Skip to content

Primary Refresh Token (sign-in) · Post-join authentication (PRT) phase

Fix PRT error 0xC000005F (user realm not found)

0xC000005F · STATUS_NO_SUCH_LOGON_SESSION Checked against Microsoft Learn

Quick answer

0xC000005F in the PRT attempt status means Microsoft Entra ID couldn't find the domain in the user's UPN during realm discovery, so the device couldn't get a Primary Refresh Token. Add the UPN's domain as a verified custom domain in Microsoft Entra ID. If the on-premises suffix is non-routable ([email protected]), configure Alternate Login ID.

Waitlist · launches Dec 1, 2026

The Autopilot + Device Prep Deployment Doctor

Checks your tenant, read-only, for the config that breaks ESP and Device Preparation, and tells you why a stuck device is stuck. Join the waitlist and we'll email you at launch.

Join the Kit 1 waitlist for the Autopilot + Device Prep Deployment Doctor

Check this first

Is the domain in the user's UPN a verified custom domain in your Microsoft Entra tenant?

What 0xC000005F means

User realm discovery failed because the Microsoft Entra authentication service couldn't find the user's domain.

Common causes

  • The domain of the user's UPN isn't added as a custom domain in Microsoft Entra ID.
  • The on-premises domain name is non-routable (for example [email protected]).

How to fix 0xC000005F

  1. Run dsregcmd /status as the user and confirm Attempt Status shows 0xc000005f.
  2. Check event 1144 in the Microsoft Entra analytics log for the UPN that was used.
  3. Add and verify that UPN domain as a custom domain in Microsoft Entra ID.
  4. If the suffix is non-routable, change users to a routable verified suffix or configure Alternate Login ID.
  5. Lock and unlock the device to retry getting the PRT.

Free PDF

Top 10 Intune and Autopilot Enrollment Errors: Causes and Fixes

A free cheat sheet covering ten enrollment errors, each with the symptom, the most likely cause, the fix, and a link to the full guide.

  • Ten real error codes and failures, including 0x80180014, 0x8018002b, 0x801c03f3, 0x800705b4, the ODJConnector logon failure, and the Win32 detection error 0x87d1041c.
  • Every cause and fix checked against Microsoft's own documentation.
  • A link from each entry to the full zakitpro.com article.

You get the free PDF. By subscribing you also agree to receive occasional emails from zakitpro about Intune and Autopilot troubleshooting. Emails are sent through MailerLite. You can unsubscribe anytime with the link in every email. See the privacy page for how your email is handled.

Related guides and tools

Other Primary Refresh Token (sign-in) codes

Sources

This page is a paraphrase of Microsoft's documentation. Check the source before you change production settings.