I set up an Azure Virtual Desktop environment with single sign-on to Microsoft Entra ID last year, and it worked reliably until recently. I'm now seeing AADSTS500032 when connecting to multiple Azure VMs through Windows App.
The AADLoginForWindows extension reports healthy, the affected users still have the required VM login permissions, and the issue occurs with several administrator accounts. Entra sign-in logs show successful authentication for the Windows 365 Client application and the Windows Cloud Login resource. There have been no recent Conditional Access changes, and the connecting laptop is running a fully updated version of Windows 11.
The error mentions that a signing certificate or private key could not be found. Where should I check the relevant certificate or key, and what else could cause this error in an Entra ID login scenario?
3 Answers
The first thing to investigate is certificate validity. Check whether any certificate involved in the VM sign-in or SSO chain has expired, been replaced, or lost its private key. The successful sign-in entry does not necessarily prove that the subsequent VM authentication step can access the required certificate.
The documented meaning of AADSTS500032 is related to a weak or invalid RSA key, although it may not exactly match the wording shown by Windows App. Check the affected machines and any authentication components for outdated or weak RSA certificates, missing private keys, or certificates that no longer meet current security requirements.
If these are Windows 11 multi-session hosts, verify whether the AADLoginForWindows extension is actually required for your configuration. Some multi-session deployments use a different sign-in setup, so an unnecessary or mismatched extension could be contributing to the failure. Compare the host configuration with a known-good VM before removing anything.
I wasn’t sure where to look because the VM appears as an enterprise application, but there is no obvious certificate section there. Is the certificate stored on the VM or managed somewhere else in Entra ID?