Starburst Login Fails in Incognito Mode with Trace ID Not Found in Azure Sign-in Logs

Yes. An authentication request can fail before a usable Microsoft Entra sign-in log entry is available, especially when browser cookies are unavailable or not handled correctly.

For this scenario, the strongest supported explanation is the Incognito/InPrivate browser behavior itself:

1. Incognito/InPrivate can prevent Entra cookies from being fully available Microsoft documents that when cookies are not correctly provided to Microsoft Entra ID, this can happen because of privacy features, browser-specific behavior, or InPrivate/Incognito mode. When that occurs, users can see:
   • SSO not working as expected
   • unexpected confirmation or consent dialogs
   • sign-out failures
2. This aligns with the observed pattern Since regular browsing works and Incognito/InPrivate fails across browsers, the issue is consistent with browser privacy restrictions affecting the OIDC sign-in flow rather than a general Entra tenant misconfiguration.
3. Third-party app or browser session handling can fail before useful Entra logging is visible The available guidance does not document every reason a Trace ID might be missing from Sign-in Logs, but it does show that browser-side cookie handling problems and unsupported authentication libraries can break authentication behavior before the normal SSO experience completes.
4. Check whether the app depends on browser extension or private-mode unsupported behavior Microsoft also documents for password-based SSO that private browsing modes can break sign-in because required browser support is unavailable in Incognito/InPrivate. Although that article is for password-based SSO, it reinforces the broader point that private browsing can block required browser state.
5. Use supported client libraries and supported browsers Microsoft recommends supported browsers and supported client authentication libraries such as MSAL so cookies are handled correctly and authentication and sign-out flows operate as designed. If Starburst is using a non-MSAL or custom OIDC implementation, that is an important area to validate.
6. If the app ever starts on HTTP, enforce HTTPS Microsoft documents an OIDC infinite redirection issue when an app is accessed over HTTP because the authentication cookie is marked secure and is not sent on HTTP requests. HTTPS avoids that issue. A workaround exists to allow cookies over HTTP, but it is not recommended for production because it reduces security.
7. Recommended troubleshooting path
   • Reproduce the failure only in Incognito/InPrivate and compare with a normal session.
   • Verify the Starburst OIDC integration uses a supported authentication library and does not rely on blocked third-party cookie behavior.
   • Confirm the full authentication flow is HTTPS only.
   • In the Microsoft Entra admin center, check Identity > Monitoring & health > Sign-in logs and filter by the affected user and failure timeframe.
   • For each failed entry that does exist, review:
     • Sign-in error code
     • Conditional Access tab
     • Authentication Details tab
   • If no entry exists for the reported Trace ID, focus investigation on browser-level restrictions and the application’s OIDC implementation, because the failure may be occurring before a normal Entra sign-in record is produced.
8. Best-supported conclusion for this case The most directly supported cause is that Incognito/InPrivate mode is restricting cookies or browser state required by the Entra OIDC flow. That can break SSO for third-party applications and can make troubleshooting harder when the failure does not complete as a normal sign-in event.

References:

• Web browser cookies used in Microsoft Entra authentication
• Troubleshoot infinite redirection between OIDC app and Entra ID
• Troubleshoot single sign-on and Conditional Access for Azure Virtual Desktop
• Troubleshoot password-based single sign-on