Microsoft 365 sign-in loops triggered by Trusted Platform Module (TPM) Error 80090016 block users from accessing Outlook, Teams, and Word. This error occurs when the Windows Web Account Manager (WAM) fails to verify local identity keys against the physical security chip on your motherboard. When this link breaks, Office applications reject valid credentials and multi-factor authentication prompts, locking your desktop software out of cloud synchronization.
Fast-Fix: The 45-Second Solution
Local encryption token corruption or a TPM hardware signature mismatch poses a moderate risk. While server-side cloud data remains completely safe, local desktop apps are blocked. To resolve this, terminate all Microsoft 365 processes, open the local AppData folder, and rename the cached corporate identity folder to force a clean cryptographic handshake.
Diagnostic Snapshot
- Severity Tier: Moderate to High (Complete desktop app lockout)
- Data Safety Risk: Low (Cloud data remains intact; only local cached session tokens are damaged)
- Common Cause: Windows PIN or biometric modifications, physical motherboard replacements, or corrupt Web Account Manager (WAM) cache directories
- Admin Requirement: End-user access for basic folder resets; Local Administrator rights for device re-registration
Condition: Low Risk vs. High Risk
- Low Risk Scenario: The error surfaces on a single computer immediately following an overnight Windows Update patch or a routine corporate password change. Disconnecting and reconnecting the account through Windows Account Settings resolves the glitch within minutes.
- High Risk Scenario: The error persists across multiple reboots, manifests immediately after a physical hardware motherboard swap, or impacts an entire department simultaneously, pointing to a severe Microsoft Entra ID device trust breakdown.
The System Break (What This Means)
The TPM chip acts like a physical lockbox welded directly onto your computer’s motherboard. Your Microsoft 365 sign-in token is a secure key stored inside this lockbox. When you launch an Office application, the software asks the operating system to retrieve this key to verify your identity.
Error 80090016 indicates that the lockbox gears have jammed or the key has warped. Because the local security broker cannot read or decrypt the hardware-encrypted file, Windows halts the validation process to protect your corporate data, resulting in an unyielding sign-in loop.
Root Cause Probability
- Likely (60%): Corrupt WAM Package Cache. The local identity folder houses expired or corrupted token pointers that no longer match the TPM’s current cryptographic state.
- Possible (30%): Hardware Configuration Mismatch. A recent BIOS update, motherboard replacement, or a change in Windows Credential Guard altered the physical hardware signatures, invalidating existing security keys.
- Rare (10%): Tenant-Side Device Deletion. A cloud administrator disabled or removed the computer’s device object from the Microsoft Entra ID directory, invalidating the machine’s cloud clearance.
Conflict Escalators
Specific network setups and software environments trigger this error more frequently. Running an aggressive third-party VPN client or constantly switching between physical docking stations can interrupt the hardware handshake during boot-up. Additionally, enabling the “New Outlook” toggle or deploying pre-release Windows Insider builds often introduces instabilities into the Web Account Manager service, leading to frequent credential drops.
Progression: 1 Hour → 24 Hours → 1 Week
- 1 Hour: Outlook and Teams display a yellow warning banner. They stop receiving incoming data, though previously cached emails and chat logs remain readable.
- 24 Hours: Office applications enter a hard-lock phase. Every attempt to click “Fix Account” or re-enter your password throws the 80090016 error screen instantly.
- 1 Week: Modern authentication fails across all core Microsoft 365 programs. The user must rely exclusively on web browsers to complete daily tasks, and local offline document modifications cannot sync, which introduces the risk of data version conflicts.
Common Misdiagnoses
Error 80090016 is frequently confused with general server-side service blockages. Technicians often mistake it for Resolving “Something Went Wrong” Error 1001 in Outlook and Teams, which represents a generic network-level or service authentication drop rather than a local hardware-tied encryption issue. It is also distinct from “Your Organization Has Disabled This Device” (Error Code 135011), where the machine is explicitly blocked by a tenant administrator rather than experiencing a localized chip malfunction.
Immediate Action Steps
Step 1: Terminate Office Processes
Open the Windows Task Manager (Ctrl + Shift + Esc). Locate and end all active tasks for Outlook.exe, Teams.exe, and Microsoft.SharePoint.exe.
Step 2: Sever the Damaged Account Link
Open the Windows Start Menu and navigate to Settings > Accounts > Access work or school. Locate your corporate email address, click it, and select Disconnect.
[Settings] ➔ [Accounts] ➔ [Access work or school] ➔ [Select Account] ➔ [Disconnect]
Step 3: Purge the Identity Broker Cache
Press Win + R to open the Run dialog box. Paste the following path and press Enter:%localappdata%\Packages\
Locate the folder named exactly:Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy
Right-click the folder and rename it to Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy.old.
(Note: If Windows displays a file-in-use error, open the Services app, temporarily stop the “Credential Manager” service, and verify all Office background processes are dead.)
Step 4: Reconnect and Re-authenticate
Restart your machine. Return to Settings > Accounts > Access work or school. Click the Connect button, type your corporate credentials, and let the system register your device with the server. Open Outlook to verify the fix.
(If you require a broader method to sweep away all cached corporate credentials from the operating system, refer to How to Clear Office Credential Cache on Windows 11 (The Modern Way)).
Hard-Stop Red Flags
Cease local manual troubleshooting immediately if you encounter any of the following parameters:
- A “Device not found” or “The device has been deleted” message during the account connection phase, which indicates server-side deletion.
- A permanent yellow warning symbol or “Code 10” error in the Windows Device Manager under Security Devices, meaning the physical TPM 2.0 module has suffered a complete hardware failure.
What the IT Admin Will Check
If the problem persists past a local profile purge, a systems administrator must inspect the hardware identity from the cloud console:
- Entra ID Status Verification: Locate the specific device hostname in the Microsoft Entra admin center. Ensure its status is toggled to Enabled and that its listed Device ID matches the physical machine.
- MDM Compliance Audit: Verify if Microsoft Intune or conditional access parameters are rejecting the computer due to an outdated motherboard BIOS version or an unprovisioned hardware module.
Resolution Complexity
- User-Level Remediation: 15 minutes (Renaming the corrupt WAM folder and logging back into the account).
- Admin Escalation: 45 minutes (Clearing the physical TPM keys via the system BIOS or executing device re-registration scripts through Windows PowerShell).
Related Error Escalators
When a computer’s security module fails to retain encryption tokens properly, it often causes cascading connectivity drops. This hardware breakdown can lead directly to system-wide failures covered in How to Resolve Modern Authentication (ADAL/MSAL) Failures in 2025, preventing secondary business applications from establishing secure cloud links.
Ticket Closed
For an isolated single-device failure, renaming the local cache folder remains the most efficient path back to operational status. However, if the machine has recently undergone a physical motherboard replacement or a major BIOS upgrade, you must clear the TPM keys entirely through the Windows Security suite or the machine’s boot menu to allow the security chip to generate fresh, valid encryption pairs for Microsoft 365.