Share via

RDS users confronted with Microsoft 365 login popups in a hybrid environment

Michel G 20 Reputation points
2025-09-01T14:19:13.8966667+00:00

Hi all,

We have a customer with a on premises hybrid RDS environment; they have a domain controller and RDS server, both running Windows Server 2022 Standard. The domain controller is running the AD/Entra ID sync service which is configured for pass-through authentication. The necessary policies are in place to enable SSO with Microsoft 365 services (used to authenticate/license MS Office apps + Outlook etc.). This works fine when signing in to their account, but after an hour or two of being logged in users are confronted with the Microsoft 365 authentication pop-ups. This happens a few times a day.

We've tried the following to remediate the issue:

  • Run a .ps1 script to clear all M365 authentication tokens at logout
  • Disable WAM (DisableADALaptopWAMOverride, DisableAADWAM, DisableMSAWAM)
  • Re-enable WAM (DisableADALaptopWAMOverride, DisableAADWAM, DisableMSAWAM)
  • Block AADWorkspaceJoin (to make sure only app-authentication is enabled)
  • Migrated from UPD images to FSLogix
  • Created an Conditional Access policy to disable MFA for their office IP

We'd like to here what else we can try to remediate this annoyance for our customer, thanks!

Windows for business | Windows Server | Windows cloud | Other
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Harry Phan 10,850 Reputation points Independent Advisor
    2025-09-01T14:53:32.66+00:00

    Hi Michel,

    Given the environment—Windows Server 2022 Standard with Entra ID sync and pass-through authentication—this behavior often stems from token persistence and session context limitations within RDS sessions, especially when WAM (Web Account Manager) is involved.

    Here are a few additional areas worth exploring:

    • Ensure Modern Authentication is fully enabled across all Microsoft 365 services, particularly Exchange Online and SharePoint Online. Inconsistent auth modes can trigger fallback behaviors.
    • Review Conditional Access policies, especially those involving session controls or sign-in frequency. If policies enforce re-authentication after a short interval, that could explain the repeated prompts.
    • Check for roaming profile or FSLogix configuration issues. If token caches aren’t persisting correctly across sessions, users may lose their auth state prematurely.
    • Validate the integrity of the Primary Refresh Token (PRT). If the PRT isn’t issued or maintained properly in the RDS session, WAM-based SSO will fail intermittently. You can use dsregcmd /status to inspect PRT status.
    • Consider disabling WAM only if absolutely necessary, as it’s tightly integrated with modern authentication flows. Instead, try isolating the issue by testing with a clean user profile and minimal GPOs.
    • Enable logging for Office apps and AAD authentication

    Hope it works for you.

    Harry P.

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.