Cached
Fix Issues When You Can't Sync OneNote - Office Support
Office For Mac Repeatedly Requesting .. - Support.microsoft.com
Microsoft Onenote The Authentication Session Has Expired

Open your 'Keychain app' Select your default keychain on the left side, this is usually the 'login' keychain. Now click on the lock icon on the top left side to ensure the lock is in the locked state. Now open any Office app, you should see a dialog asking for permissions to access the keychain. As a OneNote beginner, I somehow. So I click on SIGN IN, a Microsoft pop. Into excel one drive i get this. Message.The authentication session has.

Question:

I haven't opened Mac OneNote in a long time, and when I open it today, I'm asked to sign in to my account again. So, click Sign in to my account.
Enter the username, the password. OneNote pops up tip:
The authentication session has expired. Please sign-in again.
Microsoft

Enter username, password multiple times, it still pop up this dialog box. How do I fix it?

Solution:

Open Mac 'Keychain app'.
Select your default keychain on the left side, this is usually the 'login' keychain.
Search the “Office”
Delete all items in list.
Finally, restart Mac system.

Related Documents

-->

A Primary Refresh Token (PRT) is a key artifact of Azure AD authentication on Windows 10, Windows Server 2016 and later versions, iOS, and Android devices. It is a JSON Web Token (JWT) specially issued to Microsoft first party token brokers to enable single sign-on (SSO) across the applications used on those devices. In this article, we will provide details on how a PRT is issued, used, and protected on Windows 10 devices.

This article assumes that you already understand the different device states available in Azure AD and how single sign-on works in Windows 10. For more information about devices in Azure AD, see the article What is device management in Azure Active Directory?

Key terminology and components

The following Windows components play a key role in requesting and using a PRT:

Google Nexus 6 (shamu). Google Nexus 5 (hammerhead). Google Nexus 4 (mako). ASUS Transformer Pad Infinity (tf700t).

Cloud Authentication Provider (CloudAP): CloudAP is the modern authentication provider for Windows sign in, that verifies users logging to a Windows 10 device. CloudAP provides a plugin framework that identity providers can build on to enable authentication to Windows using that identity provider’s credentials.
Web Account Manager (WAM): WAM is the default token broker on Windows 10 devices. WAM also provides a plugin framework that identity providers can build on and enable SSO to their applications relying on that identity provider. (Not included in Windows Server 2016 LTSC builds)
Azure AD CloudAP plugin: An Azure AD specific plugin built on the CloudAP framework, that verifies user credentials with Azure AD during Windows sign in.
Azure AD WAM plugin: An Azure AD specific plugin built on the WAM framework, that enables SSO to applications that rely on Azure AD for authentication.
Dsreg: An Azure AD specific component on Windows 10, that handles the device registration process for all device states.
Trusted Platform Module (TPM): A TPM is a hardware component built into a device, that provides hardware-based security functions for user and device secrets. More details can be found in the article Trusted Platform Module Technology Overview.

What does the PRT contain?

A PRT contains claims generally contained in any Azure AD refresh token. In addition, there are some device-specific claims included in the PRT. They are as follows:

Device ID: A PRT is issued to a user on a specific device. The device ID claim deviceID determines the device the PRT was issued to the user on. This claim is later issued to tokens obtained via the PRT. The device ID claim is used to determine authorization for Conditional Access based on device state or compliance.
Session key: The session key is an encrypted symmetric key, generated by the Azure AD authentication service, issued as part of the PRT. The session key acts as the proof of possession when a PRT is used to obtain tokens for other applications.

Can I see what’s in a PRT?

A PRT is an opaque blob sent from Azure AD whose contents are not known to any client components. You cannot see what’s inside a PRT.

How is a PRT issued?

Device registration is a prerequisite for device based authentication in Azure AD. A PRT is issued to users only on registered devices. For more in-depth details on device registration, see the article Windows Hello for Business and Device Registration. During device registration, the dsreg component generates two sets of cryptographic key pairs:

Device key (dkpub/dkpriv)
Transport key (tkpub/tkpriv)

The private keys are bound to the device’s TPM if the device has a valid and functioning TPM, while the public keys are sent to Azure AD during the device registration process. These keys are used to validate the device state during PRT requests.

The PRT is issued during user authentication on a Windows 10 device in two scenarios:

Azure AD joined or Hybrid Azure AD joined: A PRT is issued during Windows logon when a user signs in with their organization credentials. A PRT is issued with all Windows 10 supported credentials, for example, password and Windows Hello for Business. In this scenario, Azure AD CloudAP plugin is the primary authority for the PRT.
Azure AD registered device: A PRT is issued when a user adds a secondary work account to their Windows 10 device. Users can add an account to Windows 10 in two different ways -
- Adding an account via the Allow my organization to manage my device prompt after signing in to an app (for example, Outlook)
- Adding an account from Settings > Accounts > Access Work or School > Connect

In Azure AD registered device scenarios, the Azure AD WAM plugin is the primary authority for the PRT since Windows logon is not happening with this Azure AD account.

Cached

Note

3rd party identity providers need to support the WS-Trust protocol to enable PRT issuance on Windows 10 devices. Without WS-Trust, PRT cannot be issued to users on Hybrid Azure AD joined or Azure AD joined devices. On ADFS only usernamemixed endpoints are required. Both adfs/services/trust/2005/windowstransport and adfs/services/trust/13/windowstransport should be enabled as intranet facing endpoints only and must NOT be exposed as extranet facing endpoints through the Web Application Proxy

What is the lifetime of a PRT?

Once issued, a PRT is valid for 14 days and is continuously renewed as long as the user actively uses the device.

How is a PRT used?

A PRT is used by two key components in Windows:

Azure AD CloudAP plugin: During Windows sign in, the Azure AD CloudAP plugin requests a PRT from Azure AD using the credentials provided by the user. It also caches the PRT to enable cached sign in when the user does not have access to an internet connection.
Azure AD WAM plugin: When users try to access applications, the Azure AD WAM plugin uses the PRT to enable SSO on Windows 10. Azure AD WAM plugin uses the PRT to request refresh and access tokens for applications that rely on WAM for token requests. It also enables SSO on browsers by injecting the PRT into browser requests. Browser SSO in Windows 10 is supported on Microsoft Edge (natively) and Chrome (via the Windows 10 Accounts or Office Online extensions).

How is a PRT renewed?

A PRT is renewed in two different methods:

Azure AD CloudAP plugin every 4 hours: The CloudAP plugin renews the PRT every 4 hours during Windows sign in. If the

Microsoft Onenote The Authentication Session Has Expired