Windows 11 VM on Parallels has broken virtual TPM.

Same behaviour on an Entra joined W11 on ARM VM running on MacBook Air M3 and Parallels Desktop Standard 26.4.0.
After the July update, the first thing I noticed was that there was a problem with the PIN service, I had to enter my password instead.
Then BitLocker started to pop upon each device start. Then the TPM/vTPM rabbithole begun.
I deleted the VM, made a new one, also fails, removed/recreated the chip in VM settings, deleted in Keychain. Nothing.
 
Looks like there might be a fix.
Parallels Desktop for Mac 26.4.1 Release Notes
Parallels Desktop for Mac 26.4 (57516) update addresses the overall stability and security issues and includes the following additions and improvements:

Windows virtual machines
  • Fixed: Issues with Microsoft account sign-in, Windows Hello, and Intune enrollment after installing update KB5101650 on Windows virtual machines.
 
Our problem was that the VPN client we use inside our Windows 11 VM to connect to our customer's network stopped working due to this error. As a workaround, we installed the Azure VPN Client outside the VM, in my case, directly on the MacBook host, and connected from there instead. Then in Parallels Control Center, under the VM's network configuration, we switched to "Shared Network." After starting the VM, everything worked again, traffic from the VM was routed through the host's active VPN tunnel. We'll keep using this workaround until there's an official fix. Not the ideal solution, but at least we're back to work.

Hope this helps someone else stuck on this!
 
I just caught this by chance and was coming here to say the same. Has anyone tried it and verified that our issues our solved if we allow the update? Or do I need to be the experimentee.
 
I just caught this by chance and was coming here to say the same. Has anyone tried it and verified that our issues our solved if we allow the update? Or do I need to be the experimentee.
haha... experiment I guess. I have not allowed MS updates yet but did update Parallels and the toolkit.
 
I just caught this by chance and was coming here to say the same. Has anyone tried it and verified that our issues our solved if we allow the update? Or do I need to be the experimentee.
I've installed it and was able to enable Windows Hello (PIN and facial recognition). The PowerShell cmdlet "Get-TPM" still gives an error, and my next set of tests will cover the non-login auth prompts for other services configured to validate/authenticate with Windows Hello.
 
Can confirm 26.4.1 fixed the issue for me. I had rolled back the KB5101650 update a while back to keep my Windows Hell functionality. I installed the 26.4.1 update, then installed the KB5101650 update. I was able to use my Windows Hello pin again even after the KB5101650 update was installed.
 
I installed the parallels update and noticed a much more encouraging event about the TPM and certs. Just now installed the KB5101650 update. Been up for 38 minutes without issue. Seems solved!!!
 
The only thing I still notice is this:

Get-Tpm : A specified output buffer is too small. (Exception from HRESULT: 0x80284005)
At line:1 char:1
+ Get-Tpm | Format-List *
+ ~~~~~~~
+ CategoryInfo : NotSpecified: (:) [Get-Tpm], TpmWmiException
+ FullyQualifiedErrorId : Microsoft.Tpm.Commands.TpmWmiException,Microsoft.Tpm.Commands.GetTpmCommand
 
Was good for about 3h then decided to install kb5101684. Looks to be a problem as TPM throws non-recoverable errors after I installed the preview. Uninstalling.
 
Parallels 26.4.1 appears to work for me (thus far) - even with a manual ViveTool to enable feature id:62861611.
I can recreate the exception on Get-Tpm in powershell but otherwise things appear to functioning normally. Will see how things run for the next few days. I had KB5101684 installed in the VM before I updated Parallels.
 
Hello Everyone,
Please note that Parallels Desktop 26.4.1 release is known to fix the following issues:
1. Microsoft account sign-in, Windows Hello, and Intune enrollment after installing update KB5101650 on Windows virtual machines.
2. BitLocker fails to initialize TPM in Windows 11 VM.
Download link of Parallels Desktop 26.4.1: https://download.parallels.com/desktop/v26/26.4.1-57516/ParallelsDesktop-26.4.1-57516.dmg
Parallels Desktop 26 Release Notes: https://kb.parallels.com/en/131014
The issue regarding Get-Tpm : A specified output buffer is too small. (Exception from HRESULT: 0x80284005) is still being investigated by our Dev Team.
Thank you!
 
Looks like there might be a fix.
Parallels Desktop for Mac 26.4.1 Release Notes
Parallels Desktop for Mac 26.4 (57516) update addresses the overall stability and security issues and includes the following additions and improvements:

Windows virtual machines
  • Fixed: Issues with Microsoft account sign-in, Windows Hello, and Intune enrollment after installing update KB5101650 on Windows virtual machines.
This new Parallels Desktop worked for me! After upgrading Parallels Desktop, my Windows 11 virtual machine successfully and completely logged into my company's resources.
 
Everything has been running fine for me on Parallels. Turned on my Mac 5 hours ago and ever since been trying to fix the attached error. I can no longer sign into my Work Office365 account on any MS Office product within the Parallels machine, nor can I login to my Work account on Windows. After running this issue for hours through Claude trying various things such as clearing cache, removing updates etc. - nothing works. I've deleted and re-added the TPM within Parallels, which made no difference. Is this the same issue mentioned in this thread that is still not resolved by Parallels? I'm running the latest Mac OS, Windows OS and Parallels. Thanks


Resolved (for me) — sharing what worked in case it helps others

Setup:
Windows 11 VM on Parallels Desktop, Apple Silicon Mac, latest Parallels/macOS/Windows at the time. Mac crashed unexpectedly; afterward couldn't sign into my work M365 account (Entra ID/Azure AD) in Outlook, Word, or via Windows Settings → Access work or school accounts. Errors seen: generic [7ita9] in Office apps, and Error Code: -2147467261 ("Invalid pointer Parameter 1 is null or undefined") when adding the account in Windows Settings.

What ruled out:

  • Not the vTPM emulator bug (for my case): I did hit the same Get-Tpm failure people report here (0x80284005, TBS_E_INSUFFICIENT_BUFFER), but completely removing the TPM Chip device in Parallels' VM hardware settings made zero difference to the sign-in error — same failure either way.
  • Not the account itself: the account signed in fine via a plain browser (portal.office.com), and a different work account on the same VM signed in to Word without issue.
  • Not a corrupted device quota (though worth checking!): I found 11 stale/duplicate device objects for my machine in Entra admin center → Devices → Deleted devices (from repeated failed join attempts), permanently deleted them — helped narrow things down but wasn't the final fix on its own.
  • Not general system file corruption: sfc /scannow did find and repair corrupted files, but they turned out to be unrelated Bluetooth driver files (BthA2dp.sys, BthHfEnum.sys, bthmodem.sys) — a red herring.
What actually fixed it:
Windows Event Viewer (Microsoft-Windows-AAD/Operational log) consistently showed the failure crashing inside AddAccountTransaction::OnSavePRTRollback (0x80004003, E_POINTER) regardless of what triggered it (NGC keyset errors, session key failures, etc.) — pointing at the local broker's own state being corrupted, not the underlying cause each time.

I cleared the local app data for the AAD broker package:

C:\Users\<yourusername>\AppData\Local\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\

(deleted contents of all subfolders — LocalState in particular had a modified timestamp matching exactly when the problems started, which is a good sign to check for anyone else trying this).

Rebooted once before deleting (files were locked by "System" while a session was active) and once after deleting (to let the separate system TokenBroker service reinitialize clean). Signed in successfully after that.

Caveat: I also happened to disable Teams and OneDrive from launching at startup around the same time, so I can't rule that out as a contributing factor with 100% certainty. But given the event log evidence pointed specifically at the broker's local state, I'd bet on the folder clear + reboot being the actual fix.
 

Attachments

  • 1787060464239.png
    1787060464239.png
    74.8 KB · Views: 3
  • Screenshot 2026-08-18 144943.png
    Screenshot 2026-08-18 144943.png
    62 KB · Views: 2
Last edited:
Back
Top