Copilot Sign-in Reports an Expired Kerberos Ticket: Domain PC Checks

Official documentation checked October 14, 2026.

A Kerberos error during Copilot sign-in on a domain PC needs to be traced to the authentication step that failed. It does not mean Copilot normally uses your computer’s Kerberos ticket to read Microsoft 365 content. Start with the full error code and corporate sign-in configuration, not a SYSTEM ticket purge or Windows work-account disconnect.

Distinguish Kerberos single sign-on from Copilot access

Kerberos can participate in Microsoft Entra Seamless SSO for a domain-joined computer. In that flow, a ticket for the AZUREADSSOACC account helps establish the user’s identity; Entra then evaluates sign-in and issues the application tokens. Microsoft describes this in the Seamless SSO technical flow. A Kerberos ticket and a cloud access token are not interchangeable.

In Microsoft’s Seamless SSO troubleshooting guide, error 81010 means the user’s Kerberos ticket is expired or invalid. Other codes identify different failures, such as ticket validation or user mismatch. Ask IT to confirm the code in the matching Entra sign-in record and whether this device actually uses Seamless SSO. Microsoft Entra joined or hybrid joined devices can use a different SSO path that takes precedence.

If an interactive Microsoft sign-in succeeds, continue through the legitimate MFA or other required checks and retest. Seamless SSO can fall back to ordinary sign-in. Conversely, a denied policy or missing feature entitlement is not repaired by renewing a domain ticket. Generic Copilot answers are also not proof of an expired Kerberos ticket.

Check your connection, session and tickets safely

1. Use the approved corporate connection. For a confirmed 81010 Seamless SSO failure, Microsoft directs users to sign in from a domain-joined device on the corporate network. If remote, ask IT whether your approved VPN supplies the needed domain connectivity; do not bypass the VPN or change proxy policy.
2. Save work and follow your normal domain sign-in procedure. If IT asks you to sign out of Windows, save unsynced documents first and confirm you can sign back in. Signing out ends the desktop session. Do not change your password again merely to “refresh” a previous password change.
3. Inspect the affected user’s tickets. In that user’s ordinary Command Prompt, run the read-only command below. Do not switch to another administrator’s session or specify a different logon ID just to inspect your own tickets.

klist

Record the ticket’s service, start and end times for IT, without publishing the output. Microsoft’s klist reference says the default query shows the current user’s cached tickets. It does not list OAuth access tokens or prove that Copilot has access to a mailbox. An absent ticket is a clue to investigate in the matching sign-in scenario, not permission to purge other sessions.

For a clock discrepancy, have IT inspect the managed time source. Domain-joined Windows computers normally follow a domain time hierarchy. An authorized administrator can use the read-only w32tm /query /status and w32tm /query /source checks described in the Windows Time documentation. Do not select an arbitrary public time server or repeatedly force resynchronization without checking the cause.

Limit ticket renewal and configuration changes to the confirmed cause

Microsoft includes a user ticket purge in its Seamless SSO diagnostic procedure, but it is not a harmless universal Copilot reset. klist purge removes cached tickets from the selected session and can interrupt access to other resources. Use it only when IT has confirmed the scenario, saved work is protected and the user can authenticate again on the approved network.

Do not run a SYSTEM-session purge, detach the Windows work or school account, or remove the device from its domain or Entra registration to fix this symptom. Those operations have a much broader scope than renewing a user’s sign-in. Do not lengthen domain ticket lifetimes or weaken Conditional Access merely to stop prompts.

If the issue returns, the identity team should investigate the exact SSO error, device/account match, domain connectivity, time synchronization and relevant domain-controller events. Recent encryption or SSO configuration changes belong in that investigation, with Microsoft’s current guidance, rather than an assumption that every ticket has simply timed out.

Retest the original Copilot operation after the identity issue is resolved. If sign-in now works but work content is unavailable, investigate that feature’s license and the user’s existing content permissions separately. Supply IT with the error code, timestamp, app name and the diagnostic comparison; never share passwords or authentication tokens.