Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
23,517 questions
Issues with M365ChatClient authentication from token protection CA policy
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(19.2, 25%, 11%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ENB%3C/text%3E%3C/svg%3E)
Neil Beytagh
1
Reputation point
I am getting errors with my account (i'm sure it extends to others in the test group) regarding authentication to Office 365 Exchange Microservices from the M365ChatClient.
I have a token protection CA policy scoped to the test user group, scoped to only office 365 exchange and office 365 SharePoint applications. It seems that I am getting the error due to unbound token (per the CA policy). How do we rectify this?
{count} votes
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(166.4, 27%, 26%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ERP%3C/text%3E%3C/svg%3E)
Raja Pothuraju 15,555 Reputation points Microsoft External Staff2025-03-04T15:46:05.74+00:00 Hello @Neil Beytagh,
Thank you for posting your query on Microsoft Q&A.
Based on your description, I understand that you have created a Conditional Access policy with the session control "Require token protection for sign-in sessions (Preview)" for Office 365 Exchange Online and Office 365 SharePoint Online. It looks like you're encountering an error due to an unbound token.
It looks like your device does not have a valid PRT token. Could you please confirm by running
dsregcmd /statusin Command Prompt and checking the AzureAdPrt value under the SSO State section to verify if a valid PRT is issued? Also, ensure that the device is joined to Microsoft Entra with the same user account that you are authenticating with, as either: Microsoft Entra joined, Microsoft Entra hybrid joined, Microsoft Entra registeredDuring the first sign-in on a device, a Primary Refresh Token (PRT) is issued by signing requests using the device key, which is cryptographically generated during device registration. On devices with a valid and functioning TPM (Trusted Platform Module), the device key is secured by the TPM to prevent unauthorized access. A PRT will not be issued if the corresponding device key signature cannot be validated. If the device has a valid and functioning TPM, the private keys are bound to the device's TPM, while the public keys are sent to Microsoft Entra ID.
Please refer to the following documentation and ensure that all prerequisites are met: Token Protection for Sign-in Sessions – Requirements
o further troubleshoot this issue, please share the complete error message displayed on your screen when accessing M365ChatClient. Additionally, I would like to connect with you offline—please share your contact details via private message.
-
Neil Beytagh 1 Reputation point
2025-03-04T18:20:24.3133333+00:00 the value for AzureADPRT is "Yes".
-
Raja Pothuraju 15,555 Reputation points Microsoft External Staff
2025-03-05T01:31:18.02+00:00 Hello@Neil Beytagh,
Thank you for confirming that PRT is valid on device. I have sent you an email please check and let me know your feasibility to connect offline on this issue.
Sign in to comment
Sign in to answer