Server 2022 RDS farm , 6 RDsession hosts, Fslogix 26.01 CU1 , office365 MFA

Hello Jacco,

Thank you for posting question on Microsoft Windows Forum!

Based on the issue description. Well! The plausible explanation to this symptom is that Modern Authentication for Office 365 and OneDrive uses the Web Account Manager (WAM) via the Microsoft.AAD.BrokerPlugin. When a user logs onto RDS01 and authenticates, WAM generates identity tokens encrypted via Windows DPAPI (Data Protection API). Part of this encryption context is tied to the local machine's security boundary and Master Keys. On the other hand, when the user roams to RDS02, FSLogix loads the BrokerPlugin folder containing the RDS01 token. Because the token cannot be validated under RDS02's local machine context, WAM triggers an auth refresh/MFA prompt. Once authenticated on RDS02, WAM writes a new host-specific entry into TokenBroker\Accounts. FSLogix syncs this back to the VHD. Hence, once a user logs into every host in the farm (RDS01 through RDSN), their roamed VHD profile contains valid TokenBroker account entries for every single server. From that point on, WAM finds a matching token entry regardless of which host receives the user connection.

If you are using FSLogix Profile Containers, try not to use Office Containers simultaneously. Since combining both container types causes a split in where AppData\Local\Packages and AppData\Local\Microsoft\Credentials are mounted and persisted, breaking identity synchronization across hosts. Relying solely on the main Profile Container, which natively captures Outlook cache (.ost), OneDrive, and identity tokens cleanly in a single VHD.

Another suggestion is to check redirections.xml exclusions. If you are using a custom redirections.xml file, verify that you are not excluding any of these paths AppData\Local\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy, AppData\Local\Microsoft\IdentityCache, AppData\Local\Microsoft\OneAuth and AppData\Local\Microsoft\TokenBroker .Excluding these directories forces WAM to regenerate identity tokens on every single logon, preventing token persistence altogether.

Another point worth mentioning here is to verify DPAPI domain controller access. Because WAM tokens roam across machines, Windows DPAPI relies on Domain Controllers to decrypt master keys created on another machine. Ensure all RDS hosts have unhindered RPC/SMB connectivity to Domain Controllers (TCP 135, TCP 445, and dynamic RPC ports). If an RDS host cannot talk to a DC at user logoff/logon to decrypt or back up DPAPI master keys, WAM falls back to local machine keys, reproducing the single-host prompt behavior.

Hope the above information is helpful!