Teams and Outlook require reauthentication on AVD machines

Question

Teams and Outlook require reauthentication on AVD machines

Adam Stewart 0

We are transitioning our AVD estate to host pools which use FSLogix. In these host pools users have given feedback that MS apps, mainly Teams and Outlook, keep asking for reauthentication throughout the day. I've seen this myself on the AVD machine I have assigned, it usually asks me to reauthenticate once in the afternoon but other users have reported they have been asked more frequently than this. Our AVD machines are using a personal model so users are only using the one machine and not hopping between VMs in a given pool.

We're unsure if there's a configuration we're missing for this or a setting that needs changed so any help on this would be greatly appreciated.

0 comments

1 answer

Your answer

Answer 1

For AVD with FSLogix, the most likely cause is that Microsoft Entra/WAM identity data is not being roamed correctly in the user profile. That leads to Teams, Outlook, OneDrive, and other Microsoft 365 apps prompting for sign-in repeatedly.

A supported fix is:

Update FSLogix to the latest version.
Enable RoamIdentity in FSLogix.
- Set the registry value to 1, or enable it through Group Policy.
Make sure these identity-related locations are not being excluded from the profile container:
- %USERPROFILE%\\AppData\\Local\\Packages\\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy
- %USERPROFILE%\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy
- %USERPROFILE%\\AppData\\Local\\Microsoft\\TokenBroker

Why this matters:

In FSLogix 2210 and later, content in those broker/token locations is no longer roamed as part of the user profile by default.
The documented resolution is to install the latest FSLogix version and configure RoamIdentity=1.
A matching AVD community case for Teams and OneDrive SSO on multi-session hosts was resolved by enabling the Roam Identity GPO.

Additional AVD-specific checks:

If the hosts are only standard domain joined, users can be prompted to authenticate to Microsoft 365 apps at every sign-in because those VMs do not create a Primary Refresh Token at sign-in.
Microsoft recommends Microsoft Entra joined or Hybrid Microsoft Entra joined virtual machines for the best user experience.

If the issue is mainly seen during sign-in together with long black-screen delays or SSO failures, check whether affected hosts installed Windows updates released between July 23, 2024 and October 8, 2024. A known AVD issue in that update range can cause both extended black screen at logon and Office/Teams/Outlook SSO failures, and it is more likely in multi-session environments using FSLogix.

If sign-ins are also slow, review host sizing and user load. FSLogix guidance recommends checking VM performance, reducing simultaneous sessions, or increasing VM size when the machine is too small for the workload.

References: