The dsregcmd /status command is the primary diagnostic tool for verifying the device registration state with Microsoft Entra ID. The output of this command includes a section named "SSO State," which explicitly shows the AzureAdPrt status. A value of YES for AzureAdPrt confirms that a valid Primary Refresh Token is present on the device and is being used for single sign-on. This command provides the most direct and comprehensive information for validating the PRT.

klist tgt: This command lists Kerberos Ticket-Granting Tickets (TGTs), which are used for on-premises Active Directory authentication, not for validating the Microsoft Entra PRT. query session: This command displays information about active user sessions on a server, such as Remote Desktop Services sessions, and is unrelated to device identity tokens. sc.exe query state=all: This command is used to query the status of all system services running on Windows and has no function related to Microsoft Entra device state or tokens.

1. Microsoft Entra Documentation: "Troubleshooting devices by using the dsregcmd

command". This document details the usage of dsregcmd /status and explicitly states that

the "SSO State" section of its output provides the status of the Primary Refresh Token

(PRT).

URL: https://learn.microsoft.com/en-us/entra/identity/devices/troubleshoot-device-dsregcmd

2. Microsoft Entra Documentation: "What is a Primary Refresh Token?". This article explains

the PRT and notes that its existence and status can be verified using the dsregcmd /status

utility.

URL: https://learn.microsoft.com/en-us/entra/identity/devices/concept-primary-refresh-token