Low severityauthentication
Power BI Error:
AADSTS130005
What does this error mean?
Windows Hello for Business / NGC key signature verification failed during Microsoft Entra ID (Azure AD) sign-in.
Common causes
- 1Corrupted or rotated NGC key on the local device after a Windows Hello PIN/biometric reset
- 2Device registration state in Microsoft Entra ID (Azure AD) is stale or out of sync with the local TPM-backed key
- 3TPM was cleared, reset, or replaced without re-registering Windows Hello for Business
- 4User profile corruption preventing access to the NGC container under %LOCALAPPDATA%\Microsoft\Ngc
- 5Conditional Access or device compliance policy invalidated the device's primary refresh token (PRT)
How to fix it
- 1Sign out and sign back in with username + password (skip Windows Hello) to confirm the account itself works — this isolates the problem to the NGC/Hello key.
- 2Re-provision Windows Hello for Business: Settings → Accounts → Sign-in options → PIN (Windows Hello) → Remove, then add it back. This regenerates the NGC key pair and re-registers it with Entra ID.
- 3Run `dsregcmd /status` in an elevated prompt and verify AzureAdJoined=YES, DeviceAuthStatus=SUCCESS, and NgcSet=YES. If NgcSet=NO or KeySignTest fails, the local key is broken.
- 4If re-provisioning fails, leave and rejoin Microsoft Entra ID: `dsregcmd /leave` (as admin), reboot, then re-join via Settings → Accounts → Access work or school.
- 5For persistent failures across multiple users on the same device, clear the TPM (tpm.msc → Clear TPM) and re-register — last resort, requires BitLocker recovery key.