Resolving “Something Went Wrong” Error 1001 in Outlook and Teams

Microsoft 365 apps display Error 1001 (“Something went wrong [1001]”) when the underlying Windows authentication broker fails to exchange identity tokens with Entra ID. This error blocks sign-in prompts, prevents mailbox synchronization in Outlook, and stops Teams from loading chats or channels. It primarily targets desktop clients on Windows 10 and 11 when local authentication caches become unreadable or corrupted.

Fast-Fix: The 45-Second Solution

Error 1001 occurs when the Windows Web Account Manager (WAM) plugin cache breaks, preventing OAuth token delivery to Outlook and Teams. Risk Tier: Moderate. To fix it immediately, sign out of Microsoft 365, open PowerShell as administrator, and re-register the Microsoft.AAD.BrokerPlugin package to rebuild the identity broker cache before rebooting your machine.

Diagnostic Snapshot

• Severity Tier: Moderate (Blocks sign-in and cloud synchronization on desktop apps; web access remains functional).
• Data Safety Risk: Low (Local document files, cloud emails, and chat histories are preserved intact on Microsoft 365 servers).
• Common Cause: Corrupted Web Account Manager (WAM) broker package cache, stale OAuth identity tokens, or restricted user profile permissions.
• Admin Requirement: User-level sign-out resolves minor cache glitches; local administrator rights required for PowerShell package re-registration.

Condition: Low Risk vs. High Risk

• Low Risk: The error appears on a single application after an unexpected system shutdown, and signing into Microsoft 365 via web browser works without prompts.
• High Risk: Error 1001 recurs across all installed Microsoft 365 applications on a managed device, persists across user profile reboots, or accompanies Trusted Platform Module (TPM) hardware errors.

The System Break (What This Means)

Modern authentication in Windows relies on the Web Account Manager (WAM) framework, specifically the Microsoft.AAD.BrokerPlugin app package, to manage OAuth 2.0 tokens for desktop applications. Think of WAM like a security badge reader at an office turnstile: if the reader’s internal memory corrupts, it rejects valid badges even if the employee holds active security clearance. When Outlook or Teams requests an access token, WAM retrieves and decrypts the cached refresh token from the user profile. If the local broker folder loses read permissions, encounters database corruption, or fails to initialize, the application cannot establish an authenticated session, returning the generic HTTP/OAuth failure header categorized as Error 1001.

Root Cause Probability

• Likely (60%): Corruption in the local Microsoft.AAD.BrokerPlugin package folder inside the user’s AppData directory.
• Possible (30%): Stale or conflicting identity records stored in Windows Credential Manager or local Office registry hives.
• Rare (10%): Hardware Security Layer or TPM state desynchronization blocking local token decryption.

Conflict Escalators

• Switching Between Classic and New Apps: Running Classic Outlook alongside the New Outlook or New Teams client can cause concurrent token requests that lock the WAM broker database.
• Third-Party Security Suites and Web Proxies: Security software inspecting SSL/TLS traffic can intercept token refresh requests to login.microsoftonline.com, causing time-out errors during broker validation.
• Roaming User Profiles and VDI Environments: Virtual Desktop Infrastructure (VDI) setups that do not properly persist the %LOCALAPPDATA%\Packages directory break the broker package identity state on every logoff.

Progression: 1 Hour -> 24 Hours -> 1 Week

• 1 Hour: Outlook displays a yellow warning bar stating “Need Password” or “Fix Account,” while Teams shows a blank screen with error code 1001.
• 24 Hours: Repeated sign-in attempts fail continuously, cached credentials expire completely, and offline document synchronization halts.
• 1 Week: Local application sessions lock out entirely, forcing the user to rely exclusively on web browser interfaces for email and chat workflows.

Common Misdiagnoses

• Misdiagnosed as Tenant Account Disablement: Administrators often assume the user’s account is locked in Entra ID. If the user can sign in at portal.office.com, the issue is strictly local to the OS authentication layer.
• Misdiagnosed as Network Disconnection: The error string occasionally mentions network issues, but internet connectivity is usually fine. If web browsers load external sites, do not troubleshoot local router settings; review token handlers via How to Resolve Modern Authentication (ADAL/MSAL) Failures in 2025.
• Misdiagnosed as TPM Hardware Failure: While TPM errors (like 80090016) disrupt sign-in, Error 1001 specifically points to the broker software package rather than chip key storage. For TPM-specific resets, see Troubleshooting TPM 2.0 Errors (80090016) during Office Sign-in.

Immediate Action Steps

Step 1: Re-register the AAD Broker Plugin Package

Rebuilding the Windows Web Account Manager package resets the authentication broker without affecting user data files.

1. Close all Microsoft 365 applications, including Outlook, Teams, Word, and OneDrive.
2. Right-click the Start button and select Terminal (Admin) or PowerShell (Admin).
3. Paste the following command and press Enter: PowerShell Add-AppxPackage -Register "C:\Windows\SystemApps\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\AppxManifest.xml" -DisableDevelopmentMode -ForceApplicationShutdown
4. Restart the computer, open Outlook or Teams, and complete the sign-in prompt.

Step 2: Clear the Local Broker Plugin Cache

If package re-registration fails to resolve the error, rename or clear the broker folder directly from the user profile.

1. Press Windows Key + R to open the Run dialog box.
2. Type %LOCALAPPDATA%\Packages and press Enter.
3. Locate the folder named Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy.
4. Right-click the folder, select Rename, and append .old to the name (e.g., Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy.old).
   • Note: If Windows states the folder is in use, log out of Windows, log back in, and immediately attempt the rename before opening any apps.
5. Re-open Outlook or Teams to allow Windows to generate a clean broker cache folder automatically.

Step 3: Remove Stale Identity Tokens from Windows Credential Manager

Stale tokens stored in the Windows Credential vault can conflict with fresh token generation.

1. Press Windows Key + S, type Credential Manager, and open it.
2. Select Windows Credentials.
3. Scroll down to Generic Credentials.
4. Expand and remove all entries beginning with MicrosoftOffice16_Data, ADAL, or SSO_POP.
5. For step-by-step guidance on clearing cached tokens cleanly, refer to How to Clear Stale Office Tokens from Windows Credential Manager.

Step 4: Perform an Identity State Reset

If token loops persist, clear the local Office identity registry values:

1. Refer to the automated cleanup procedure outlined in How to Reset the Microsoft 365 Activation State (Using SaRA Tool).

Hard-Stop Red Flags

• “Account Disabled” in Web Portal: If browser sign-in at portal.office.com returns account status errors, stop local troubleshooting immediately; the user requires IT Helpdesk administrative intervention.
• Corrupted Windows System Apps Directory: If the PowerShell re-registration command returns “Path Not Found,” the Windows system installation is damaged, requiring an in-place OS repair or DISM restoration.
• Device Unregistered in Entra ID: If the sign-in failure accompanies device status codes like 135011, review “Your Organization Has Disabled This Device” (Error Code 135011).

What the IT Admin Will Check

1. Entra ID Sign-in Logs: Filter logs by User Principal Name (UPN) to check for failed OAuth token requests under Error Code 500121 or 50199.
2. Conditional Access Policies: Verify that non-compliant device rules or unexpected location restrictions are not silently blocking broker requests.
3. Registry Identity Overrides: Check client endpoints for legacy registry keys that enforce outdated authentication behavior under:
   HKCU\Software\Microsoft\Office\16.0\Common\Identity
   (Ensure EnableADAL is not set to 0 on modern builds).
4. Group Policy Restrictions: Ensure user profile policy rules permit the installation and execution of packaged apps (AppX) within the local AppData directory.

Resolution Complexity

• Moderate: Resolving Error 1001 typically requires executing elevated PowerShell commands or modifying user profile system folders, though no domain-level changes are needed.

Related Error Escalators

• If signing in succeeds briefly but continually prompts for credentials upon app restart, see How to Clear Office Credential Cache on Windows 11 (The Modern Way).
• If Outlook reports an inability to reach Microsoft servers during sign-in attempts, check Office Activation Fails with “Server Not Responding”.
• If network transport appears online but Office apps report offline conditions, consult “No Internet Connection” Error despite being Online in Office.

Ticket Closed

Error 1001 is a local broker communication failure rather than a cloud-side account failure. Re-registering the Microsoft.AAD.BrokerPlugin package via PowerShell clears out stalled OAuth refresh states and fixes the issue in the vast majority of cases. Once the broker package is re-registered and the computer is restarted, launch Outlook or Teams to complete the standard identity prompt and restore regular desktop client operations.