Microsoft Teams Account Picker Appears on Every Login in Citrix Non-Persistent VDI – AADSTS70011 Invalid Scope Error

Question

Microsoft Teams Account Picker Appears on Every Login in Citrix Non-Persistent VDI – AADSTS70011 Invalid Scope Error

Sattar Ahmed Alamgeer 20

We are experiencing a Microsoft Teams authentication/account-picker issue in a Citrix non-persistent VDI environment.

Environment:

Citrix VDA: 2203 LTSR

Windows 10 Enterprise 21H2 / OS Build 19044

Microsoft Teams: 26198.304.4946.9672

Citrix Workspace App: 2402

Citrix UPM is used for profile management.

VDIs are non-persistent and provisioned using PVS/ELM.

Teams is running in Citrix HDX Optimized mode.

Issue:

After updating Teams, affected users are repeatedly presented with the Teams account picker/sign-in prompt instead of Teams automatically using the previously signed-in account.

We also see the following authentication errors:

0xCAA5001C

Token broker operation failed

Operation: GetTokenSilently

Error: -895352825 (0xcaa20007)

AADSTS70011:

The provided request must include a 'scope' input parameter.

Scope:

openid openid https://api.spaces.skype.com offline_access profile

The scope format is invalid.

We also see:

0xCAA90006

Failed to get token by WS-Trust flow

The older Teams version 26163.405.4842.717 worked correctly in the same environment.

0 comments

Answer accepted by question author

0 additional answers

Your answer

Answer 1

Killian N 4,410 Independent Advisor

Hi Sattar,

Thank you for taking the time to share the detailed information about your environment, along with the error messages you've captured.

From the details provided, one point that stands out is the duplicated openid value shown in the failed request.

Since this request is generated as part of the Microsoft Teams authentication flow, rather than being a scope that is typically configured manually in Microsoft Entra ID, the duplicate entry is certainly worth investigating further. Additionally, given that the older Teams client continues to work correctly within the same Citrix environment, this may suggest that the issue is related either to the newer Teams client itself or to how it interacts with the existing Citrix UPM profile data.

As an initial isolation step, I would recommend testing with one affected user by creating a new UPM profile, while leaving the existing profile unchanged.

If Teams signs in successfully using the new profile, this would indicate that persisted profile data or cached authentication information may be contributing to the issue.
On the other hand, if the same error occurs even with a clean profile, it would be reasonable to focus the investigation on the Teams client version or the underlying image-level configuration.

Could you also confirm the exact versions of:

Citrix VDA 2203 CU
MsTeamsPluginCitrix

This information may be useful because the current guidance for the new Teams VDI solution references VDA 2203 LTSR CU3 or later, Citrix Workspace app 2402, and MsTeamsPluginCitrix 2024.41.1.1.

In addition, before clearing any cached data, I would suggest enabling Extended Logging, reproducing the issue, and then collecting the Teams diagnostic logs using: Ctrl + Alt + Shift + 1

Microsoft generally recommends collecting the logs immediately after the issue occurs to ensure the relevant diagnostic information is captured.

Should the issue continue, the Teams diagnostic logs, together with the Request ID, Correlation ID, UTC timestamp, and the corresponding Entra sign-in logs, would provide valuable insight for further analysis. It may also be beneficial to compare the logs from a working Teams version against those from the affected version, as this could help determine whether a change introduced in the newer client is influencing the authentication flow.

For reference:

I hope this helps point the investigation in the right direction. Please let me know the results of the clean-profile test and the Citrix component versions, and we can review the next steps accordingly.

Kind regards,

Sattar Ahmed Alamgeer 20 Reputation points

2026-09-25T07:11:35.4933333+00:00

Hi,

Thank you for the detailed response and recommendations.

We performed the suggested test using a fresh/new UPM profile for an affected user, while leaving the existing profile unchanged. Unfortunately, the same Teams account picker/authentication issue persists even with the fresh profile.

This indicates that the issue may not be limited to persisted profile data or cached authentication information.

Regarding the Citrix component versions:

Citrix VDA: 23.0.7000.7522

Teams client: 26198.304.4946.9672

Citrix Workspace app: 2603
Sattar Ahmed Alamgeer 20 Reputation points

2026-09-25T07:17:30.0266667+00:00

Sorry teams Client version is 26225.1806.5074.1452.
Killian N 4,410 Reputation points Independent Advisor

2026-09-25T18:27:42.42+00:00
Hi Sattar,

Thank you for testing with a fresh UPM profile and for providing the updated component versions.

Since the same authentication issue occurs with a newly created profile, this makes stale Teams data or persisted authentication information in Citrix UPM much less likely to be the cause. It also strengthens the possibility of a Teams client authentication issue or an interaction between the current Teams build and the Citrix environment.

Your Teams version, 26225.1806.5074.1452, is newer than the version originally reported. Since the problem remains after updating Teams and reproduces with a fresh profile, I would recommend proceeding with log collection and escalation rather than making further profile changes.

Before escalating, please confirm the installed MsTeamsPluginCitrix version and check whether Teams reports Citrix HDX Optimized, Citrix SlimCore Media Optimized, or another optimization state under Settings > About Teams. Microsoft’s VDI documentation identifies the Citrix plugin, virtual-channel configuration, and optimization state as important components when troubleshooting Teams in Citrix.

Please also perform these two comparison tests, if possible:

Check whether the same user can sign in successfully to Teams on the web from the same VDI session.

Check whether the Teams desktop client works for the same user outside the Citrix environment.

These tests can help establish whether the failure is specific to the desktop client inside the VDI session.

Next, enable Extended Logging in Teams, reproduce the account-picker prompt and AADSTS70011 error, and collect the Teams logs by pressing:

Ctrl + Alt + Shift + 1

Microsoft’s VDI troubleshooting guidance confirms that Teams VDI logs can be collected with this shortcut. The Teams Client Health dashboard in the Teams admin center can also provide VDI-related insights and remediation information.

When opening a Microsoft 365 support request, I suggest including:

The working version.

The currently affected version.

The exact MsTeamsPluginCitrix version

Teams optimization status

Teams diagnostic logs

Microsoft Entra sign-in logs

The request ID, correlation ID, and timestamp from the AADSTS70011 error

Confirmation that the issue reproduces with a fresh UPM profile

Results from Teams on the web and from a non-VDI device

I hope everything gets sorted out soon. Please keep me posted on any updates.

Kind regards,
Killian N 4,410 Reputation points Independent Advisor

2026-09-28T08:31:12.9633333+00:00

Hi Sattar,

Have you reviewed the provided answer? Please let me know if there are any updates.
Sattar Ahmed Alamgeer 20 Reputation points

2026-09-28T17:25:59.1233333+00:00

hi Killian,

I am sorry I was busy, I see below in logs in Team after press CTRL+ALT+SHIT+1.

oauth_error_code: invalid_scope

server_error_code: 70011

Interaction required. Prompt will show

account_join_on_start: not_joined

`

We see OneAuth/WAM silent sign-in failing with invalid_scope and 70011, causing Teams to move to interactive authentication and present the account picker.
Killian N 4,410 Reputation points Independent Advisor

2026-09-29T13:47:08.09+00:00
Good day Sattar,

Thank you for sharing the detailed environment information and error messages.

The duplicated openid value in the failed request is significant:

openid openid https://api.spaces.skype.com offline_access profile

This request is generated by the Teams authentication flow and is not a scope that you would normally configure manually in Microsoft Entra ID. Since the older Teams version works in the same Citrix environment, the behavior appears more likely to be related to the updated Teams client or its interaction with the persisted Citrix UPM profile.

As a first isolation test, I recommend trying one affected user with a newly created UPM profile, without deleting the existing profile:

If Teams signs in normally with the new profile, compare the persisted Teams, WebView2, and identity-related profile data.

If the same error occurs with a clean profile, the Teams client build or image-level configuration is more likely involved.

Please also confirm the exact Citrix VDA 2203 cumulative update and MsTeamsPluginCitrix version. Microsoft currently lists VDA 2203 LTSR CU3 or later and Citrix Workspace app 2402 among the supported requirements for the new Teams VDI solution.

Before clearing any caches, enable Extended Logging, reproduce the issue, and collect the Teams diagnostic logs with: Ctrl + Alt + Shift + 1

I recommends collecting VDI logs immediately after reproduction because cache removal can delete information needed for troubleshooting.

Then open a Microsoft 365 support request and include the request ID, correlation ID, UTC timestamp, Entra sign-in log, and comparison logs from both the working and failing Teams versions. A temporary test with the older build may help confirm the regression, but it should not be considered a permanent resolution.

For reference:

Teams VDI requirements

Collect Teams diagnostic logs

I hope this helps narrow down the cause.