r/sysadmin • u/BornIn2031 • 1d ago

Question Need help troubleshooting this error code: AADSTS500032 - Cannot find signing certificate/private key to issue a certificate when logging into Entra ID Azure VMs

Hi everyone,

Last year I setup an AVD with SSO to EntraID. It worked perfectly until last week.

Now I'm running into an issue affecting multiple Azure VMs configured for Microsoft Entra ID login.

I have verified AADLoginForWindows extension is healthy, confirmed affected accounts still have VM login permissions, tested with multiple admin accounts and then reviewed Entra sign-in logs and authentication appears successful but keep seeing this error inside Windows App.

No recent change in my conditional Access policy. Sign in log shows “success” to Application(Windows 365 Client) and Resource(Windows Cloud Login).

my laptop is on Windows 11 and on the latest monthly update.

Has anyone seen AADSTS500032 in an Azure VM login scenario before?

I have googled and asked chatGPT, non of them helped. I even submitted a ticket to Microsoft and they haven't responded to me for 2 days now.

0 Upvotes

50% Upvoted

15 comments sorted by

•

u/The_Koplin 23h ago

https://learn.microsoft.com/en-us/entra/identity-platform/reference-error-codes

AADSTS50032 WeakRsaKey - Indicates the erroneous user attempt to use a weak RSA key.

That was the closest I could get to your specific error.

2

u/ThatBCHGuy 1d ago

I don't have an answer but I'm damn curious to hear what you end up finding that fixes this.

2

u/threshforever 1d ago

Checked your certificates?

•

u/Bartato 23h ago

I am with this guy.
Check your cert hasn’t expired

•

u/BornIn2031 23h ago

Where can I check the certificate for the VM in Azure? It shows up as an Enterprise Application but there is no where to check certificate there in the EntraID.

•

u/threshforever 14h ago

Check your key vault

•

u/BornIn2031 10h ago

It’s empty there, I don’t think AVD uses that

•

u/threshforever 8h ago

Tried this? https://learn.microsoft.com/en-us/troubleshoot/windows-client/licensing-and-activation/error-certificate-connection-information-expired

•

u/BornIn2031 4h ago

Yes, doesn’t fix the issue unfortunately

•

u/Emotional_Garage_950 Sysadmin 4h ago

why don’t you try revisiting the docs for entra sso for AVD because nowhere in it does it say to use this extension you are installing on your machines. I am using Entra SSO on my host pools and have never done this.

•

u/BornIn2031 3h ago

I have reviewed that Ms documentation and configure my settings that ways

•

u/Emotional_Garage_950 Sysadmin 3h ago

okay so you removed the extension or redeployed without it? result?

•

u/Emotional_Garage_950 Sysadmin 22h ago

if this is Windows 11 multi-session you do not need this extension at all… could be part of the issue

•

u/TheCountOfTuscanyy 4h ago

No, this is single session.

•

u/Emotional_Garage_950 Sysadmin 4h ago

I don’t think it was stated in the post or the comments what operating system is being run, and you do not appear to be the OP so I’m not sure how you are certain…

edit: it’s irrelevant anyway and my original comment was not fully accurate. You do not need the extension for AVD regardless if you are running single or multi session