Recurring Work or School Account Sign-In Error Notifications (Hybrid-Joined Devices)

We're seeing a recurring issue where users receive frequent notifications from Windows saying, “There is a problem with your work or school account”, prompting them to sign in. However, when they attempt to sign in to resolve it, the process fails—despite everything else seemingly working fine (e.g., no impact on Teams, Outlook, or other M365 services).

All affected devices are hybrid Azure AD-joined (on-prem AD + Entra ID). This has been occurring across both Windows 10 and Windows 11 machines, including recent test deployments.

Using dsregcmd /status, I noticed the following in the logs:

SSO: Invalid Grant
AADSTS7000022: VSM Binding Key missing from Ticket Granting Ticket Request

Additionally, Azure AD Connect was found to be running an outdated version, which might be a factor—but I’m not certain if this is the root cause.

Has anyone encountered this before or found a reliable fix? Appreciate any insight!