Entra ID Joined device intermittently loses device identity in token requests — "Invalid token" errors and Windows Hello PIN error 0x80284001, fixed by reboot

The symptoms point to intermittent issues with the device’s Microsoft Entra identity and its primary refresh token (PRT), plus a separate Windows Hello for Business PIN provisioning/authentication problem. All of them being fixed by a reboot strongly suggests transient token/PRT or network issues rather than a permanent misconfiguration.

A practical way forward is:

1. Use the Entra Windows device troubleshooter on this specific device
   Since the issue is isolated to one Windows 11 Entra‑joined device, start with the built‑in troubleshooter:
   1. Sign in to the Microsoft Entra admin center as at least a Reports Reader.
   2. Go to Entra ID → Devices → All devices → select the problematic device → Diagnose and solve problems.
   3. Under Windows 10+ related issue, select Troubleshoot.
   4. Select instructions and follow the steps to download and run the tool on the affected device, then collect and zip the authlogs folder.
   5. Upload the zip in the same Diagnose and solve problems pane. The troubleshooter will analyze device join/PRT/auth flows and return specific next steps, including whether to contact support.
2. Explicitly check for PRT and CloudAP errors on the device
   Because the Conditional Access evaluation sometimes sees the device as “undetermined” and returns “Invalid token”, verify that the PRT is healthy:
   • Follow the guidance in Troubleshoot primary refresh token issues on Windows devices to collect Microsoft Entra logs for a repro session on this device.
   • In the Microsoft Entra analytic and operational logs, look for:
     • CloudAP error codes (AAD_CLOUDAP_E_*) and network errors (ERROR_WINHTTP_*).
       Common network errors like ERROR_WINHTTP_TIMEOUT, ERROR_WINHTTP_NAME_NOT_RESOLVED, ERROR_WINHTTP_CANNOT_CONNECT, ERROR_WINHTTP_CONNECTION_ERROR indicate transient connectivity issues that can cause PRT refresh failures and “Invalid token” results.
     • If such errors appear, use events 1022 (analytic) and 1084 (operational) to identify the URL being accessed and confirm that the device can reach it without proxy interference.
3. Verify UPN and device join state consistency
   Now that the user signs into Windows with an Entra account, make sure the UPN and join state are clean:
   • For Entra‑joined devices, the UPN is the text entered at sign‑in. If CloudAP logs show AAD_CLOUDAP_E_OAUTH_USERNAME_IS_MALFORMED, correct the UPN to an internet‑style sign‑in name (RFC 822) and ensure it matches the Entra user object.
   • If the device had any previous hybrid‑join or domain‑join state, confirm that it is now only Entra‑joined and that there are no conflicting registrations.
4. Treat the Windows Hello PIN error as a token/authorization issue and re‑provision if needed
   The PIN error 0x80284001 is not directly listed in the Windows Hello error table, but similar server‑side or token issues during PIN operations are mitigated by:
   • Signing out and signing back in.
   • If sign‑out/in does not help and the error recurs, unjoining and rejoining the device to Entra ID, then re‑provisioning Windows Hello for Business.
     For related errors (for example 0x801C03ED), guidance is to:
   • Sign out and sign in again.
   • If unresolved, unjoin the device from Azure AD/Entra ID and rejoin.
   • Ensure the user has permission to join devices and register Windows Hello for Business keys.
5. Collect full diagnostic and network traces if the problem persists
   If the issue continues to appear weekly:
   • Use the PRT troubleshooting checklist to collect Entra logs during a repro.
   • Collect network traces with netsh trace start scenario=internetClient_dbg capture=yes persistent=yes, repro the issue (lock/unlock, sign‑in, Outlook/Teams access), then netsh trace stop.
   • Share the resulting nettrace.cab and Entra logs with Support as recommended.

This combination of the Entra device troubleshooter, PRT/CloudAP log review, UPN/join state validation, and potential re‑provisioning of Windows Hello/Entra join should identify whether the root cause is transient network/PRT refresh failure, a malformed identity in tokens, or a misconfigured device registration.

References:

• Troubleshooting Windows devices in Microsoft Entra ID
• Troubleshoot primary refresh token issues on Windows devices
• Troubleshoot Microsoft Entra hybrid joined devices
• Windows Hello errors during PIN creation