Skip to content

Primary Refresh Token (sign-in) · Post-join authentication (PRT) phase

Fix PRT error 0xC004844C (malformed UPN)

0xC004844C · AAD_CLOUDAP_E_OAUTH_USERNAME_IS_MALFORMED Checked against Microsoft Learn

Quick answer

0xC004844C means the CloudAP plug-in rejected the user's UPN because it isn't an internet-style sign-in name (RFC 822). On Microsoft Entra joined devices the UPN is what the user typed. On hybrid joined devices it comes from the domain controller. A non-routable on-premises suffix such as jdoe@contoso.local is a typical cause; Microsoft points to Alternate Login ID for that case.

Waitlist · launches Dec 1, 2026

The Autopilot + Device Prep Deployment Doctor

Checks your tenant, read-only, for the config that breaks ESP and Device Preparation, and tells you why a stuck device is stuck. Join the waitlist and we'll email you at launch.

Join the Kit 1 waitlist for the Autopilot + Device Prep Deployment Doctor

Check this first

Run whoami /upn on the device. Does it show a routable, internet-style UPN?

What 0xC004844C means

The user's UPN isn't in the expected internet-style format, so the device can't get a Primary Refresh Token.

Common causes

  • The UPN isn't in internet-style format (RFC 822).
  • On hybrid joined devices, the domain controller returns a UPN in the wrong format.
  • The on-premises domain suffix is non-routable (for example contoso.local).

How to fix 0xC004844C

  1. Find event 1144 in the Microsoft Entra analytics log (Applications and Services Logs > Microsoft > Windows > AAD) to see the UPN that was provided.
  2. On a hybrid joined device, run whoami /upn and check that the domain controller returns the configured UPN.
  3. If users have a non-routable suffix, give them a routable, verified UPN suffix, or configure Alternate Login ID as Microsoft documents.
  4. Sign out and back in (or lock and unlock), then check AzureAdPrt in dsregcmd /status.

Free PDF

Top 10 Intune and Autopilot Enrollment Errors: Causes and Fixes

A free cheat sheet covering ten enrollment errors, each with the symptom, the most likely cause, the fix, and a link to the full guide.

  • Ten real error codes and failures, including 0x80180014, 0x8018002b, 0x801c03f3, 0x800705b4, the ODJConnector logon failure, and the Win32 detection error 0x87d1041c.
  • Every cause and fix checked against Microsoft's own documentation.
  • A link from each entry to the full zakitpro.com article.

You get the free PDF. By subscribing you also agree to receive occasional emails from zakitpro about Intune and Autopilot troubleshooting. Emails are sent through MailerLite. You can unsubscribe anytime with the link in every email. See the privacy page for how your email is handled.

Related guides and tools

Other Primary Refresh Token (sign-in) codes

Sources

This page is a paraphrase of Microsoft's documentation. Check the source before you change production settings.