Forum Discussion
Windows 11 forces PIN validation on boot for Edge, Teams and Phone Link
Hello. I am facing a persistent issue in Windows 11 where Microsoft Edge (running multiple windows and dozens of open tabs that I must keep active), Teams, and the Phone Link app demand PIN validation (Windows Hello) via toolbar prompts or "Your account requires attention" notifications upon every system startup. OneDrive is the only app that does not experience this issue.
I want to make it absolutely clear that I DO NOT want to disable any convenience features (automatic reopening of apps on boot and Edge startup boost are enabled by necessity), I DO NOT want to switch to a local account (I strictly need settings synchronization active between my other Windows 11 devices), and I DO NOT clear cookies on close.
To save time and avoid repetitive, generic troubleshooting steps, please note that I have already performed advanced troubleshooting procedures. I have disabled the Windows Hello requirement in settings, cleared credentials in Credential Manager, reset the Ngc security cache folder via terminal, applied local Group Policies for Edge, and even implemented a registry startup queue delay to prevent overcrowded login requests before the internet connection stabilizes.
The issue gets temporarily fixed for 2 or 3 startups after applying these fixes, but Windows automatically overwrites or ignores these directives and goes back to demanding the PIN to revalidate the Single Sign-On (SSO) token of my personal Hotmail email across native background apps.
There is clearly a hidden system maintenance scheduled task or a Cloud Identity Service component forcing this strict re-authentication cyclically, overriding user preferences. How can I stop Windows Hello from interfering with the automatic, silent login of these specific apps without breaking my device synchronization settings?
2 Replies
The repeated prompts don’t establish that a scheduled task is overriding your settings. Turning off the Windows Hello sign-in requirement also doesn’t prevent apps from requesting account verification. And resetting Ngc again could introduce more authentication disruption rather than fix the underlying issue.
Since several apps are affected but OneDrive isn’t, Windows’ shared account authentication is worth investigating. OneDrive working doesn’t rule that out because it can maintain a separate session.
Two useful next steps won’t require changing your startup or sync preferences:
- Open Settings > Accounts > Your info and Email & accounts. If Windows itself shows Verify or Fix now for the Hotmail account, complete that there rather than separately in each app. Note whether the warning returns after a restart.
- Capture what happens during one failing startup. Record the exact prompt text and time, then check Event Viewer > Applications and Services Logs > Microsoft > Windows > AAD > Operational, if available. Despite its name, that log can contain useful Windows authentication-broker errors; not every event there will be relevant.
If Windows shows no account warning, or verification only lasts a couple of restarts, take those errors to Microsoft support and request investigation of Web Account Manager/account-token persistence across restarts. That’s a more specific lead than another PIN reset.
There isn’t a supported universal switch that forces all three apps to accept silent sign-in when their account session requires verification. Avoid disabling identity services or deleting more authentication caches until there’s evidence identifying the failing component.
Hi Laura,
Your advice was spot on! I checked the Event Viewer under Applications and Services Logs > Microsoft > Windows > AAD > Operational right after a failing boot, and I found the exact error you suspected:
• Event ID: 1098
• Error Code: 0x80070005 (Access is denied)
• Description: Exception of type 'Class Exception' at EnumerateAccountsBrokerOperation.cpp, line 54, method EnumerateAccountsBrokerOperation::ExecuteImpl. Log: (0x80070005) Token broker operation failed.
It turns out the Web Account Manager / Token Broker was facing a hard file permission block when trying to enumerate and silently read the Microsoft account tokens stored in the system profile directory (\systemprofile\AppData\Local\Microsoft\Windows\WebCache and INetCache), causing it to drop the background SSO trust and force the manual PIN UI prompts on Edge and Teams every time.
I’ve just applied registry and permission fixes to resolve this specific 0x80070005 WebCache/NetCache access conflict so the Broker can successfully read the tokens silently during boot without breaking my device synchronization or startup settings.
Thank you so much for pointing me to the exact log directory—you actually nailed the root cause!
