Event ID 1084Network error reaching an endpoint

What to check

Test connectivity to the URL shown, and make sure the computer account can authenticate to any outbound proxy.

Codes you'll see in this event

Find it with PowerShell

Run on the machine that logs it.

1
2Get-WinEvent -FilterHashtable @{ LogName = 'Microsoft-Windows-AAD/Operational'; Id = 1084 } -MaxEvents 50 |
    Format-List TimeCreated, Id, Message

Hunt for it in Sentinel or Log Analytics

This works once a data collection rule sends the Microsoft-Windows-AAD/Operational log to your workspace, where it lands in the Event table.

1
2
3
4
5Event
| where TimeGenerated > ago(7d)
| where EventLog == "Microsoft-Windows-AAD/Operational" and EventID == 1084
| project TimeGenerated, Computer, Source, RenderedDescription
| order by TimeGenerated desc

Related Primary Refresh Token events

• Event ID 1006: PRT acquisition started
• Event ID 1007: PRT acquisition finished (final error code)
• Event ID 1081: Error from the Microsoft Entra authentication service
• Event ID 1088: Error from the WS-Trust (federation) endpoint
• Event ID 1022: URL being accessed
• Event ID 1144: UPN provided for sign-in
• Event ID 1098: Token broker operation failed (0xCAA5001C)

Search all 123 event IDs →