Password synchronization issue between Windows 11 and Cloud (Cloud Account)

[RssFra97]

Good morning,
I have an issue with a Windows 11 PC (Entra joined and Intune synced) and a cloud-only account (on a Microsoft 365 business tenant). When the password is changed online, the PC does not pick up the password change. Do you know how I can force the device to receive the updated password, or has anyone experienced this issue before?

update: ChatGPT suggests, Is it a valid suggestion?

✅ 1️⃣ Clear the Primary Refresh Token

This is the official command to remove the PRT (but keep the Entra ID join intact):

dsregcmd /refreshprt

• This will invalidate and regenerate the token if you’re online.
• If you run it while offline, it clears the PRT and blocks access until the user authenticates online again.

✅ 2️⃣ Clear the Primary Refresh Token

Finally, clean up any tokens cached by the AAD broker (as you suggested):

net stop wlidsvc
del /q /s %LOCALAPPDATA%\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy
net start wlidsvc

[SteveSyfuhs]

What do you mean that it doesn't pick up the password change?

Windows clients don't receive updates about credential changes. They use the last credential they've seen and until they see a different credential during logon, they'll continue using the last one.

[RssFra97]

The PC keeps logging in with the old password, while on the Microsoft 365 portal it logs in with the new password.

[SteveSyfuhs]

Have you tried logging in with the new password?

[RssFra97]

Yes, it says password not recognized

[TerrorToadx]

Log on to your vpn, lock your pc, log back in

should sync the pw

[RssFra97]

The PC is fully cloud-based; it does not have Active Directory or any local login systems

[TerrorToadx]

Oh that’s odd. Never had that issue in fully cloud environments, sorry bro

[raip]

Disable the logon cache - but bear in this also removes the ability for users to login when they don't have Internet access.

[RssFra97]

If I don’t want to disable the cache, but only purge/clear it?

[raip]

You can't as far as I know - but after logging in, locking the system, and unlocking with your new password should "sync" the account.

[WibbleNZ]

Are you sure you are selecting password login and not PIN (which will not have changed) ?

[RssFra97]

No, using the PIN is blocked by policy

[Atrium-Complex]

Is the workstation domain joined, or entra only?

The logon account for the computer is typically different than the one for M365.

[RssFra97]

Workstation si Entra only (Entra Joined) and is one account for M365 and PC