Microsoft.AAD.BrokerPlugin Errors Signing Users Out Across Multiple Tenants
Asked by
MellowCedar42
Several users were unexpectedly signed out of OneDrive and Outlook, and the issue has now appeared across multiple companies and three separate tenants. The affected systems report "Microsoft.AAD.BrokerPlugin...WebAccountProvider did not register with DCOM within the required timeout," along with AzureAdPrt: YES and WamDefaultSet: ERROR (0x80080300). We initially spent several hours troubleshooting without finding a fix. Has anyone seen this behavior recently, and are there known hardware, firmware, security software, or identity-provider causes?
Answers
Are the affected devices running Trend Micro or another endpoint security product? Security software can interfere with the broker plugin and DCOM registration. In this case, though, SentinelOne was installed, and removing it did not resolve the problem.
Reply to this answer
It may be worth checking whether any of the tenants use a federated identity provider where legacy authentication was recently disabled. Changes in that area can sometimes affect Web Account Manager and token registration.
Reply to this answer
Check the TPM on each affected machine and verify that it is enabled, healthy, and responding correctly. TPM or device-registration problems can cause Azure AD PRT and Web Account Manager errors, even when the PRT itself appears to be present.
Reply to this answer
Since the affected machines all appear to be Lenovo Legion Go devices, I would compare their BIOS, firmware, Windows build, and driver versions. A recent vendor update could explain why users across unrelated tenants began seeing the same broker-plugin and sign-in symptoms.
Reply to this answer
Add your answer
Answers are reviewed before publication.
MellowCedar42: The affected devices appear to be Lenovo Legion Go systems, so we are also investigating whether a Lenovo firmware or driver update is involved.