I set up an Azure Virtual Desktop environment with single sign-on to Microsoft Entra ID last year, and it worked reliably until last week. The issue now affects several Azure VMs configured for Entra ID sign-in. The AADLoginForWindows extension reports as healthy, the affected users still have the required VM login permissions, and the same behavior occurs with multiple administrator accounts. Entra sign-in logs show successful authentication for the Windows 365 Client application and Windows Cloud Login resource, but the Windows App still fails with AADSTS500032: "Cannot find signing certificate/private key to issue a certificate." There have been no known Conditional Access changes. The client is a fully updated Windows 11 laptop. Has anyone encountered this error in an Entra ID VM login scenario, and where should I check for an expired or missing certificate/private key?
3 Answers
Start by checking whether a certificate used by the VM sign-in flow has expired or lost its private key. The error points toward certificate-based authentication rather than a basic permission problem. Check the VM’s local certificate stores and any certificates associated with the Entra sign-in or device authentication configuration, not just the Enterprise Application overview in the Azure portal.
If these are Windows 11 multi-session hosts, verify whether the AADLoginForWindows extension is actually required for your setup. Some multi-session configurations use a different identity and sign-in path, so an unnecessary or stale extension could contribute to the problem. Compare one affected host with a newly created host or a known-good configuration before changing multiple settings.
The published error-code description may not match the complete wording you’re seeing. AADSTS500032 is often documented as a weak RSA key error, while your message specifically mentions a missing signing certificate or private key. I’d capture the full sign-in error details, including the correlation ID and timestamp, and use those when reviewing the VM’s certificate configuration or following up with Microsoft support.
I looked in the Enterprise Application blade but couldn’t find a certificate section there. I’ll check the VM certificate stores and verify expiration dates and private-key access.