Users may continue to use old passwords to log in to Azure Active Directory (AD)-joined devices after updating passwords in Okta due to cached credentials, resulting in random lockouts. This occurs because the device maintains a Primary Refresh Token (PRT) that does not route authentication requests to Okta until a refresh is due. Locking the Windows desktop and unlocking it with the new Okta password forces a credential validation to resolve the issue. Symptoms include frequent lockouts when not accessing Okta-protected resources and Okta System Log failure events for "Authentication of a user via Rich Client" or "Authentication of user via MFA" due to invalid credentials.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Azure Active Directory (AD)
• Single Sign-On (SSO)

Azure AD-joined devices maintain a Primary Refresh Token (PRT) that periodically refreshes using the cached credentials of the logged-in user. While the device determines that the PRT is not yet due for a refresh, the Microsoft PRT mechanism does not attempt to route authentication requests to Okta. As a safety mechanism, Windows keeps a hash of the last valid credentials allowed for logging into the desktop in case the device loses internet connectivity. The local hash does not have a specific lifetime or expiration and remains usable for months after the password changes in Okta until the device utilizes the new password to obtain a new PRT.

How does Windows clear cached credentials on an Azure AD-joined machine?

Lock the Windows desktop, then unlock the device using the new Okta password to force Windows to validate credentials against the Okta federation and update the Primary Refresh Token.

1. After changing the Okta password, immediately lock the Windows desktop from the Ctrl, Alt, and Del menu or by pressing the Windows and L keys.
2. Use the new Okta password to unlock the device. Windows detects that the newly provided password does not match the stored hash and attempts to validate the password against the federation with Okta. If Okta accepts the password, Windows deletes the hash of the previous credentials, ensuring only the updated credentials remain valid for desktop access.
3. Open a Command Prompt by pressing the Windows and R keys, entering cmd, and pressing Enter.
4. Enter the dsregcmd /status command to find the AzureAdPrtUpdateTime value.
5. If the value does not fall within the expected date range, change the Okta password and repeat the lock and unlock process, ensuring the user enters the most current Okta password to access the desktop.

Related References

• What is a Primary Refresh Token?
• Enabling Okta Credentials for Windows 10 Login with Azure AD Join