azureblog.co.uk
← cd ~/events
// events/1098 · Primary Refresh Token

Event ID 1098Token broker operation failed (0xCAA5001C)

Entra authentication through the token broker failed, which can break the Store for Business and Enterprise State Roaming. Caused by missing permissions or ownership on the AAD BrokerPlugin PSR registry key.

LogMicrosoft-Windows-AAD/Operational
SourceMicrosoft-Windows-AAD
AreaPrimary Refresh Token

What to check

Match the SID in the event to HKEY_USERS, take ownership (SYSTEM) of the BrokerPlugin PSR key if needed and re-enable permission inheritance.

Codes you'll see in this event

CodeMeaning
0xCAA5001CToken broker operation failed.

Find it with PowerShell

Run on the machine that logs it.

powershell2 lines
Get-WinEvent -FilterHashtable @{ LogName = 'Microsoft-Windows-AAD/Operational'; Id = 1098 } -MaxEvents 50 |
    Format-List TimeCreated, Id, Message

Hunt for it in Sentinel or Log Analytics

This works once a data collection rule sends the Microsoft-Windows-AAD/Operational log to your workspace, where it lands in the Event table.

kql5 lines
Event
| where TimeGenerated > ago(7d)
| where EventLog == "Microsoft-Windows-AAD/Operational" and EventID == 1098
| project TimeGenerated, Computer, Source, RenderedDescription
| order by TimeGenerated desc

Related Primary Refresh Token events

Search all 123 event IDs →

Sources