Fix account sign in loop after device enrollment

[valexiadis]

Hello,

We have an issue in our organization where some devices we enrol get in a sign in loop after a few days. More specifically, the way we've set up our environment is as follows:

- Devices are primarily managed by MECM so in order to enable co-management we add them to a collection called Pilot Co-Managed Devices.

- We then add the devices to an on-premises AD group in order to enable hybrid join.

- After the devices are hybrid joined we add them to an MEM group called Pilot Co-Managed devices in order for them to get the policies we have set up.

We've done that for about 600 devices. Now, a very small percentage of those (around 12 devices) develop the above-mentioned issue after a few days. All Microsoft products show a Fix Account error, same with windows, and the only way to solve it is to effectively offboard the device. When clicking on fix account either nothing happens or the sign in window keeps popping up. I've also some times noticed the device registration window flashing. Under email accounts there are two identical ones appearing with the only difference being one of them says All apps can sign you in and the other says Microsoft Apps can sign you in. From my understanding the problem is that the ad registered and the hybrid joined accounts don't merge. Two of those devices were working fine and the error occurred when the user changed their password because it had expired.

Any ideas? I'd really appreciate anyone's help!

[#2]

Hi,

Any Conditional access or security baselines we should be aware of ?
Do you have any good reasons to go hybrid? LIke device authentication etc?

What does the dsregcmd /status tells you?

[#3]

Hello, thank you for your reply.

No conditional access but we do have a security baseline set for Defender which applies to the MEM group. I'm troubleshooting one of those devices currently and I have enrolled it to Intune but haven't added it to the MEM group in order to see if it develops the same issue. It usually happens after a couple of days so I should definitely know by tomorrow.

We went hybrid because we still need the on-premises MECM so Co-Management is the only option at this point. Dsreg shows everything is normal, as a successfully enrolled device.

[#4]

Hi, its indeed a good way to test if existing policies are giving you issues... please report back when you know if the base line could be the issue

[#5]

Hello, it does look like the security baseline is causing the issue. Thanks for pointing me in that direction. Now to find exactly which part of it is the cause!

[#6]

Hi, thanx for replying back... I would love to hear what broke the account sign in from the security baseline.. (I am assuming you used the build in Security baseline for windows 10 or later?)

Maybe something to do with the credential guard being enabled or something like that?

[#7]

Hello
Im actually having the same problem with a similar set up (Intune computers, only a very small percentage are giving us this problem)
We also have conditional access regarding those computers, but it affects users that are excluded from it.
Can you please share how did you resolve the problem in the end please?

[#8]

@GiladD1240 

Hello, we had a similar situation. The problem disappeared after we performed account opening or verification (MFA) in MsOffice 365 products. Then we excluded the MFA of MSOffice applications with Conditional access. In this case, users who had a problem only in case of password change were informed to log in to MsOffice 365 applications with their new passwords.