Google Chrome wants to access key "Microsoft Workplace Join Key" in your keychain

@santoroj Make sure the user is clicking "Always Allow" after entering their password. If they click Allow Chrome will prompt _every_ time it needs to access the certificate and that will happen often enough that it looks like the password was rejected.

@sdagley Thank you for the response and suggestion but unfortunately, it will not take any password, that is the issue here.  

@santoroj Do you mean that you can't type in the entry field for the password, or that it's not accepting the user's login password? If they are not clicking "Always Allow" it will look like the password wasn't accepted because the prompt is being repeated so quickly. If they _are_ clicking "Always Allow" and it's not accepting their login password you'll need to determine why the password for the user's login keychain doesn't match the password they use to log in and fix that.

@sdagley the user can enter the password, but it will not accept any password.  User has had the device for 2 weeks and only had 2 passwords, neither are working.  

To be absolutely clear, the user IS selecting "Always Allow" at that prompt?

If they are have them open the Keychain Access app (if they're running macOS Sonoma they may be offered the option to use System Settings instead, have them choose Keychain Access). In Keychain Access select the login keychain then My Certificates to verify the certificate can be accessed. If it's working there but not in Chrome I don't have any other suggestions for you. 

@sdagley Yes, always allow is the option being used.  They are on Sonoma, but because the password is not taking, there is no prompt to accept anything past entering the password and hitting "Always Allow". Thank you for your inputs, maybe someone else in the forum has been experiencing the issue.  

@santoroj My suggestion about opening Keychain Access isn't something you'd do after the password prompt in Chrome, just open the Keychain Access app. It will allow you to determine if the user's login keychain isn't being unlocked when the user logs in to the Mac because the login keychain password isn't in sync with the Mac's password.

@sdagley gotcha, let me check this, issue is that I am thinking when you hit the save changes button it will prompt for the password and still we will face the issue where it does not take the password for it, but still we will try. 

@santoroj did you ever find a resolution? I believe I am stuck in the same do-loop.

I have not yet found any solution

The workplace join key is their Azure password, not their Mac password. If the user is using the right password and still not able to authenticate, it's most likely a keychain issue. You can reset the keychain with a terminal command: sudo fdesetup authrestart

This does not affect any passwords already in the keychain, just resets the authentication protocol. This will prompt for username and password (mac password) and will reset the keychain authentication. Then I would try the workplace join password again. If that doesn't work, unenroll from Azure and reenroll the mac. Also worth checking that the Mac complies with any Azure compliance policies set for your org. 

Was this able to solve the problem?

I've had users report this same issue from time to time. The prompt just won't accept the password. We have Jamf Connect, so the computer password and the Azure/Entra password are the same. Sometimes a reboot fixes it, sometimes it doesn't. The only thing I've been able to come up with to get around it is to go in the Keychain and manually add the application on the "Access Control" tab of the WPJ key.

Try entering user mac logon password and click "Always Allow"

Sometimes it rejects it, despite being correct.

I don't know if people are still having this keychain issue but to solve this I usually do a couple of things. 1. Go to keychain access and look for the MS WOrkplace Join Key and change it to allow all.  I go back to Chrome and the certificate will pop up and then I have the user try their password and choose always allow. If that doesn't work I check the MS certificate to make sure it is trusted. If not trusted there are a couple of options you can delete the cert and a new cert will be downloaded. The method I use is to right click on the the red trust line and change it to always trust to resolve this issue. 

If the user is remote, have them connect to your corporate network (VPN) then type the password and choose *Always allow* 

That will authenticate successfully and stop the prompt from showing up again, at least for that access.