Slack “Modern Auth” Prompt Loops (ADAL/MSAL)

A persistent “Modern Auth” authentication loop repeatedly prompts users for corporate credentials without ever finalizing the sign-in process in Slack. This issue primarily affects desktop and mobile users in Microsoft Azure Active Directory (Entra ID) environments during Microsoft Active Directory Authentication Library (ADAL) to Microsoft Authentication Library (MSAL) token handshakes. Resolving it requires clearing stale authentication broker tokens or re-establishing device registration states.

Fast-Fix: The 45-Second Solution

A Slack “Modern Auth” prompt loop occurs when the Microsoft Authentication Library (MSAL) fails to validate a Primary Refresh Token (PRT) stored in the Windows Web Account Manager (WAM). To fix it immediately, open Windows Settings > Accounts > Access work or school, select your corporate account, click Disconnect, and then reconnect it to refresh your device authentication token.

Quick Logic Snapshot

• Severity: Operational (Blocks user authentication and workspace connectivity).
• Impact: Single User or Endpoint connected to Microsoft Azure AD / Entra ID.
• Primary Cause: Expired or corrupted Primary Refresh Token (PRT) in the local Web Account Manager (WAM) broker.
• Rare/Security Cause: Mismatched ADAL-to-MSAL protocol policies or strict Conditional Access device compliance rules blocking token renewal.

Low Risk vs. High Risk Scenarios

• Low Risk: The loop is isolated to a single desktop client on an unmanaged network, while the Slack web client (slack.com) logs in successfully. Re-registering the work account or clearing broker credentials restores access immediately.
• Moderate Risk: The loop triggers across multiple users after an enterprise migration from ADAL to MSAL endpoints or following an OS update that resets WAM permissions.
• High Risk: The login loop is accompanied by Azure AD Conditional Access blocks (“Device Non-Compliant” or “Block Access”), locking the user out of all federated corporate applications beyond Slack.

What This Means

Modern authentication relies on background token brokers, such as Microsoft’s Web Account Manager (WAM) on Windows or Keychain on macOS, to pass security clearances between Slack and your company’s identity provider (like Azure AD / Entra ID). Instead of making you type your password every hour, the broker hands Slack a cryptographic pass called a Primary Refresh Token (PRT).

Think of this process like a security gate with an automated badge scanner. The broker scans your device’s security badge (the PRT) and gives Slack an entry ticket. If the badge scanner upgrades its protocol (from older ADAL to newer MSAL) but your local badge still carries old encoding, the scanner accepts the badge for a second, realizes the code format is wrong, and spits you back to the credential line. The gate keeps opening and closing, trapping you in a continuous sign-in loop.

Logic Escalators

• Transitioning from On-Premises AD to Hybrid / Entra ID: Mismatched domain join states causing authentication brokers to request credentials for the wrong identity authority.
• Strict Conditional Access Policies: Policies enforcing “Require Approved Client App” or “Require Marked as Compliant Device” when device trust tokens are expired.
• Disabling WAM via Registry Policies: Group policy keys forcing legacy ADAL workflows (EnableADAL = 0 or DisableWAM = 1) on updated OS builds.

What To Do Right Now

1. Clear Microsoft Identity Credentials:
   • Open Windows Credential Manager (search in Start menu).
   • Select Windows Credentials.
   • Locate and remove any entries starting with MicrosoftAccount:user=, adal, or Identity.
2. Disconnect and Reconnect Work Account:
   • Go to Settings > Accounts > Access work or school.
   • Select your organization’s account and click Disconnect.
   • Click Connect and re-enter your corporate credentials to fetch a fresh Primary Refresh Token.
3. Reset Slack Application Data:
   • Open Slack, press Ctrl + Shift + S (or navigate via menu bar if reachable), or use How to Clear Slack Desktop Cache (The Deep Clean Method) to wipe stale local OAuth states.
4. Force Browser-Based Modern Auth:
   • Ensure Microsoft Edge or Google Chrome is set as your default browser.
   • On the Slack sign-in screen, click Sign in in browser to allow MSAL tokens to pass through a full browser context rather than an embedded webview.

Immediate Intervention Flags

• Azure AD Sign-in Logs display Error 50199 (CMS_TOKEN_NOT_FOUND) or Error 50005 (Device Not Compliant).
• Continuous credential prompts appear across Outlook, Teams, and Slack simultaneously.
• The system displays a hardware-level Trusted Platform Module (TPM) error (0x80090016 – Keyset does not exist) during sign-in attempts.

Operations Summary

A Slack “Modern Auth” prompt loop is a local token broker conflict occurring when MSAL cannot validate device registration tokens against Azure AD / Entra ID. Clearing stale credentials from Windows Credential Manager and re-binding the corporate work account refreshes the Primary Refresh Token and breaks the loop. If the problem persists across account resets, system administrators must inspect device compliance states in Entra ID and remove deprecated ADAL registry overrides.