Azure AD Connect- All because of a workstation with WAM Service error 7000003

Richard Sheasley 0 Reputation points
2026-04-15T04:20:14.1833333+00:00

My title to this should be Microsoft you really need to handle this better!!!

1 user that could not keep signed into their Microsoft 365 WAM Service error 7000003 would come up - One Drive, and a few other things. Their Office packages are working (but complaining not signed in). So down the diagnostics on the issue. Seems if you are Domain joined and running Windows 11, the system also has to be AzureAD joined if you are on Microsoft 365 in a hybrid mode. So to fix that Microsoft has a Entra Sync Connector- . Not supposed to install it unless really no other option on the Domain Controller. So I chose the Remote Desktop Gateway VM to do the installation on. Instructions of about 10 steps and should be all good. Except it wants all the Windows logins to be pointing to ******@domainname.com and not domainname.local. I change that in the User account (one for now to test that is getting that error)

You are sent to a link to download the software-

https://www.microsoft.com/en-us/download/details.aspx?id=47594

DOES NOT WORK- downloads a .pdf 1 page paragraph that basically says SORRY we do not offer the download here anymore!! No nice instructions with easy set of steps to actually get the AzureADconnect.msi installer required to fix this EITHER. Tried 2 different AI engines (including Microsoft Copilot that could not tell me where and how to get this mystery top secret fix software package!! to even start this. Literally probably 3 hours out of my day just to get the NEW location and how to do it. Sign into the Entra Admin, and you also after round and round have to have additional roles assigned- on the Entra to be able to get all this done. So over the weekend I figure that I could get this done and the user off my back while I deal with other final issues.  AI tells me I can just use the Express install, but nope I could not because of the need for Hybrid AD from all I've read.  Spent an evening- I asked Copilot AI to clearly give me step by step instructions- but I have to use customize. They want the Hybrid AD selection but that was not an option and nowhere to be found on any screens and steps with the customized installation. AI claims- that is fine sometimes that happens and it works even without that Hybrid AD appearing. I do the install and finished up late in the evening. I did not test the Remote Desktop gateway though and it broke something in that service and setup. DIagnose that and get it running again and then back to the Entra Sync. The user is still showing only domain joined and not the AzureADjoined also. So AI says that is because of the failure to have the Hybrid AD in the installation that is not an option. Suggest a repair install since the other steps did not provide any sort of solution to add the required Hybrid AD. Run the Repair installation option and Microsoft throws up another error- that a Repair can't be done and to contact the Package Developer writer for support (like that is going to be easy to get to the team of this)

So Suggestion is to UNINSTALL restart the server, manually delete some folders and files so that another try can be made. Easily have 6 to 7 hours in all this so far and back at the start again- run the installer this time again with Custom and advanced options and HOPE and PRAY that somewhere this second attempt to get the offer Hybrid AD option show up (like a magician pulling something out of their hat)??? Wat to do if the same options are offered again and WHY is Hybid AD not a clear and easy thing not sure if all this is worth it and maybe just try a fix on the workstation side and leave it as just only DomainADjoined and not the AzureADjoined. This site discusses the PC workstation fixes and I did probably another 3 ours of dsregcmd leave and status and reboot and attempt to get it right

If Microsoft makes a simple server install be any more challenging without having an easy well documented solution and fix? The user just wants to be able to open OneDrive and work.

Microsoft Security | Microsoft Entra | Microsoft Entra ID

1 answer

Sort by: Oldest
Most helpful Newest Oldest

  1. AI answer

    2026-04-15T04:20:52.5133333+00:00

    The workstation’s WAM sign-in problem and the complexity around Azure AD Connect/Hybrid join are separate issues. For a single user who “just wants OneDrive and Office to stay signed in,” focus on fixing the local authentication components first instead of rebuilding hybrid.

    Based on the context, there are two key areas to check on the Windows 11 client:

    1. Fix the Microsoft Entra WAM plugin (Microsoft.AAD.BrokerPlugin)
      This plugin is required for modern authentication and WAM-based sign-in to Microsoft 365 apps (OneDrive, Office, Teams, etc.). If it is missing or broken, users see repeated prompts or errors like the one described. On the affected workstation:
      1. Open an elevated PowerShell window:
        • Right-click Start → Windows PowerShell (Admin).
        • Approve the UAC prompt.
      2. Run the following command to repair/reinstall the Microsoft Entra WAM plugin package: 
              if (-not (Get-AppxPackage Microsoft.AAD.BrokerPlugin)) {
          Add-AppxPackage -Register "$env:windir\SystemApps\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Appxmanifest.xml" -DisableDevelopmentMode -ForceApplicationShutdown
      }
      Get-AppxPackage Microsoft.AAD.BrokerPlugin
      3. After the command completes without errors, restart the workstation.
      4. Have the user sign in to Windows with their domain account, then open OneDrive/Office and sign in with their Microsoft 365 account again.
      This directly addresses the WAM component that Microsoft 365 desktop apps rely on.
    2. Use the built-in troubleshooter for Microsoft 365 desktop sign-in
      Windows 10/11 includes an “Access work or school” troubleshooter that specifically targets the scenario where users cannot sign in to Microsoft 365 desktop apps (Teams, OneDrive, Outlook, Word, Excel, PowerPoint) due to missing or broken AAD broker components. On the affected workstation:
      • On Windows 10: Start → Settings → Update & Security → Troubleshoot → View troubleshooting history and confirm whether the Access work or school troubleshooter has run. If it appears, it may already have attempted to repair the AAD broker plugin.
      • On Windows 11: Start → Settings → System → Troubleshoot → Recommended troubleshooter history and look for:

        Access work or school troubleshooter – Automatically repair system files and settings to fix a problem on your device

      This troubleshooter automatically checks for and installs the Microsoft.AAD.BrokerPlugin package if it is missing.
    3. Avoid unnecessary Azure AD Connect/Hybrid changes for a single WAM issue
      From the context:
      • Azure AD Connect (“Sync”) is required for hybrid identity scenarios and “same sign-on,” but it is not required just to fix a single workstation’s WAM sign-in problem.
      • AAD Connect is intended to synchronize users and (optionally) password hashes from on-premises AD to Microsoft 365. It is not the fix for a broken WAM plugin on one client.
      If the environment already has directory synchronization working and users can sign in to Microsoft 365 generally, do not rebuild Azure AD Connect or attempt to reconfigure hybrid just to fix this workstation. Instead, focus on:
      • Repairing Microsoft.AAD.BrokerPlugin as above.
      • Ensuring the device can reach Microsoft 365 endpoints and that no local firewall/proxy is blocking modern auth.
    4. If the device is domain-joined only
      Hybrid Azure AD join is not strictly required for OneDrive/Office sign-in to work. A domain-joined device can still use modern authentication as long as:
      • The user’s cloud identity exists and is licensed in Microsoft 365.
      • The WAM plugin and sign-in components on the device are healthy.
      Therefore, it is reasonable to leave the device as domain-joined only and fix the local sign-in stack rather than forcing hybrid join for this scenario.

    Summary of practical steps:

    1. On the affected workstation, run the PowerShell command to repair Microsoft.AAD.BrokerPlugin and restart.
    2. Verify that the “Access work or school troubleshooter” has run (or will run automatically) and that the user can sign in to Microsoft 365 apps afterward.
    3. Avoid further Azure AD Connect/Hybrid reconfiguration unless there is a broader directory synchronization or hybrid identity requirement beyond this one user’s WAM issue.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.