Azure AD sign-in logs. When I checked the Windows sign-in events, I could not find any reference to Primary Refresh Token under the authentication methods.

Could you please help me understand:

Should I expect to see Primary Refresh Token listed in the Windows sign-in activity for an Azure AD registered device?

If not, could you guide me on how to verify that the device is actually requesting and using the PRT during the Windows sign-in activity?

Thanks for your support!
Kancharla Saiteja 4,195 Reputation points Microsoft External Staff Moderator

2025-04-22T18:34:11.3466667+00:00

Hi @Naija R C,

Could you please take a look at basic authentication details, if you could see the resource is Azure Active directory and the token issuer type is Microsoft Entra ID. I believe this would be enough to log a sign-in's in Entra ID. This is the easiest way I can make you understand on the issue. If you have further queries kindly let me know by responding here.
Kancharla Saiteja 4,195 Reputation points Microsoft External Staff Moderator

2025-04-24T16:33:45.11+00:00

Hi @Naija R C,

Following up to see if the above answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know
Kancharla Saiteja 4,195 Reputation points Microsoft External Staff Moderator

2025-04-25T22:23:54.45+00:00

Hi @Naija R C,

Following up to see if the above answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know

Share via

Why am I seeing "Windows Sign-in" activity for an Azure AD registered (not joined) device?

0 additional answers

Your answer