#primary-refresh-token 1 post tagged primary-refresh-token. Inside the Primary Refresh Token: The Cryptographic Seam Between Windows Logon and Microsoft Entra ID May 11, 2026 How one TPM-bound JWT issued at first sign-in bridges Windows logon and Microsoft Entra ID -- and how Pass-the-PRT taught Microsoft to bind the derivation to the message.