Azure Virtual Desktop - Device TPM Problem

Question

Azure Virtual Desktop - Device TPM Problem

Kris Larsen 0

Hello all.

I have a client who has an Azure Virtual Desktop and one user (only one) receives the error message 'Device TPM problem' when they attempt to log into M365 office programs. I have been searching and searching online for a solution but can't seem to find one. The error code they receive is 2146893802.

Has anyone else come across this issue and if so, what was your resolution?

Thank you!

TGC Pic.jpg

Anonymous

2025-09-10T03:16:59.56+00:00
Hello Kris Larsen,

⁠Do you know which specific Session Host VM the affected user was logged into when they encountered this error?

⁠Were there any recent changes to the AVD host image (e.g., updating a Golden Image), applying new Group Policies, or changes to Azure AD Conditional Access policies just before this started?

⁠Does the error occur every single time the user tries to log into any M365 application (like Word, Teams, Outlook), or is it intermittent ?

Additionally, please try out Disconnect from Azure AD and joining back as suggested by Jerald Felix and let us know if helps to resolve the issue.
Anonymous

2025-09-11T04:07:32.5066667+00:00

Hello Kris Larsen,

Just checking in if you got a chance to review our response shared earlier,

let us know if there are any follow-up queries with the thread.
Anonymous

2025-09-12T00:44:15.5766667+00:00

Hello Kris Larsen,

Just checking in if you got a chance to review our response shared earlier,

let us know if there are any follow-up queries with the thread.
Kris Larsen 0 Reputation points

2025-09-17T18:54:42.9433333+00:00

Sure! Please see my answers below your questions labeled 'KL:'

#1 KL: They changed their password to M365 on their local machine. They were not logged into the VM when this changed happened.

#2 KL: No

#3 KL: This happens every time they attempt to log into any M365 application while on the VM.
Anonymous

2025-09-18T23:19:04.78+00:00
Hello Kris Larsen.

Thank you for answering the questions, this clarifies that here it's likely Hybrid Azure AD joined.

Can you try to delete the WorkPlaceJoin registry key and re-register the user to see if that fixes the issue.

Steps to follow :

Identify the user session host and profile:
a. In Azure Portal, go to Azure Virtual Desktop > Host pools > Your Host Pool > Session hosts
b. Find the host where the user's session was located.
c. Login to that VM using admin account.

Clear the Azure AD registration state
a. Find SID of the user (open powershell as admin) using below command:

Get-WmiObject -Class Win32_UserAccount | Select-Object Name, SID | Where-Object Name -eq "<Username>"

note: username would be the affected user's local account name on the VM or their AD username

b. Open registry editor (regedit) as admin, navigate to HKEY_USERS, expand it and look for the key matching the user's SID.
c. Expand the SID and navigate to \Software\Microsoft\WorkPlaceJoin
d. Right click on the 'WorkPlaceJoin' folder and delete it. This will clear the device registration data.

Run dsregcmd as user role:
a. Sign into AVD session.
b. Open command prompt (CMD) (not admin)
c. Run below command one after another:
dsregcmd /leave
dsregcmd /join

this will sever the Azure AD registration and re-register the session host with Azure AD.

Ask the user to open M365 applications and once they authenticate successfully, it'll generate new keys in vTPM and the error should not re-appear.

Let me know if this works out to fix the issue for you!!
Anonymous

2025-09-19T21:10:56.8866667+00:00

Hello Kris Larsen,

Just wanted to check in and see if you had a chance to look over the response I shared earlier. Let me know if it works for you or if you hit any snags with any of the steps.
Kris Larsen 0 Reputation points

2025-09-21T23:20:48.54+00:00

Ankit, thank you for your response. This user nor any other user has the REGEDIT key of \Software\Microsoft\WorkPlaceJoin. What might be the next steps?
Anonymous

2025-09-22T19:54:13.4966667+00:00
Hello Kris Larsen,

Thank you for checking the registry values.

This sounds like misconfigurations with Hybrid join.

Can you please login into the session host, open powershell as admin and run below command:

dsregcmd /status

From the output, kindly share us the values for AzureAdJoined, DomainJoined and WorkplaceJoined.

Reference: https://learn.microsoft.com/en-us/entra/identity/devices/troubleshoot-device-dsregcmd

Based on the output, we can plan the next set of actions accordingly.
Anonymous

2025-09-23T19:44:18.0933333+00:00

Hello Kris Larsen,

Just checking in if you got a chance to check dsregcmd /status from the session as asked previously.
Anonymous

2025-09-24T20:11:02.8766667+00:00

Hello Kris Larsen,

Just checking in if you got a chance to check dsregcmd /status from the session as asked previously.
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

1 answer

Your answer

Anonymous

2025-09-10T03:16:59.56+00:00

Hello Kris Larsen,

⁠Do you know which specific Session Host VM the affected user was logged into when they encountered this error?

⁠Were there any recent changes to the AVD host image (e.g., updating a Golden Image), applying new Group Policies, or changes to Azure AD Conditional Access policies just before this started?

⁠Does the error occur every single time the user tries to log into any M365 application (like Word, Teams, Outlook), or is it intermittent ?

Additionally, please try out Disconnect from Azure AD and joining back as suggested by Jerald Felix and let us know if helps to resolve the issue.
Anonymous

2025-09-11T04:07:32.5066667+00:00

Hello Kris Larsen,

Just checking in if you got a chance to review our response shared earlier,

let us know if there are any follow-up queries with the thread.
Anonymous

2025-09-12T00:44:15.5766667+00:00

Hello Kris Larsen,

Just checking in if you got a chance to review our response shared earlier,

let us know if there are any follow-up queries with the thread.
Kris Larsen 0 Reputation points

2025-09-17T18:54:42.9433333+00:00

Sure! Please see my answers below your questions labeled 'KL:'

#1 KL: They changed their password to M365 on their local machine. They were not logged into the VM when this changed happened.

#2 KL: No

#3 KL: This happens every time they attempt to log into any M365 application while on the VM.
Anonymous

2025-09-18T23:19:04.78+00:00

Hello Kris Larsen.

Thank you for answering the questions, this clarifies that here it's likely Hybrid Azure AD joined.

Can you try to delete the WorkPlaceJoin registry key and re-register the user to see if that fixes the issue.

Steps to follow :

Identify the user session host and profile:
a. In Azure Portal, go to Azure Virtual Desktop > Host pools > Your Host Pool > Session hosts
b. Find the host where the user's session was located.
c. Login to that VM using admin account.

Clear the Azure AD registration state
a. Find SID of the user (open powershell as admin) using below command:

Get-WmiObject -Class Win32_UserAccount | Select-Object Name, SID | Where-Object Name -eq "<Username>"

note: username would be the affected user's local account name on the VM or their AD username

b. Open registry editor (regedit) as admin, navigate to HKEY_USERS, expand it and look for the key matching the user's SID.
c. Expand the SID and navigate to \Software\Microsoft\WorkPlaceJoin
d. Right click on the 'WorkPlaceJoin' folder and delete it. This will clear the device registration data.

Run dsregcmd as user role:
a. Sign into AVD session.
b. Open command prompt (CMD) (not admin)
c. Run below command one after another:
dsregcmd /leave
dsregcmd /join

this will sever the Azure AD registration and re-register the session host with Azure AD.

Ask the user to open M365 applications and once they authenticate successfully, it'll generate new keys in vTPM and the error should not re-appear.

Let me know if this works out to fix the issue for you!!
Anonymous

2025-09-19T21:10:56.8866667+00:00

Hello Kris Larsen,

Just wanted to check in and see if you had a chance to look over the response I shared earlier. Let me know if it works for you or if you hit any snags with any of the steps.
Kris Larsen 0 Reputation points

2025-09-21T23:20:48.54+00:00

Ankit, thank you for your response. This user nor any other user has the REGEDIT key of \Software\Microsoft\WorkPlaceJoin. What might be the next steps?
Anonymous

2025-09-22T19:54:13.4966667+00:00

Hello Kris Larsen,

Thank you for checking the registry values.

This sounds like misconfigurations with Hybrid join.

Can you please login into the session host, open powershell as admin and run below command:

dsregcmd /status

From the output, kindly share us the values for AzureAdJoined, DomainJoined and WorkplaceJoined.

Reference: https://learn.microsoft.com/en-us/entra/identity/devices/troubleshoot-device-dsregcmd

Based on the output, we can plan the next set of actions accordingly.
Anonymous

2025-09-23T19:44:18.0933333+00:00

Hello Kris Larsen,

Just checking in if you got a chance to check dsregcmd /status from the session as asked previously.
Anonymous

2025-09-24T20:11:02.8766667+00:00

Hello Kris Larsen,

Just checking in if you got a chance to check dsregcmd /status from the session as asked previously.
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Answer 1

Hello Kris Larsen,

Greetings! I see you're encountering a "Device TPM problem" for a single user on an Azure Virtual Desktop environment when they try to log into Microsoft 365 applications. This is a known issue and the error code 2146893802 (which translates to NTE_BAD_KEYSET) often points to a corrupted user profile or issues with how the device is registered with Azure Active Directory (AAD).

Since this is happening for only one user, the problem is likely tied to that user's specific profile on the session host, rather than a broader AVD or TPM configuration issue. Here are some steps you can take to resolve this, starting with the least intrusive:

Solution 1: Disconnect and Reconnect the Work or School Account

This is often the quickest fix. It forces a re-authentication and re-registration of the device with Azure AD for that user account.

In the AVD session, go to Windows Settings > Accounts > Access Work or school.

Select the user's work or school account and click Disconnect.

After it's disconnected, click Connect and have the user sign in again.

Solution 2: Clear the TPM and Re-register

If the above doesn't work, clearing the user's TPM-related keys and re-registering the device can resolve corruption issues.

Clear the TPM: From the Start menu, open the TPM management console by typing tpm.msc. In the Actions pane, click "Clear TPM..." to reset it.

Disconnect from Azure AD: You can do this from the "Access work or school" settings as mentioned above, or by using the command line: dsregcmd /leave.

Re-join Azure AD: Have the user sign back into an Office application. This should prompt them to re-register their device with Azure AD.

Solution 3: Rename the AAD BrokerPlugin Folder

This folder caches authentication tokens. Renaming it forces the system to create a new, clean one.

Close all Microsoft 365 applications.

Open File Explorer and navigate to %localappdata%\\Packages\\.

Find the folder named Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy and rename it to Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy.old.

Have the user sign into an Office application again.

Additional Considerations

Virtual TPM (vTPM): Azure VMs, including those used for AVD, can have a virtual TPM (vTPM) which is a virtualized version of a hardware TPM. Issues can sometimes arise with the vTPM state.

Sysprep: The error NTE_BAD_KEYSET (0x80090016) has been linked to issues with sysprepped images where the machine was joined to Azure AD before creating the image. If you're using a custom image, ensure it's generalized correctly.

For a single user, it's very likely that one of the first two solutions will resolve the problem without needing to modify the virtual machine's configuration. I would recommend trying them in order.

I hope this helps you resolve the issue for your client.

Best regards,

Jerald Felix

Kris Larsen 0 Reputation points

2025-09-17T16:35:03.94+00:00

Hello Jerald. Thank you for getting back to me and I am sorry I haven't responded sooner.

This environment is not AzureADJoined so I am not able to see 'Access Work or School'. I have tried the renaming of the folder and this has not resolved the issue. I'm wondering though on the dsregcmd /leave if that is to be initiated under the user who is affected?

Thanks

Kris
Anonymous

2025-09-17T18:50:24.64+00:00

Hello Kris Larsen,

Thanks for getting back to us! While we're working on your follow-up question, it’d be super helpful if you could take a moment to answer the earlier queries, that’ll give us a better understanding of the case.