Devices in hybrid Azure/AD environment no longer automatically signing into Office/Outlook...

Question

Hey Microsoft community,

I'm having an issue where we have a Hybrid environment between Azure AD/Entra and a local Active Directory VM with Server 2022 installed. We had configured a server to join connect to Azure AD using Azure AD connect so it can intertwine users' domain logins with their 365 accounts, including Office and OneDrive. We had it initially setup so whenever a user logs in to a domain-joined PC, it will automatically populate their email address into Office apps and OneDrive.

However, the server is a VM and was initially created as a Hyper-V VM. It has since moved over to a Scale computing system. Since then, devices that are joining to the domain are no longer signing into or populating the user's email address into Office apps like OneDrive and Outlook/Excel/Word, etc.

I checked "dsregcmd /status" and it is indicating YES to AzureADJoined. However, below under Device Details, I see the following error:

DeviceAuthStatus : FAILED. Error: 0x90090311

I am wondering if this is because the TPM is missing/removed from the VM now and if the server is no longer able to authenticate properly with Azure because of this.

I have unjoined/rejoined to Azure AD, made no difference, despite the device showing in the Entra portal. I checked the Group Policy Object and made sure that silently sign into OneDrive is enabled and I also configured the same policy to add EnableADAL to the user's workstation in the GPO.

Is there a way to change Entra so it no longer requires hardware TPMs on devices or on this device?

As I said, it WAS working properly, but hasn't since the VM was moved to Scale.

Any suggestions or help with this would be appreciated. Thanks in advance!

Jay Smith

Answer 1

Update: I think I might have figured it out.

It appears that two (formerly three) of the computers in the AD were having issues syncing with AAD due to device id (or object id) already in use by another object and it must be unique. I found this out using Synchronization Service Manager on the server after running "Start-ADSyncSyncCycle -PolicyType Delta" in Powershell. This would make sense, because when I initially joined two of the devices to the domain, they somehow lost connectivity to the server and couldn't reconnect on their own. So I had to unjoin, then rejoin them to the domain and I did that without deleting the computer in AD first. For the third one, it was somehow using a device/object ID that already existed with another computer that was joined to Azure AD. After I deleted the computer from Azure AD and ran dsregcmd /join, it started to work properly and was joined to AzureAD.

The Synchronization Service Manager did come in handy here telling me that computers were having sync issues with Azure AD.

Hopefully this helps someone.

Answer 2

Hi Daniel, thank you for getting back to me. I can tell you that I was able to convert the VM from BIOS to UEFI and got a virtual TPM installed now and that is working. However, I am still getting that same DeviceAuthStatus failed even after unjoining (leave) and rejoining AzureAD and reapplying the credentials. I also tried a /forcerecovery and re-signed in with the admin credentials in 365 to join devices, but still getting the same DeviceAuthStatus failed error. Also, devices connected and joined to the domain are still no longer populating with the user's email.

I also configured that GPO for Automatic Device Registration and it still didn't work.

Where's what it reads after the dsregcmd /debug /status:

Answer 3

Hello again.

I'm here just to do a quick follow up and ask you if the information I shared was useful.

I'll be here if you need further guidance.

Best Regards,

Daniel C.

Microsoft Community Support

Answer 4

Hello, Jay.

Welcome to the Microsoft Community.

From what you've described, this issue seems linked to TPM requirements after the VM migration to a Scale computing system. The error code 0x9009031f typically suggests authentication failure, often related to device identity trust or hardware-based security like TPM.

Here are a few points and suggestions to consider:

• TPM and Device Registration in Entra ID. Microsoft Entra requires TPM for certain features like Seamless SSP and Device Write-back. However, TPM isn't mandatory for basic Azure AD Join or registration. If your VM lacks a TPM, ensure device registration policies don't enforce TPM-based key storage, as this can block the authentication process.
• DeviceAuthStatus Failed - What to Try Next.
  1. Double-check that the device is Hybrid Azure AD Joined and not stuck in a partial state.
  2. Run dsregcmd/debug/status and review the AzureAdJoined and Device State sections.
  3. Try clearing device credentials cache (dsregcmd/leave + rejoin).
  4. Make sure the GPO for Automatic Device Registration is correctly applied:
  Computer configuration > Administrative Templates > Windows Components > Device Registration.

Let me know how it goes.

Best Regards,

Daniel C.

Microsoft Community Support