Update on Sep 29th 2020: It seems that PRT tokens must now … It feels like I’ve written this blog before – many times actually. We also check the system in Azure AD under Devices. Under the ‘User State’ section check the value for AzureAdPrt which must be YES. Microsoft says that you just have to update or upgrade to the latest version of Windows and the AzureAdPrt … The reason why AzureAdPrt is always NO seems to be a limitation of dsregcmd.exe command. Per my experience, here are examples of what might be the root of Azure AD PRT … If all of the above checks out, it’s time to check the Azure AD sign-in logs. Azure AD PRT is set to No and the reason for that is the other difference that you noticed "Is your Azure AD joined" is set to NO. If AzureAdPrt is set to NO, this means that the system has not been assigned a PRT. This is … Always evaluate/test everything yourself first before using/implementing this in production! However, the SSO State for AzureADPrt should be set to YES and not NO! On other machines that also do not have TPM the PRT seems fine and the device is automatically … AzureAdPrt: NO. This posting is provided "AS IS" with no warranties and confers no rights! The user won’t have SSO and will be … PRT which stands for the primary refresh token … Keep in mind that the Azure AD PRT is a per user token, so you might see AzureAdPrt:NO if you are running the “dsregcmd /state” as local or not synchronized (on-premises AD user UPN doesn’t match the Azure AD UPN) user. Another note, AzureADPRT = NO This particular user does not have TPM. A value of NO will indicate that no PRT was obtained. But given the amount of interest recently, it’s time to cover the topic again: How to troubleshoot Windows Autopilot … It never show the status correctly whether the user obtains a PRT or … AzureAdPrt : NO AzureAdPrtAuthority : EnterprisePrt : NO EnterprisePrtAuthority : I'm aware that AzureAdPrt is set to NO, but I understand that isn't an issue if you are trying to … Here AzureAdPrt should state ‘yes’ and the ‘AzureAdPrtExpiryTime should be later than the current time. It is in the Pending … The nicest thing here is that if the PRT was issued with MFA, the resulting access token also has the MFA claim! …