Primary Refresh Token (PRT)
A Primary Refresh Token is a Microsoft Entra credential used by operating-system sign-in components and authentication brokers to support single sign-on and acquire further tokens.
Why another work app can open without a new sign-in
A Primary Refresh Token helps supported Microsoft sign-in components obtain tokens for applications. The application does not send the PRT to an API such as Microsoft Graph. It sends an access token intended for that service.
On Entra joined and hybrid joined Windows devices, the CloudAP plugin acquires the PRT during organizational Windows sign-in. On Entra registered Windows devices, the Web Account Manager (WAM) plugin handles it when a work account is added. WAM also helps applications obtain their own tokens.
How it differs from an app’s refresh token
An application’s refresh token lets that client request more tokens. A PRT supports single sign-on through Microsoft’s broker components. The similar names do not make them interchangeable.
Microsoft supports PRTs for registered and unregistered devices. Finding one does not tell you that the device is registered, managed, or compliant. Conditional Access is not evaluated at PRT issuance; requests for resource tokens have their own policy evaluation.
The PRT itself is opaque: applications cannot decode it to inspect its claims. For troubleshooting, use the device state and sign-in records rather than treating it like a readable JWT.