Microsoft 365 Apps Won’t Activate After Update: How to Fix It (2026 Updated Guide)

Quick answer

When Office stops activating immediately after a Windows update or an Office update, the cause is rarely Office itself. The update touched the credential subsystem — Web Account Manager, Windows Hello, or the TPM-protected token store — and broke the trust path that Office uses to confirm your subscription. The fix isn’t to reinstall Office. It’s to refresh the identity layer that the update broke. Most of the cases resolve in under ten minutes if you go in the right order.

Before you start

A few things to settle first.

Confirm the timing. The defining symptom of this pattern is Office worked yesterday and stopped today, after an update completed. If activation has been broken for longer than that, or you can’t tie it to a specific update, you may be on the wrong fix path. The Office activation error 0x80070005 article covers cold-start activation issues that aren’t update-related.
Identify which update. Settings → Windows Update → Update history shows the most recent updates and their install dates. Does the activation break date line up? If yes, the update is the trigger. If not, something else changed and the fix sequence below is less likely to help.
Check the obvious. Is there a banner in Office that says something other than “Activation failed”? Sometimes after an update, Office prompts for re-consent to terms or asks you to re-accept your account — that’s not activation failure, it’s a one-click confirmation that’s been mislabelled by users as a fault. Click whatever Office asks you to click first.

What this error means

Microsoft 365 activation depends on a chain of trust that the operating system maintains: a token issued by Microsoft Entra ID (or a Microsoft account, depending on your subscription type), encrypted with a key tied to your device’s TPM, brokered through Web Account Manager, and persisted in the OneAuth token store. Office reads that token, confirms with the licensing service that it’s valid, and continues running.

Windows updates — especially feature updates from one major version to the next, but also some servicing updates — can disturb any link in that chain. The update can:

Re-initialise the TPM-bound key store, invalidating cached tokens
Reset Web Account Manager’s default identity broker setting
Re-enrol the device’s primary refresh token, which Office’s license depends on
Restart the Click-to-Run service in a state that doesn’t pick up the new credential subsystem
Clear the Office Identity service’s cached state without re-establishing it cleanly

Any of those produce the same visible symptom: Office launches, fails to prove its license, and presents an activation error. The actual error code varies — it might be 0x80070005, 0x4004F00C, CAA70004, or no code at all — but the underlying problem is the same. The fix doesn’t depend on the code; it depends on rebuilding the credential chain that the update disturbed.

Where this error appears

This pattern shows up on five distinct triggers. The fix sequence is the same; the timing context helps you confirm you’re looking at the right problem.

After a Windows feature update (Windows 11 23H2 → 24H2, or any future major version jump). The most disruptive case because feature updates touch the most subsystems. Activation breaks on the first Office launch after the post-update reboot.
After a Windows monthly servicing update. Less common but well-documented for specific KBs that touched the credential layer. Microsoft’s release health dashboard lists known issues if the update has caused activation problems at scale.
After an Office update. Click-to-Run pushes Office updates roughly monthly; occasionally one of these breaks the licensing handshake and surfaces as activation failure on the next app launch.
After a TPM reset or BitLocker change. If you’ve cleared the TPM, paused BitLocker, or migrated to a new device with the same Windows account, Office activation can break for the same fundamental reason.
After a Windows in-place reinstall. Settings → System → Recovery → Reinstall now preserves Office, but the credential subsystem is rebuilt and Office’s cached tokens often don’t survive cleanly.

Common causes

In rough order of frequency.

Cause	What happened	Why Office breaks
Cached identity token invalidated by update	The update reset the TPM-bound key that decrypted the token	Office can no longer read its own cached token, can’t refresh, fails activation
Web Account Manager default unset	Update reverted the WAM default broker setting	Modern-auth calls go through the wrong path and fail
Click-to-Run service not running	Service stopped during the update and didn’t restart cleanly	Office can’t reach the Office Licensing Heartbeat
Conflicting Windows Hello state	Hello PIN was reset or invalidated by the update	The Windows-side identity assertion that Office relies on isn’t valid
Office install file partially damaged	Update touched files that Office shares	Office runs but can’t activate; needs a repair to restore
Conditional Access compliance lapsed	Device’s compliance state expired during the time it was offline for update	Entra blocks the activation traffic at the policy layer

Fixes to try first

Try these in order. Stop at the first one that works.

1. Reboot once more

Yes, you’ve already rebooted to install the update. Reboot again anyway. After the post-update first boot, Windows runs background tasks for several minutes (sometimes hours) — credential brokers re-initialising, services re-registering, profile state being rebuilt. A second clean reboot often catches Office at a moment when the credential subsystem is stable, and activation succeeds without further intervention.

2. Sign out of Office, then sign back in

In any Office app: File → Account → Sign out. Close all Office apps completely. Wait twenty seconds. Open Word and sign in again with the account that holds the Microsoft 365 subscription. This resolves a meaningful share of post-update activation cases because it forces Office to discard its cached token and request a fresh one through the now-stable credential subsystem.

If sign-out throws an error or hangs, the OneAuth cache is in a bad state — go to fix 4.

3. Run Office Quick Repair

Settings → Apps → Installed apps → Microsoft 365 → Modify → Quick Repair. This re-registers Office’s components and resets the licensing service without re-downloading anything. It takes 2–3 minutes and resolves cases where the update partially damaged Office’s local state. If Quick Repair completes but the issue persists, run Online Repair from the same dialog — heavier but it redownloads damaged files. Allow 15–30 minutes for Online Repair.

4. Clear the OneAuth token cache

Close all Office apps. Confirm none are still running in Task Manager (look for winword.exe, excel.exe, outlook.exe, lync.exe). In File Explorer, go to %LOCALAPPDATA%\Microsoft\OneAuth and rename the folder to OneAuth.old. Open Word — it should prompt you to sign in fresh, build a clean OneAuth folder, and present a new token to the Identity service.

If Word doesn’t prompt for sign-in and just opens with the same activation banner, also rename %LOCALAPPDATA%\Microsoft\IdentityCache to IdentityCache.old and try again. After successful activation, you can delete the renamed folders.

5. Restart the Click-to-Run service

Open PowerShell as administrator and run:

Stop-Service -Name "ClickToRunSvc" -Force
Start-Service -Name "ClickToRunSvc"

This forces the licensing service to come back up cleanly. After it restarts, open Word and check File → Account for activation status. The activation handshake usually fires within a minute of the service starting.

6. Check Windows Hello status

Settings → Accounts → Sign-in options. If Windows Hello PIN shows a warning (“You’ll need to set up your PIN again”) or asks you to re-enter your password, complete that setup. Office activation depends on the Windows-side identity assertion being valid; if Hello is in a half-set-up state, Office’s modern-auth call fails.

After re-establishing Hello, sign out of Office and sign back in.

Advanced fixes

If the standard sequence didn’t work.

Reset the activation state with `ospp.vbs`

In Command Prompt as administrator:

cd "C:\Program Files\Microsoft Office\Office16"
cscript ospp.vbs /dstatus
cscript ospp.vbs /rearm

The first line shows the current activation status (useful for diagnostics — note any error codes or expired tokens it reports). The second resets the grace period and forces re-activation on the next Office launch. Then close any open Office apps and relaunch.

Verify the Entra ID device join state

If the device is joined to Microsoft Entra ID, the join state can be disturbed by some updates. Run dsregcmd /status in Command Prompt (regular user, not admin). Look for the AzureAdJoined value (should be YES for an Entra-joined device), the WamDefaultSet value (should be YES), and the KeySignTest value (should be PASSED). If any of these are wrong, that’s the actual cause. The fix is admin-side — open a ticket if this is a managed device.

Run the Microsoft Support and Recovery Assistant

Microsoft’s Support and Recovery Assistant has a specific diagnostic for Office activation. Download, run, choose “I’m having a problem with Microsoft 365 / Office activation” and let it work. It collects logs, identifies the failure point, and applies targeted fixes. Slower than the manual sequence (15–25 minutes) but it surfaces causes that the manual approach can miss.

Last-resort uninstall and reinstall

If nothing has worked, uninstall Office (Settings → Apps → Installed apps → Microsoft 365 → Uninstall) and reinstall from office.com after signing in. Save signatures, AutoCorrect entries, and Outlook data files first if any are local — those don’t always survive cleanly. Reinstall resolves nearly all activation issues at the cost of an hour and a 4 GB download.

If you are on a work or school device

The post-update activation pattern is especially common on managed devices because Conditional Access compliance can expire during the offline period that updates create. The fix sequence above will not work if the underlying cause is policy.

Symptoms that suggest policy rather than fault:

Activation worked before the update, the device is now showing the activation error, and the device hasn’t checked into Intune since before the update
Other Microsoft 365 services (Outlook web, Teams) are also asking for re-authentication or showing compliance warnings
The error message includes a Conditional Access reference or a “Your device is not in compliance” link

Don’t run repair or uninstall on a managed device without authorization. Open a ticket. The fix is to bring the device back into compliance — usually by syncing with Intune (Settings → Accounts → Access work or school → click your work account → Info → Sync) — and then re-running activation. That’s something IT or the device itself does; not something the user resolves.

When to stop

Stop and escalate if:

You’ve completed the standard sequence and the issue persists across two clean reboots. That suggests a deeper problem with the device’s credential subsystem (broken WAM, damaged user profile, TPM not initialising) and the right next step is a profile rebuild or a Windows in-place reinstall, not more Office troubleshooting.
Multiple Microsoft services are failing at once. Office not activating, OneDrive disconnected, Outlook unable to sign in, Teams unable to load — that’s identity-layer collapse, not an Office activation problem. Different fix path entirely.
The activation worked, then broke again at the next reboot. Suggests a Conditional Access loop on a managed device. Don’t keep running the same fixes; the device needs to be brought back into compliance.
Critical work is at risk. Use Office on the web (office.com) as a stopgap. The web versions don’t depend on the local activation layer, so they work even when the desktop apps don’t. Sort out the desktop install when work allows time.

Office activation error 0x80070005 — the code-led twin of this article, useful when activation has always been broken (not just after an update)
Office keeps asking you to sign in — when activation succeeds but doesn’t persist
How to repair Microsoft 365 — the deeper repair sequence when the standard fixes don’t resolve it
Windows Update error 0x80070643 — the most common Windows update failure on devices that go on to break Office activation

Official references

Microsoft Support — Activate Office
Microsoft Support — Repair an Office application
Microsoft Learn — Windows release health
Microsoft Support and Recovery Assistant

FAQ

Why does this happen mostly after Windows feature updates? Feature updates touch more of the operating system than monthly servicing updates do — including the credential brokers and identity-related services that Office depends on. Monthly updates rarely cause this, but they can. The defining factor isn’t the size of the update, it’s whether it touched the credential subsystem.

Will rolling back the Windows update fix it? Sometimes — but rollback is a heavier operation than the fix sequence above, and it leaves you on an outdated version of Windows that you’ll need to update again eventually. Try the activation fix first. Use rollback only as a last resort, and only if rollback is still possible (Windows allows rollback within the first 10 days after a feature update, then deletes the rollback files).

Is this a virus or malware? No. The pattern is a known consequence of Windows updates interacting with the credential subsystem. Don’t run any tool that claims to “scan for activation errors” or “remove activation viruses” — those are usually bundled with PC-optimizer software that creates new problems.

Why does signing out of Office sometimes fail? Because Office can’t write to the OneAuth folder to clear the cached token. That’s the cache corruption signal — go to fix 4 (rename the OneAuth folder) directly. Once the folder is renamed and Office prompts for fresh sign-in, the issue clears.

My subscription is fine — why is Office acting like it’s expired? Activation isn’t a check against your subscription’s billing state. It’s a check against the local cached token. Even with an active subscription, a corrupted local token causes activation failure. Sign out, clear the cache, sign back in — that’s the fix path that actually addresses what’s broken.

Can I avoid this by delaying Windows updates? You can defer feature updates for up to a year on Windows 11 Pro and Enterprise editions; Home edition has more limited deferral options. But delaying updates indefinitely is a security risk, and the right answer is having a fix sequence ready for when activation breaks rather than avoiding the updates entirely. The fix takes ten minutes — easier than running outdated Windows.

↑ Back to top