Event ID 1006PRT acquisition started

What to check

Enable the analytic log, then read every AAD event between 1006 and 1007 as part of the same PRT attempt.

Find it with PowerShell

Run on the machine that logs it. Analytic and Debug logs are hidden and turned off by default: in Event Viewer choose View › Show Analytic and Debug Logs, then enable the log.

1
2Get-WinEvent -FilterHashtable @{ LogName = 'Microsoft-Windows-AAD/Analytic'; Id = 1006 } -Oldest -MaxEvents 50 |
    Format-List TimeCreated, Id, Message

Hunt for it in Sentinel or Log Analytics

This works once a data collection rule sends the Microsoft-Windows-AAD/Analytic log to your workspace, where it lands in the Event table.

1
2
3
4
5Event
| where TimeGenerated > ago(7d)
| where EventLog == "Microsoft-Windows-AAD/Analytic" and EventID == 1006
| project TimeGenerated, Computer, Source, RenderedDescription
| order by TimeGenerated desc

Related Primary Refresh Token events

• Event ID 1007: PRT acquisition finished (final error code)
• Event ID 1081: Error from the Microsoft Entra authentication service
• Event ID 1088: Error from the WS-Trust (federation) endpoint
• Event ID 1084: Network error reaching an endpoint
• Event ID 1022: URL being accessed
• Event ID 1144: UPN provided for sign-in
• Event ID 1098: Token broker operation failed (0xCAA5001C)

Search all 123 event IDs →