DEV Community

Bryz︱🦾
Bryz︱🦾

Posted on

Troubleshoot Microsoft 365 Sign-In Issues with dsregcmd /status

#itsupport #windows #azure #beginners

A user calls the help desk: "Teams keeps asking me to sign in" or "Outlook won't connect" on their work laptop. It's tempting to jump straight to resetting the password or rebuilding the Outlook profile. Before you do, spend 30 seconds checking whether the device is healthy in Microsoft Entra ID. One built-in Windows command tells you.

Step 1: Run the command

Open Command Prompt (no admin rights needed) and run:

dsregcmd /status
Enter fullscreen mode Exit fullscreen mode

The output is long, but you only need a few lines from two sections.

Step 2: Check Device State

Look at the Device State section at the top:

AzureAdJoined : YES
DomainJoined : NO
Enter fullscreen mode Exit fullscreen mode
  • AzureAdJoined : YES means the device is joined to Entra ID (cloud-joined).
  • DomainJoined : YES together with AzureAdJoined : YES means it's hybrid joined (on-prem Active Directory plus Entra ID).
  • If AzureAdJoined is NO on a device that should be joined, single sign-on to Microsoft 365 apps won't work properly. That's a device registration problem, not a password problem, so escalate or re-register the device per your org's process.

Step 3: Check SSO State

Scroll down to the SSO State section:

AzureAdPrt : YES
Enter fullscreen mode Exit fullscreen mode

The PRT (Primary Refresh Token) is what lets Windows sign the user in to Microsoft 365 apps silently. If it shows NO:

  1. Make sure the laptop is online (and on VPN if your org requires it).
  2. Have the user lock the screen and unlock it, or sign out and back in. Windows tries to get a fresh PRT at sign-in and unlock.
  3. Run the command again: 
dsregcmd /status | findstr /i "AzureAdJoined AzureAdPrt"
Enter fullscreen mode Exit fullscreen mode

That findstr filter shows just the lines you care about, which is handy when you're on a remote session with the user.

Step 4: Decide where the problem is

  • Joined = YES and PRT = YES, but the app still fails: focus on the account or the app (license, MFA, cached credentials, the app itself).
  • Joined = YES and PRT = NO after a lock/unlock: check network access and the user's account status, then escalate with the output attached.
  • Joined = NO: it's a device issue. Escalate to whoever manages device enrollment (often the Intune or endpoint team).

Why this habit helps

Checking the device first saves you from password resets and profile rebuilds that don't fix anything. It also gives the next tier clear evidence: paste the relevant dsregcmd /status lines into the ticket and they can pick up right where you left off.

One command, 30 seconds, and you know whether you're fixing the account or the device.

Top comments (0)