Chrome SSO Not Showing Device Information

Question

We have deployed miscrosoft sso in chrome through intune , so when signing in to Microsoft 365 apps using Chrome, the login should

1. • redirect to login.microsoftonline.com,
   • use the Windows Accounts extension + WAM/PRT,
   • and therefore show Device Information in the Microsoft Entra sign‑in logs
2. This behaviour is working correctly for other users in the organisation.

However, there are two users in the organization the Entra sign‑in logs show:

• Client app = Browser
• Authentication Protocol = None
• No Device info section
• At the same time, a separate sign‑in entry appears for Microsoft Authentication Broker (Mobile apps and desktop clients) with Incoming token type = Primary Refresh Token, which indicates the device does have a valid PRT.

How to fix this issue?

Answer 1

Hi, this happens when Chrome is not actually using the Windows Accounts extension / WAM for those users, even though the device has a valid PRT. In that case Chrome falls back to a plain browser flow, so Entra logs show Client app = Browser with no device information, while a separate broker sign-in appears for the PRT.

The fix is to force Chrome back onto the WAM path for those profiles. For the affected users, check that they are using a managed Chrome profile (not a local or guest profile), that the Windows Accounts extension is installed and enabled, and that they are signed into Chrome with their work account. Clearing Chrome’s profile data or creating a fresh Chrome profile often fixes it. Also verify that no user-level Chrome policies are disabling the extension or WAM integration for just those accounts. Once Chrome uses WAM again, the browser sign-in will include device info as expected.