New Outlook occasionally asks users to sign in again. Continuing clears the prompt for a few weeks, but it eventually returns. The devices are Entra joined, managed through Intune, and use Windows Hello.
Entra sign-in logs haven't shown anything unusual, and clearing the WAM cache hasn't stopped it. What else should I check without switching to Outlook Classic?
Next time it happens, run dsregcmd /status in the affected user's session before they click Continue. Use a non-elevated command prompt, since elevation can give you misleading WAM results.
Look at AzureAdPrt, WamDefaultSet, DeviceAuthStatus, and any AcquirePrtDiagnostics or RefreshPrtDiagnostics sections. A primary refresh token refresh failure may show an error and correlation ID even when the Entra sign-in logs look normal. Capture the output before retrying, since the prompt may disappear afterward.
Check Conditional Access, especially any sign-in frequency policies that apply to the affected users. A recurring prompt could be policy-related rather than a broken local cache. Ask whoever manages those policies to check the scope and settings.
n542!foldcase_8:
I don't have access to those policies, so I'll check with the admin who manages them.
Also look at security tools that update IP lists or otherwise affect access policies. Changes like that have been associated with failed automatic token refreshes and repeat sign-in prompts. It won't apply everywhere, but it's worth checking alongside the token diagnostics if you use a tool with that kind of integration.
Take another look at the affected user's sign-in history for the week around a prompt, including application sign-ins such as Azure CLI. That might turn up a useful clue. Not seeing the issue in Outlook Classic doesn't necessarily mean switching clients fixes the underlying cause.
Answers are reviewed before publication.
n542!foldcase_8:
Getting someone to leave the prompt alone long enough might be tricky, but I'll try to capture the status while it's happening.