Event ID 1144UPN provided for sign-in

What to check

Confirm the UPN suffix is a verified custom domain in Entra ID and is not a non-routable suffix such as .local.

Find it with PowerShell

Run on the machine that logs it. Analytic and Debug logs are hidden and turned off by default: in Event Viewer choose View › Show Analytic and Debug Logs, then enable the log.

1
2Get-WinEvent -FilterHashtable @{ LogName = 'Microsoft-Windows-AAD/Analytic'; Id = 1144 } -Oldest -MaxEvents 50 |
    Format-List TimeCreated, Id, Message

Hunt for it in Sentinel or Log Analytics

This works once a data collection rule sends the Microsoft-Windows-AAD/Analytic log to your workspace, where it lands in the Event table.

1
2
3
4
5Event
| where TimeGenerated > ago(7d)
| where EventLog == "Microsoft-Windows-AAD/Analytic" and EventID == 1144
| project TimeGenerated, Computer, Source, RenderedDescription
| order by TimeGenerated desc

Related Primary Refresh Token events

• Event ID 1006: PRT acquisition started
• Event ID 1007: PRT acquisition finished (final error code)
• Event ID 1081: Error from the Microsoft Entra authentication service
• Event ID 1088: Error from the WS-Trust (federation) endpoint
• Event ID 1084: Network error reaching an endpoint
• Event ID 1022: URL being accessed
• Event ID 1098: Token broker operation failed (0xCAA5001C)

Search all 123 event IDs →