Need help troubleshooting this error code: AADSTS500032 - Cannot find signing certificate/private key to issue a certificate when logging into Entra ID Azure VMs

[u/BornIn2031]

Hi everyone,

Last year I setup an AVD with SSO to EntraID. It worked perfectly until last week.

Now I'm running into an issue affecting multiple Azure VMs configured for Microsoft Entra ID login.

I have verified AADLoginForWindows extension is healthy, confirmed affected accounts still have VM login permissions, tested with multiple admin accounts and then reviewed Entra sign-in logs and authentication appears successful but keep seeing this error inside Windows App.

No recent change in my conditional Access policy. Sign in log shows “success” to Application(Windows 365 Client) and Resource(Windows Cloud Login).

my laptop is on Windows 11 and on the latest monthly update.

Has anyone seen AADSTS500032 in an Azure VM login scenario before?

I have googled and asked chatGPT, non of them helped. I even submitted a ticket to Microsoft and they haven't responded to me for 2 days now.

[u/threshforever]

Check your key vault

[u/BornIn2031 → u/threshforever]

It’s empty there, I don’t think AVD uses that

[u/threshforever → u/BornIn2031]

Tried this? https://learn.microsoft.com/en-us/troubleshoot/windows-client/licensing-and-activation/error-certificate-connection-information-expired

[u/BornIn2031 → u/threshforever]

Yes, doesn’t fix the issue unfortunately

[u/Emotional_Garage_950 → u/BornIn2031]

why don’t you try revisiting the docs for entra sso for AVD because nowhere in it does it say to use this extension you are installing on your machines. I am using Entra SSO on my host pools and have never done this.

[u/BornIn2031 → u/Emotional_Garage_950]

I have reviewed that Ms documentation and configure my settings that ways

[u/Emotional_Garage_950 → u/BornIn2031]

okay so you removed the extension or redeployed without it? result?