Home » Internet » How to Solve invalid_client Error When Joining Windows 10 to Microsoft Entra ID

Internet

How to Solve invalid_client Error When Joining Windows 10 to Microsoft Entra ID

Geeksdigit Team

July 12, 2026

0 Views

SaveSavedRemoved 0

Joining a Windows 10 device to Microsoft Entra ID (formerly Azure Active Directory) allows users to access organizational resources, use single sign-on (SSO), and manage devices through Microsoft Intune or other enterprise management solutions. However, some users encounter the invalid_client error during the enrollment or sign-in process, preventing the device from successfully joining Microsoft Entra ID.

The error may appear after entering work or school account credentials, and the join process stops with a message indicating that the client is invalid or authentication failed. This usually happens because of incorrect app registration settings, outdated authentication tokens, device registration issues, conditional access policies, or tenant configuration problems.

Fortunately, the issue can usually be resolved by checking your account permissions, clearing cached credentials, verifying device registration settings, and ensuring that both Windows and Microsoft Entra ID are configured correctly.

In this guide, we’ll cover the most effective methods to fix the invalid_client error when joining Windows 10 to Microsoft Entra ID.

What Causes the invalid_client Error?

Several factors can trigger this authentication error during the device join process, including:

• Incorrect Microsoft Entra ID tenant configuration.
• User isn’t permitted to join devices.
• Expired or invalid authentication tokens.
• Corrupted Work or School account credentials.
• Device already registered in Microsoft Entra ID.
• Incorrect system date and time.
• Outdated Windows version.
• Conditional Access policies blocking enrollment.
• Microsoft Intune enrollment restrictions.
• Proxy, firewall, or network authentication issues.

Method 1: Verify Internet Connectivity

Windows must communicate with Microsoft authentication services during the join process.

1. Connect to a stable internet connection.
2. Open a web browser.
3. Visit several websites to confirm internet access.
4. If you’re using a VPN, temporarily disconnect it.
5. Try joining Microsoft Entra ID again.

Network interruptions during authentication may result in the invalid_client error.

Method 2: Check the Date and Time

Incorrect system time can prevent authentication tokens from being validated.

1. Open Settings.
2. Go to Time & Language > Date & Time.
3. Enable Set time automatically.
4. Enable Set time zone automatically if available.
5. Click Sync now.
6. Restart your computer.

Once the correct time is synchronized, retry the enrollment process.

Method 3: Make Sure Windows Is Activated

Some organizational policies require Windows to be properly activated before joining Microsoft Entra ID.

1. Open Settings.
2. Navigate to Update & Security > Activation.
3. Confirm Windows shows Activated.
4. If activation is required, complete it before trying again.

Although activation isn’t always mandatory, verifying it eliminates one possible cause.

Method 4: Verify the User Can Join Devices

Organizations can limit who is allowed to join devices to Microsoft Entra ID.

If you’re an administrator:

1. Sign in to the Microsoft Entra admin center.
2. Open Identity > Devices > Device settings.
3. Locate Users may join devices to Microsoft Entra.
4. Ensure your account or user group is allowed.
5. Save any changes if needed.

If you’re not an administrator, contact your IT department to verify that your account has permission to join devices.

Method 5: Remove Existing Work or School Account

Old enrollment information can interfere with new registrations.

1. Open Settings.
2. Go to Accounts > Access work or school.
3. Select the existing organizational account.
4. Click Disconnect.
5. Restart your computer.
6. Try joining Microsoft Entra ID again.

Removing outdated account information forces Windows to create a fresh enrollment.

Method 6: Remove Stale Device Registration

If the device was previously registered, duplicate entries can prevent successful enrollment.

1. Open Command Prompt as Administrator.
2. Run:

dsregcmd /status

3. Review the AzureAdJoined status.
4. If the device is partially registered, leave the organization from Settings > Accounts > Access work or school.
5. Restart the computer.
6. Retry the join process.

Administrators may also need to delete the old device object from Microsoft Entra ID before rejoining.

Method 7: Clear Cached Credentials

Corrupted authentication tokens can trigger the invalid_client error.

1. Open Control Panel.
2. Go to Credential Manager.
3. Open Windows Credentials.
4. Remove stored credentials related to Microsoft, Office, Azure, or your organization.
5. Restart the computer.
6. Sign in again during enrollment.

Windows will request fresh authentication tokens.

Method 8: Update Windows 10

Older Windows builds may contain authentication bugs or lack support for newer Microsoft Entra features.

1. Open Settings.
2. Select Update & Security.
3. Click Windows Update.
4. Select Check for updates.
5. Install all available updates.
6. Restart your computer.

Keeping Windows updated improves compatibility with Microsoft authentication services.

Method 9: Repair Corrupted System Files

Damaged system files can interrupt device registration.

1. Open Command Prompt as Administrator.
2. Run:

sfc /scannow

3. Wait for the scan to complete.
4. Restart the computer.

If SFC cannot repair everything, run:

DISM /Online /Cleanup-Image /RestoreHealth

Restart Windows after DISM finishes.

Method 10: Check Microsoft Entra Device Limits

Each user may have a maximum number of registered devices.

Administrators should:

1. Open the Microsoft Entra admin center.
2. Navigate to Identity > Devices > Device settings.
3. Review the Maximum number of devices per user setting.
4. Remove unused devices if the limit has been reached.

If the device limit is exceeded, new registrations may fail.

Method 11: Verify Intune Enrollment Restrictions

If your organization uses Microsoft Intune, enrollment restrictions may block the device.

Administrators should:

1. Open the Microsoft Intune admin center.
2. Navigate to Devices > Enrollment.
3. Review enrollment restrictions.
4. Ensure Windows devices are permitted.
5. Verify that the user is licensed for Intune.

Incorrect enrollment policies can prevent Microsoft Entra device registration.

Method 12: Check Conditional Access Policies

Conditional Access policies may block device enrollment under certain conditions.

Administrators should review:

• Device compliance requirements.
• Location-based restrictions.
• Multi-factor authentication requirements.
• Platform restrictions.
• Risk-based sign-in policies.

Temporarily excluding the affected user for testing can help determine whether Conditional Access is responsible.

Method 13: Verify Proxy and Firewall Settings

Authentication traffic must reach Microsoft services without interference.

1. Disconnect from restrictive corporate networks if possible.
2. Temporarily disable third-party proxy software.
3. Verify required Microsoft authentication endpoints aren’t blocked.
4. Retry joining the device.

Network filtering can interrupt OAuth authentication, resulting in the invalid_client error.

Method 14: Join Using Another Network

Sometimes local network filtering or captive portals interfere with enrollment.

1. Connect the PC to another trusted internet connection.
2. Use a mobile hotspot if appropriate.
3. Attempt the Microsoft Entra join again.

If enrollment succeeds on another network, the original network configuration likely needs to be reviewed.

Method 15: Check Microsoft Entra Service Health

Occasionally, the issue may be caused by a temporary Microsoft service outage.

Administrators can:

1. Sign in to the Microsoft 365 admin center.
2. Review the Service Health dashboard.
3. Look for incidents affecting:
   • Microsoft Entra ID
   • Microsoft Intune
   • Device Registration Service
4. Wait until the issue is resolved if Microsoft reports an outage.

Although uncommon, service disruptions can temporarily prevent successful device enrollment.

Method 16: Recreate the Device Registration

If the device registration is severely corrupted, creating a fresh registration may resolve the problem.

1. Disconnect the work or school account.
2. Restart the computer.
3. Remove any existing device object from Microsoft Entra ID (administrator).
4. Clear cached credentials.
5. Join the device again using the organizational account.

This creates a new device identity instead of attempting to reuse an invalid registration.

Method 17: Verify Licensing

Some Microsoft Entra and Intune features require appropriate licenses.

Administrators should confirm that the affected user has the required licenses assigned, such as:

• Microsoft Entra ID P1 or P2 (if required by organizational policies)
• Microsoft Intune license (if enrollment is managed through Intune)
• Microsoft 365 Business Premium or Enterprise license, where applicable

Missing or expired licenses can prevent device enrollment depending on your organization’s configuration.

Method 18: Reset Windows Work Account Components

If all else fails, resetting the work account components may help.

1. Disconnect the work or school account.
2. Restart Windows.
3. Remove cached credentials.
4. Ensure the device is no longer registered in Microsoft Entra ID.
5. Sign in again using Settings > Accounts > Access work or school.
6. Complete the join process from scratch.

This rebuilds the local authentication components used during enrollment.

Conclusion

The invalid_client error when joining Windows 10 to Microsoft Entra ID is typically caused by authentication problems, stale device registrations, incorrect tenant settings, enrollment restrictions, or expired credentials. In many cases, removing old work accounts, clearing cached credentials, verifying user permissions, and ensuring the device is properly configured are enough to resolve the issue. For managed environments, administrators should also review Microsoft Entra ID, Intune, Conditional Access, and licensing settings. By following the methods in this guide, you can identify the root cause and successfully join your Windows 10 device to Microsoft Entra ID.

Frequently Asked Questions

What does the invalid_client error mean?

It generally indicates that Microsoft Entra ID rejected the authentication request because of an invalid client configuration, expired credentials, permission issues, or an incorrect device registration.

Can cached credentials cause the invalid_client error?

Yes. Corrupted or outdated authentication tokens stored in Credential Manager can prevent successful enrollment.

Do I need administrator permissions to join Microsoft Entra ID?

That depends on your organization’s policies. Many organizations allow standard users to join devices, while others restrict this ability to specific users or administrators.

Can Intune policies prevent a device from joining Microsoft Entra ID?

Yes. Enrollment restrictions, device limits, licensing issues, or Conditional Access policies configured in Microsoft Intune can block successful device registration.