Microsoft 365 Sign-in Error Codes and Fixes (2026): 1001, CAA50021, 135011, 0xCAA70004 and More

Quick answer: Most Microsoft 365 sign-in errors (Outlook, Teams, Word, Excel) come from one of five causes: a broken Windows sign-in component (WAM / AAD Broker Plugin), old cached credentials, a network, proxy or wrong date/time problem, a device problem in Microsoft Entra ID (disabled, not registered or not compliant), or a company policy such as MFA or Conditional Access.

Try this first: restart the PC, check that the date and time are correct, sign out of Office and sign in again, then run the Microsoft 365 sign-in troubleshooter in the Get Help app. If the error still appears, find your error code in the table below and follow its fix.

Last updated: 29 October 2026. Every fix is based on official Microsoft documentation (see sources). Written by a working IT engineer who fixes these errors on real user PCs.

"Something went wrong." "We couldn't sign you in." "Your organization has disabled this device." If you work in IT support or simply use Microsoft 365 at office, you have seen these messages. The worst part is that the message rarely tells you what to do. It only shows a code like 1001, CAA50021 or 0xCAA70004.

In this guide I have collected the Microsoft 365 error codes that users search for and that helpdesks see most often, explained what each one really means in simple language, and given step-by-step fixes. Each section says clearly what a normal user can do and what only an IT admin can fix.

Table of contents

1. All error codes at a glance
2. 5 fixes that solve most sign-in errors
3. Error 1001: "Something went wrong [1001]"
4. Error CAA50021: "Number of retry attempts exceeds expectation"
5. Error 135011: "Your organization has disabled this device"
6. Error 0xCAA70004 / 0xCAA70007: server or proxy not found
7. Error 0xCAA82EE2 / 0xCAA82EE7: request timed out
8. Error 0xCAA20003 / 0xCAA20004: authorization problem
9. Error 0xCAA90018: wrong credentials
10. Activation error 0x80070005
11. Outlook "Need Password" with no error code
12. AADSTS errors: 50076, 50126, 50053, 50055, 53000, 53003
13. Last resort: fully reset Microsoft 365 sign-in and activation
14. For IT admins: how to find the real cause in 2 minutes
15. FAQ
16. Sources

All error codes at a glance

Error code	What it means	Main cause	Who can fix it
1001	Something went wrong signing in to desktop apps	Broken WAM plug-in, security software, roaming profile	User + IT
CAA50021	Number of retry attempts exceeds expectation	Device registration with Microsoft Entra ID failing	Mostly IT
135011	Your organization has disabled this device	Device disabled or deleted in Microsoft Entra ID	IT admin
0xCAA70004 / 0xCAA70007	Server or proxy not found / download interrupted	Proxy, firewall, network inspection tool	User + IT
0xCAA82EE2 / 0xCAA82EE7	Request timed out / server name not resolved	No internet, DNS or firewall	User + IT
0xCAA20003 / 0xCAA20004	Authorization problem / approval needed	Wrong date and time; Conditional Access	User / IT
0xCAA90018	Wrong credentials	Windows account differs from Microsoft 365 account	User
0x80070005	Activation failed (access denied)	Blocked broker process, corrupted tokens	User + IT
AADSTS50076	MFA required	Admin policy or new location	User
AADSTS50126	Invalid username or password	Typing mistake, old password	User
AADSTS50053	Account locked	Too many wrong attempts	Wait / IT
AADSTS50055	Password expired	Password policy	User
AADSTS53000	Device not compliant	Conditional Access needs an Intune-compliant device	User + IT
AADSTS53003	Blocked by Conditional Access	Company access policy	IT admin

5 fixes that solve most sign-in errors

Before you go deep into a specific code, try these five steps in order. In my experience they fix the majority of Microsoft 365 sign-in tickets.

1. Restart the PC. Microsoft's own guidance for error 1001 says a reboot often helps, because it restarts the Windows sign-in broker.
2. Check the date, time and time zone. Go to Settings > Time & language > Date & time and turn on Set time automatically. A wrong clock breaks secure (HTTPS) sign-in and causes errors like 0xCAA20003.
3. Sign out and sign in again in Office. Open Word or Excel, go to File > Account > Sign out, close all Office apps (including Teams and Outlook), then open them and sign in again.
4. Remove old saved passwords. Open Control Panel > Credential Manager > Windows Credentials and remove entries that start with MicrosoftOffice16. Restart and sign in again.
5. Run the Microsoft 365 sign-in troubleshooter. Open the Get Help app in Windows and search for "Microsoft 365 sign-in troubleshooter". It checks and fixes many common sign-in problems automatically.

Still stuck? Find your exact code below.

Error 1001: "Something went wrong [1001]"

Where you see it: when signing in to Outlook, Teams, Word, Excel or OneDrive on Windows.

What it means: the Windows component that handles work account sign-in, called Web Account Manager (WAM) or the AAD Broker Plugin, is broken or blocked. Microsoft lists two main causes:

• Security software (antivirus, endpoint protection or network filter drivers) blocks or damages the WAM plug-in.
• User profile tools that copy (roam) sign-in data between PCs, common on VDI and shared computers, leave it in a bad state.

How to fix error 1001

1. Restart the PC and try again.
2. Re-register the sign-in plug-ins. Open Windows PowerShell as the affected user (normal, not as another admin account) and run:

   Add-AppxPackage -Register "$env:windir\SystemApps\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Appxmanifest.xml" -DisableDevelopmentMode -ForceApplicationShutdown
   Add-AppxPackage -Register "$env:windir\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\Appxmanifest.xml" -DisableDevelopmentMode -ForceApplicationShutdown

   The first command fixes work or school accounts, the second fixes personal Microsoft accounts.
3. Update Office. In any Office app go to File > Account > Update Options > Update Now. Microsoft shipped fixes for some 1001 cases in Office Version 2310 (Current Channel) and later.
4. Use the web version meanwhile: Outlook on the web and Office for the web keep working while you fix the desktop app.

For IT admins

• Ask your antivirus/EDR vendor to exclude the WAM packages and folders listed by Microsoft, especially %localappdata%\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy, %localappdata%\Microsoft\TokenBroker, %localappdata%\Microsoft\OneAuth and %localappdata%\Microsoft\IdentityCache.
• Make sure profile tools (FSLogix, roaming profiles, migration tools) do not roam the TokenBroker, AAD Broker Plugin folders and the HKCU\SOFTWARE\Microsoft\IdentityCRL registry key. Microsoft does not support roaming this data.
• Check Event Viewer > Windows Logs > Application for AppModel-State errors starting with -2147 that mention Microsoft.AAD.BrokerPlugin. They confirm the plug-in is damaged.
• Microsoft does not recommend disabling WAM or ADAL as a fix.

Error CAA50021: "Number of retry attempts exceeds expectation"

Where you see it: usually in Teams or Outlook, often after the message "Hold on while we register this device with your company".

What it means: Windows tried to register the device with your company's Microsoft Entra ID (formerly Azure AD) several times and gave up. The problem is almost always the device registration, not your password.

What a user can try

1. Restart the PC and make sure the date and time are correct.
2. Connect to a normal network (office network or home Wi-Fi). Disconnect any VPN or proxy for a moment and try again.
3. Run the PowerShell commands from the error 1001 section to repair the sign-in plug-ins.
4. Remove MicrosoftOffice16 credentials from Credential Manager, restart and sign in again.
5. Install pending Windows and Office updates.

What an IT admin should check

1. Run dsregcmd /status on the device and check AzureAdJoined, DomainJoined, WorkplaceJoined and the Diagnostic Data section for the registration error.
2. In the Microsoft Entra admin center > Devices > All devices, look for the device. Check whether it is disabled, duplicated or stale, and whether users are allowed to register devices.
3. Check that the user has a Microsoft 365 licence and that Conditional Access policies are not blocking registration.
4. For hybrid joined devices only, re-register the device: run dsregcmd /leave as administrator, restart, then in Task Scheduler > Microsoft > Windows > Workplace Join run the Automatic-Device-Join task. Do not run dsregcmd /leave on cloud-only (Entra joined) laptops unless you know how to rejoin them, or the user can lose access.

Error 135011: "Your organization has disabled this device"

Where you see it: when activating Microsoft 365 Apps or signing in to Teams or Outlook.

What it means: the device object for this PC has been disabled or deleted in Microsoft Entra ID, and it was not done from the device itself. This often happens when IT cleans up "old" devices, or after a PC is reset or reimaged.

How to fix error 135011

• User: you cannot fix this yourself. Send your IT admin the error code 135011 and your PC name (press Windows + Pause or check Settings > System > About).
• Admin, if the device was disabled: open the Microsoft Entra admin center > Devices > All devices, search for the device or user, select it and choose Enable.
• Admin, if the device was deleted: the device must be registered again. For a registered (BYOD) device, the user can go to Settings > Accounts > Access work or school, disconnect the work account, restart and connect it again. For joined devices, rejoin them as per your normal process (for example Autopilot or hybrid join).

Error 0xCAA70004 / 0xCAA70007: server or proxy not found

What it means: 0xCAA70004 means the sign-in server or proxy could not be found; 0xCAA70007 means the download was interrupted. Both point to the network path between the PC and Microsoft.

How to fix it

1. Check that the internet works in a browser (open https://login.microsoftonline.com).
2. Turn off any VPN for a moment and try again. Try a mobile hotspot to see if your office network is the problem.
3. If you use tools that inspect HTTPS traffic (for example Fiddler or some security proxies), close them or configure them correctly. Microsoft specifically mentions these.
4. IT admin: check proxy settings and make sure the Microsoft 365 sign-in endpoints are allowed and not SSL-inspected. Microsoft publishes the full list on its "Microsoft 365 URLs and IP address ranges" page.

Error 0xCAA82EE2 / 0xCAA82EE7: request timed out

What it means: 0xCAA82EE2 means the request timed out, and 0xCAA82EE7 means the server name could not be resolved (a DNS problem). Both are connectivity errors, common in Teams.

How to fix it

1. Confirm you have internet access and that other websites load.
2. Restart the router or switch to another network to rule out local DNS problems.
3. Open Command Prompt and run ipconfig /flushdns, then try again.
4. IT admin: check firewall and proxy rules and DNS for the Microsoft 365 endpoints. For Teams, Microsoft also recommends its network assessment tool to test the path to Microsoft's network.

Error 0xCAA20003 / 0xCAA20004: authorization problem

0xCAA20003 (authorization problem): Microsoft says to check that the date and time on the PC are correct. A wrong clock makes secure HTTPS connections fail. Turn on automatic time and time zone in Windows settings, restart and sign in again.

0xCAA20004 (request needs approval): this one is linked to your company's Conditional Access or Microsoft Entra ID policies. A user cannot fix it alone. Ask your IT admin to check the sign-in logs and the policies that apply to your account and app.

Error 0xCAA90018: wrong credentials

What it means: Windows is trying to sign you in to Microsoft 365 with your Windows login, but your Microsoft 365 account is different (for example you log in to Windows with a local account or a different email).

Fix: sign out of the Office app, then sign in again and type your work email and password manually. If the error keeps coming back, remove MicrosoftOffice16 entries from Credential Manager and check Settings > Accounts > Access work or school for an old or wrong account to disconnect.

Activation error 0x80070005

What it means: "access denied" during Microsoft 365 activation. Usually a security tool, proxy or VPN blocks the broker process, or the activation tokens are corrupted.

How to fix error 0x80070005 (Microsoft's steps)

1. Update Windows and restart.
2. Remove Office credentials: delete MicrosoftOffice16 entries in Credential Manager. In Settings > Accounts > Access work or school, disconnect any account that is different from the one you use for Office. Restart.
3. Temporarily disable antivirus, proxy, firewall or VPN (with your admin's permission) and try activation again.
4. If it still fails, delete the contents of these two folders, restart and run the sign-in troubleshooter:

   %LOCALAPPDATA%\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\AC\TokenBroker\Accounts
   %LOCALAPPDATA%\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AC\TokenBroker\Accounts

5. Rename tokens.dat (admin Command Prompt):

   net stop sppsvc
   ren %SystemDrive%\Windows\System32\spp\store\2.0\tokens.dat tokens.old
   net start sppsvc

   Then run an Online Repair of Office (Settings > Apps > Installed apps > Microsoft 365 > Modify > Online Repair) and restart.
6. As a final test, create a new local administrator account, sign in with it and try activating. If it works there, the problem is in the old user profile.

Outlook "Need Password" with no error code

Outlook shows Need Password in the status bar, or Word and Excel silently fail to sign in, but no error code appears. Microsoft explains that this happens when the sign-in package information for the work account (or the personal account) is missing in Windows.

Fix: first run the Microsoft 365 sign-in troubleshooter. If that does not help, open PowerShell as administrator and run the command for your account type:

# Work or school account
if (-not (Get-AppxPackage Microsoft.AAD.BrokerPlugin)) { Add-AppxPackage -Register "$env:windir\SystemApps\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Appxmanifest.xml" -DisableDevelopmentMode -ForceApplicationShutdown } Get-AppxPackage Microsoft.AAD.BrokerPlugin

# Personal account (outlook.com / hotmail.com)
if (-not (Get-AppxPackage Microsoft.Windows.CloudExperienceHost)) { Add-AppxPackage -Register "$env:windir\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\Appxmanifest.xml" -DisableDevelopmentMode -ForceApplicationShutdown } Get-AppxPackage Microsoft.Windows.CloudExperienceHost

Restart Outlook and sign in when prompted.

AADSTS errors: 50076, 50126, 50053, 50055, 53000, 53003

Errors that start with AADSTS come from the Microsoft Entra ID sign-in service itself, usually in the browser sign-in window. These are the ones users hit most:

Code	Meaning (Microsoft)	Fix
AADSTS50076	Multi-factor authentication is required because of an admin policy or because you moved to a new location.	Complete the MFA prompt (Authenticator app, SMS or call). If no prompt appears, sign out completely, clear browser cookies and try again.
AADSTS50079	You must register for MFA.	Go to https://aka.ms/mysecurityinfo and add the Authenticator app or phone number.
AADSTS50126	Invalid username or password.	Check Caps Lock, keyboard language and the full email address. If you changed the password recently, use the new one everywhere.
AADSTS50053	Account locked after too many wrong attempts, or sign-in from a risky IP address.	Wait some time before retrying, and stop old devices (phone mail app) that keep trying the old password. If it continues, contact IT.
AADSTS50055	Password expired.	Reset it when prompted, or ask IT to reset it.
AADSTS50057	User account is disabled.	Only IT can re-enable the account.
AADSTS50173	The saved sign-in has expired, often after a password change.	Sign out and sign in again with the new password.
AADSTS53000	Conditional Access requires a compliant device and this device isn't compliant.	Enroll the device in your company's MDM (for example Intune Company Portal) and fix the items it reports, then try again.
AADSTS53003	Access blocked by Conditional Access policies.	IT admin must check which policy blocked the sign-in. See our full Teams error 53003 / AADSTS53003 fix guide.

Tip: for the latest official wording of any AADSTS code, open https://login.microsoftonline.com/error and enter the number.

Last resort: fully reset Microsoft 365 sign-in and activation

If nothing above works, reset the activation state completely. Microsoft's supported options are:

1. Easiest: run the Microsoft 365 activation troubleshooter from the Get Help app on the affected PC.
2. Scripted (IT): Microsoft provides OLicenseCleanup.vbs (clears licences and cached accounts) and signoutofwamaccounts.ps1 (signs out WAM accounts). Run them elevated, then restart and sign in again.
3. Manual (IT, back up the registry first): close all Office apps, delete %localappdata%\Microsoft\Office\Licenses, delete the registry keys HKCU\Software\Microsoft\Office\16.0\Common\Licensing and HKCU\Software\Microsoft\Office\16.0\Common\Identity, and remove Office entries from Credential Manager.

For IT admins: how to find the real cause in 2 minutes

1. Get the details from the user: a screenshot of the error, plus the correlation ID and timestamp shown under "More details".
2. Check the Entra sign-in logs: in the Microsoft Entra admin center > Monitoring & health > Sign-in logs, filter by user and time. The Failure reason and Conditional Access tabs usually show the exact cause.
3. Check the device: run dsregcmd /status on the PC and compare with the device record in Entra ID (enabled, compliant, joined type).
4. Check the PC side: Event Viewer > Applications and Services Logs > Microsoft > Windows > AAD > Operational shows WAM and token errors.
5. Escalate with logs: if you need Microsoft support, collect authentication logs (for example with the MSOAID tool) before opening a ticket in the Microsoft 365 admin center.

FAQ

What does "Something went wrong" mean in Microsoft 365?

It is a generic sign-in failure message. The important part is the code below it (for example 1001, CAA50021 or 0xCAA70004), which tells you the real cause. Use the table at the top of this article to match the code.

How do I fix Microsoft 365 error 1001?

Restart the PC, then re-register the AAD Broker Plugin and CloudExperienceHost packages with the two PowerShell commands in the 1001 section, and update Office. If security software keeps breaking it, IT must add exclusions.

Can I fix error 135011 myself?

No. Error 135011 means your device was disabled or deleted in your company's Microsoft Entra ID. Only an IT admin can re-enable it or help you register it again.

Is CAA50021 a password problem?

Usually not. CAA50021 means device registration with Microsoft Entra ID kept failing. Changing your password normally won't help; IT should check the device registration.

Why does Teams show 0xCAA82EE2?

0xCAA82EE2 means the sign-in request timed out, which is a network problem. Check the internet, try another network, flush DNS and ask IT to verify firewall and proxy rules for Microsoft 365.

Will reinstalling Office fix sign-in errors?

Rarely. Most sign-in errors are caused by Windows sign-in components, cached credentials or company policies, not by Office itself. Try the fixes in this guide first; reinstalling is a last resort.

Is it safe to run the PowerShell commands in this article?

Yes. The Add-AppxPackage -Register commands come from Microsoft's own documentation and only re-register built-in Windows sign-in components. Commands like dsregcmd /leave or registry deletions should be run only by IT admins.

What is the Microsoft 365 sign-in troubleshooter?

It is a free automated tool from Microsoft, available in the Get Help app on Windows, that detects and fixes common Microsoft 365 sign-in and activation problems.

Final words

Microsoft 365 error codes look scary, but they follow a pattern: broken sign-in plug-in, old credentials, network, device registration or policy. Start with the five quick fixes, match your code in the table, and send the correlation ID to IT when the fix is on their side. Bookmark this page; I will keep adding new codes as I see them in real tickets.

Related guides: Teams error 53003 fix, 25 Conditional Access policies every Entra tenant needs and Outlook not receiving emails? 10 fixes.

More help: browse our Microsoft 365 guides and Windows troubleshooting guides.

Sources

• Microsoft Support: Error "Something went wrong [1001]" signing in to Microsoft 365 desktop applications
• Microsoft Learn: Can't sign in to Microsoft 365 desktop applications (WAM plug-ins and security software)
• Microsoft Learn: Automatic authentication fails in Microsoft 365 apps (Need Password)
• Microsoft Support: Why am I having trouble signing in to Microsoft Teams? (0xCAA error codes)
• Microsoft Learn: Resolve Teams sign-in errors
• Microsoft Learn: Activation error 0x80070005
• Microsoft Learn: Reset the activation state of Microsoft 365 Apps
• Microsoft Q&A: Error code 135011 (device disabled or deleted in Entra ID)
• Microsoft Learn: Microsoft Entra authentication and authorization error codes (AADSTS)

Techyami is not affiliated with Microsoft. Steps that change device registration or the registry should be done by your IT administrator. Always follow your company's IT policy.