Microsoft Entra hybrid join and the Primary Refresh Token

Skills you'll practise

• Explain what the Primary Refresh Token is, when Windows gets it and how apps use it for single sign-on
• Identify the parts of a hybrid join (SCP, directory sync, registration task, device object) and which one failed from dsregcmd output
• Choose safe first actions for missing PRT or failed device authentication, and escalate with the right evidence

Course outline

1. 1.Microsoft Entra hybrid join and the Primary Refresh TokenVideo · 6 min
2. 2.What the Primary Refresh Token is and why single sign-on depends on itLesson · 15 min
3. 3.How hybrid join completes, step by stepLesson · 15 min
4. 4.Fixing missing PRTs and failed device authentication safelyLesson · 14 min
5. 5.Microsoft Entra hybrid join and the Primary Refresh Token: knowledge checkKnowledge check · 17 questions
6. 6.Microsoft Entra hybrid join and the Primary Refresh Token: practical exerciseKnowledge check · 1 question
7. 7.Microsoft 365 keeps asking one user to sign inScenario
8. 8.Final exam4 questions · passing it completes the course, so people who already know the material can test out

Sources it draws on

The lessons and questions are written from these references, so learners can go back to the original.

• Microsoft Learn: What is a Primary Refresh Token?
• Microsoft Learn: Troubleshoot devices by using the dsregcmd command
• Microsoft Learn: Configure Microsoft Entra hybrid join
• Microsoft Learn: Troubleshoot Microsoft Entra hybrid joined devices