AVD SSO fails for exactly one user with TokenLogonFailed / 0x8007052E

Hello @MarcAF

Thanks for the detailed troubleshooting information and follow-up.

Since approximately 70 other users can connect successfully, and the affected user experiences the same failure across multiple devices and both the Windows App and the web client, this appears to be specific to the user's SSO sign-in path rather than a general host pool or client configuration issue.

You've also confirmed that both Azure Virtual Desktop and Windows Cloud Login show successful Microsoft Entra sign-ins, per-user MFA is disabled, and Conditional Access requirements are satisfied.

Successful Microsoft Entra authentication doesn't necessarily mean Windows successfully created the user's session on the AVD host.

The TokenLogonFailed / 0x8007052E error suggests that we should investigate the Windows session-host authentication stage.

Recommended next steps

1. Review authentication events on the session host

Reproduce the issue and check the following Event Viewer logs on the session host handling the failed connection:

• Applications and Services Logs > Microsoft > Windows > AAD > Operational
• Windows Logs > Security, particularly failed logon events such as Event ID 4625
• Applications and Services Logs > Microsoft > Windows > TerminalServices-LocalSessionManager > Operational

For any corresponding failure, capture the timestamp, event ID, status/substatus, authentication package, and account identity.

This helps determine whether the failure occurs during token processing, account mapping, or Windows session creation.

2. Verify the affected user's identity configuration

Could you confirm whether your session hosts are Microsoft Entra joined or Active Directory/hybrid joined?

If they are hybrid joined, compare the affected user's identity attributes with a working user, particularly:

• User Principal Name (UPN) in Microsoft Entra ID and Active Directory.
• Whether the account is synchronized from on-premises AD.
• Whether there have been recent account renames, domain migrations, or identity changes.

Identity mismatches between Active Directory and Microsoft Entra ID can affect Azure Virtual Desktop authentication.

3. Review session-host sign-in prerequisites

If the hosts are Microsoft Entra joined, verify that the affected user has the appropriate VM sign-in permissions and that the session host's Microsoft Entra authentication components are healthy.

Since other users can connect, I don't recommend reinstalling the AADLoginForWindows extension or changing host-wide SSO settings at this stage.

4. Correlate the AVD connection failure

Review the failed connection in Azure Virtual Desktop Insights or the available AVD diagnostic logs.

Correlate the failure timestamp and connection correlation ID with the Windows events on the session host.

This should help identify whether the token was accepted by Microsoft Entra but rejected during the Windows logon process.

Could you confirm two things?

• Are the session hosts Microsoft Entra joined, hybrid joined, or AD DS joined?
• Do you see a corresponding authentication failure in the session host's AAD Operational or Security event logs when the affected user attempts to connect?

These two details should help narrow down whether we're dealing with identity mapping, token validation, or Windows logon processing. Hope this helps!

References:

• Troubleshoot SSO and Conditional Access for Azure Virtual Desktop
• Troubleshoot connections to Microsoft Entra joined VMs
• Azure Virtual Desktop identities and authentication
• Sign in to a Windows VM using Microsoft Entra ID

Help make this community better for everyone: If this answer helped or resolved your issue, please accept it or upvote it. If not, share more details in a comment so we can continue the discussion and find the right solution. Thank you.