How to Resolve Outlook 365 “Credential Loop”

If Microsoft Outlook continuously prompts you for your password—flashing the login dialog, accepting your credentials, and then immediately asking for them again—you are dealing with an Outlook 365 “credential loop.” The bottom status bar typically flickers between “Need Password,” “Trying to connect,” and “Disconnected.”

Quick Answer

An Outlook 365 credential loop is almost always caused by stale tokens in Windows Credential Manager, corrupted Web Account Manager (WAM) identity caches, or modern authentication (OAuth2) negotiation failures. Clear all cached Microsoft/Office credentials from the Windows Credential Manager and run the Microsoft 365 sign-in troubleshooter (or re-authenticate via Edge) to reset the token broker.

---

What the Signal Means

When Outlook connects to Microsoft 365 (or an integrated Google Workspace/IMAP account), it does not store your raw password in plain text. Instead, it completes a Modern Authentication (OAuth 2.0) flow. Once validated, your local system receives a cryptographic refresh token managed by Windows Web Account Manager (brokerplugin.exe).

A “credential loop” occurs when the local identity broker sends an expired, malformed, or revoked authorization token to the endpoint, but Outlook’s local cache insists the token is still valid. The server rejects the handshake, Outlook falls back to asking for user input, and the loop repeats because the client cannot write over the broken local identity state.

---

Technical Causes

Outlook Credential Loop
│
├── Did you recently change your password?
│   ├── YES ──► Stale tokens in Windows Credential Manager.
│   └── NO  ──► Modern Auth / WAM broker corruption or account status conflict.
│
├── Is your device domain-joined or hybrid Azure AD / Entra joined?
│   ├── YES ──► "Work or School account" token collision in Windows Settings.
│   └── NO  ──► Office Credential cache corruption or conflicting registry keys.

1. Stale Windows Credential Manager Entries: When a password changes, old identity payloads remain stored under generic credentials, overriding newly typed input.
2. Web Account Manager (WAM) Broker Failures: If Windows 10/11 system components responsible for Entra ID (formerly Azure AD) authentication fail to complete the handoff, the prompt window disappears without saving session tokens.
3. Work or School Account Identity Conflict: Multiple profiles linked in Windows Settings under “Access work or school” can cause modern auth tokens to cross-authenticate against the wrong tenant directory.
4. Conditional Access and MFA Challenges: A corporate policy requiring continuous device compliance, a Trusted Platform Module (TPM) hardware attestation failure, or a silent MFA rejection will cause the login box to refresh endlessly.

---

Progressive Diagnostic Steps

Step 1: Clear Windows Credential Manager

Before touching system files, flush all cached tokens:

1. Close Outlook completely (verify in Task Manager that OUTLOOK.EXE is terminated).
2. Press the Windows Key, type Credential Manager, and press Enter.
3. Select Windows Credentials.
4. Scroll to Generic Credentials.
5. Look for any entries containing:
   • MicrosoftOffice16_Data...
   • MS.Outlook...
   • adalcache...
   • OneDrive Cached Credential...
6. Click the drop-down arrow next to each matching entry and select Remove.
7. Restart your computer, launch Outlook, and submit your credentials once.

---

Step 2: Disconnect and Reconnect “Access Work or School”

If Step 1 fails, the primary Windows account token manager is likely desynchronized from Entra ID:

1. Open Windows Settings (Win + I).
2. Go to Accounts > Access work or school.
3. Locate the corporate account tied to Outlook.
4. Click Disconnect (Note: If this device is purely corporate-owned and domain-joined, do not disconnect without IT approval; proceed to Step 3 instead).
5. Open Outlook. The native Modern Auth prompt will appear.
6. Enter your credentials, complete your MFA challenge, and when the prompt asks “Allow my organization to manage my device”, check the box and select OK.

---

Step 3: Repair the Web Account Manager (WAM) via PowerShell

If the authentication dialog flashes and vanishes instantly, the WAM broker package requires a registration refresh:

1. Right-click the Windows Start menu and select PowerShell (Admin) or Terminal (Admin).
2. Run the following command to re-register the Microsoft.AAD.BrokerPlugin package:

if (-not (Get-AppxPackage Microsoft.AAD.BrokerPlugin)) { Add-AppxPackage -Register "$env:windir\SystemApps\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Appxmanifest.xml" -DisableDevelopmentMode -ForceApplicationShutdown } else { Get-AppxPackage Microsoft.AAD.BrokerPlugin | Reset-AppxPackage }

1. Restart the workstation and launch Outlook.

---

Step 4: Rule Out TPM (Trusted Platform Module) Lockups

If your device utilizes a hardware TPM chip to seal OAuth credentials, TPM state errors (such as error 80090016 or 80090030) will trap Outlook in a loop.

To test this:

1. Navigate to:%localappdata%\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\AC\TokenBroker\Accounts
2. Rename this folder to Accounts.old.
3. If Outlook connects cleanly afterward, the issue was an unreadable local security envelope on the disk.

If you are using Outlook with a Google Workspace backend rather than native Exchange, token loops often happen because the profile was set up without standard Modern Auth. In that case, review your settings with How to Reset Gmail “OAuth2” Token (Outlook).