Office Activation Error 0x80070005: How to Actually Fix It (2026 Updated Guide)

Quick answer

When Microsoft 365 fails to activate with 0x80070005, the cause is almost never a permission on a folder, despite what the code literally translates to. It’s an identity-layer problem: the Office Identity service can’t read or refresh the token it needs to confirm your subscription. The fix is rarely “run as administrator.” It’s almost always “clear the local identity cache, sign back in fresh, and let Office talk to Microsoft’s modern-auth endpoint without anything in the way.” Most generic advice for this error skips the actual cause and tells you to repair Office, which fixes about a quarter of cases. The rest need the identity reset.

Before you start

Three things to confirm.

  • Confirm this is the activation surface, not the Windows Update surface. If 0x80070005 showed up in Word, Excel, Outlook or another Office app — usually with a message like “We couldn’t activate Microsoft 365” or “Account notice” — you’re in the right place. If it appeared in Settings → Windows Update, see the Windows Update scenario instead.
  • Confirm you have an active license. Sign into your account at account.microsoft.com (personal) or office.com (work or school) and check that Microsoft 365 is listed as active under “Subscriptions” or “Apps.” If it’s not, you have a licensing problem, not an activation problem — see Microsoft 365 license assigned but won’t activate.
  • Make a note of which account is signed into Office. Open File → Account in any Office app. The account listed at the top is what Office is trying to activate against. If it’s the wrong account (a personal one when it should be a work one, or vice versa), that’s likely your whole problem and the fix below will resolve it as a side effect.

What this error means

Microsoft 365 activation is not a one-time check against a license server. It’s a continuous handshake. Every Office app talks to the Office Identity service through the Office Licensing Heartbeat — a process that wakes up every few hours, presents the cached identity token, and gets back a “yes you’re licensed, here’s a refreshed token” response. When that handshake fails, Office moves into reduced-functionality mode, and depending on which step of the handshake failed, you get a specific error code on screen.

0x80070005 in the activation context means the Office Identity service tried to read or write to its protected data area and was refused. The protected data area is %LOCALAPPDATA%\Microsoft\OneAuth (the modern token store), %LOCALAPPDATA%\Microsoft\IdentityCache (the legacy cache), and %LOCALAPPDATA%\Microsoft\Office\16.0\Licensing (the license cache itself). When any of those folders has corrupted contents, broken ACLs, or a token that the service can no longer decrypt, Office gets Access Denied back from its own subsystem and reports it as 0x80070005.

This is why “run as administrator” doesn’t fix it — Office Identity already runs with the privileges it needs. The problem isn’t privilege. It’s that the data it’s trying to read is in a state it can’t make sense of.

Where this error appears

  • At Office launch. You open Word and a yellow or red banner appears: “We couldn’t activate Microsoft 365” with 0x80070005 listed when you click for details. Most common surface.
  • After a Windows sign-in change. You changed your Windows password, joined or left a domain, or re-joined the device to Microsoft Entra ID, and Office now fails to activate. The Windows-side identity changed and Office’s cached token no longer matches.
  • After a Windows feature update. Specifically, after a 23H2 → 24H2 jump, or after certain monthly servicing updates that touch the credential subsystem. This is its own pattern with its own fix path — see Microsoft 365 won’t activate after update.
  • On a corporate device after a long absence. A laptop that’s been off the corporate network for weeks comes back online and Office fails to activate. Conditional Access policies have flagged the device as out-of-compliance and are blocking the activation traffic at the policy layer.
  • Silently, with Office quietly disabled. Sometimes Office doesn’t show a popup — it just removes editing functionality and grays out the save button. If you’re in reduced-functionality mode without a clear message, check File → Account; the activation status and any error codes are listed there.

Common causes

  • Stale or corrupted token in the OneAuth cache. The most common cause. Office cached a token from a previous successful sign-in, the token is now expired or invalid, and the refresh handshake is failing.
  • Multiple accounts in conflict. The Office Identity service is trying to activate against one account while Windows Hello / Web Account Manager is presenting a different one. Common after someone has signed into Office with a personal Microsoft account on a device that’s joined to a work tenant.
  • Conditional Access block on the activation traffic. On a managed device, an Entra ID Conditional Access policy is blocking the modern-auth call that Office is trying to make. The user sees 0x80070005; the actual cause is “your device isn’t compliant.”
  • Office Licensing service not running. The ClickToRunSvc or OfficeLicenseHeartbeat service has stopped or is in a stuck state. A restart resolves it.
  • The Office installation is genuinely damaged. Less common — usually the result of a half-completed update or a previous repair attempt that didn’t finish. Office Repair fixes this.
  • Antivirus interfering with %LOCALAPPDATA%. Some endpoint protection products treat writes to the AppData folder as suspicious and block them. Rare but real.

Fixes to try first

These are ordered by likelihood of success, lowest risk first.

1. Sign out fully and sign back in

In any Office app: File → Account → Sign out (under your account name). Close all Office apps completely (check Task Manager — if you see winword.exe, excel.exe, or outlook.exe still running, end them). Wait twenty seconds. Open Word, sign in with the account that holds the license. This single step resolves a meaningful share of cases because it forces a token refresh.

If signing out reports an error or doesn’t go through, you have token cache corruption — go to fix 3.

2. Run Office Repair (Quick first)

Settings → Apps → Installed apps → Microsoft 365 → Modify → Quick Repair. Quick Repair is local, fast, and doesn’t require an internet connection. It re-registers Office’s components and resets the licensing service without redownloading anything.

If Quick Repair completes but the error returns, run Online Repair from the same dialog. Online Repair is heavier — it redownloads the entire Office install — but it resolves cases where the local files are damaged.

3. Clear the OneAuth cache

If sign-out and repair haven’t worked, the token cache itself is the problem. To clear it, close all Office apps, then in File Explorer navigate to %LOCALAPPDATA%\Microsoft\OneAuth. Rename the folder to OneAuth.old. Open Word — it’ll prompt you to sign in fresh, build a new OneAuth folder, and present a clean token to the Identity service.

If Word doesn’t prompt you (it just opens with the same banner), close it again, also rename %LOCALAPPDATA%\Microsoft\IdentityCache to IdentityCache.old, and try again. After a successful sign-in, you can delete the .old folders.

4. Remove the conflicting account

Open Settings → Accounts → Email & accounts. If you see entries for accounts that aren’t the one you want Office to activate against, especially Work or school account entries you don’t recognize, remove them. Then sign out of Office (File → Account → Sign out) and back in. Conflicting Windows-side accounts are a frequent cause of 0x80070005 on devices where someone has shifted between personal and work use.

5. Reset Office activation state

If none of the above worked, run the Office activation reset. Open Command Prompt as administrator and run:

cd "C:\Program Files\Microsoft Office\Office16"
cscript ospp.vbs /dstatus
cscript ospp.vbs /rearm

The first command shows you the current activation state — useful for diagnostics. The second resets the license grace period and forces a re-activation on next Office launch. This is a documented Microsoft action, not a workaround.

After running it, open Word, sign in if prompted, and check File → Account for the activation status.

Advanced fixes

If the standard sequence didn’t resolve it.

Restart the Click-to-Run service

The ClickToRunSvc is the service that handles Office activation and updates. If it’s stuck, the fix sequence above will keep failing. In an admin PowerShell:

Stop-Service -Name "ClickToRunSvc" -Force
Start-Service -Name "ClickToRunSvc"

Then retry activation.

Check dsregcmd /status for AAD join issues

If your device is joined to Microsoft Entra ID (most corporate devices are), run dsregcmd /status in Command Prompt. Look at the AzureAdJoined and WamDefaultSet values. If AzureAdJoined is YES but WamDefaultSet is NO, the Web Account Manager isn’t being used as the default identity broker, which can cause activation to fail with 0x80070005 on modern-auth calls. This is an admin-side fix that your IT team handles — open a ticket.

Verify Office is fully signed out at the Windows credential level

Office stores a credential entry in Windows Credential Manager. Open Control Panel → User Accounts → Credential Manager → Windows Credentials. Look for entries beginning with MicrosoftOffice16_Data:. Right-click each and remove. Then sign back into Office. This forces a complete identity reset that File → Account → Sign out doesn’t always achieve.

Use the Microsoft Support and Recovery Assistant

Microsoft publishes a free diagnostic tool called the Microsoft Support and Recovery Assistant that runs an automated diagnostic against Office activation. It’s worth running before you escalate. It collects logs, makes targeted fixes, and tells you what it found. It’s slow (15–25 minutes) but useful when the manual sequence hasn’t resolved the issue.

If you are on a work or school device

This is where most 0x80070005 activation cases on managed devices actually live.

The likely cause is a Conditional Access policy in Microsoft Entra ID that’s blocking the activation handshake. The trigger is usually one of:

  • The device is no longer marked compliant in Intune (out-of-date Windows version, encryption disabled, not phoned home recently)
  • The user account has had a security event (impossible-travel sign-in, password reset) that triggered a re-auth requirement
  • The tenant has changed its Conditional Access rules (a new policy is in effect that the device hasn’t been brought into compliance with)

Don’t run Office Repair on a managed device without authorization — it can change your Office install in ways that affect your IT team’s deployment configuration. Open a ticket. The fix is almost always something they need to do at the policy level, not something you can resolve at the user level.

If your IT team confirms the device should be allowed to activate and the issue persists, then the user-level fixes (token cache clear, account sign-out) are appropriate.

When to stop

Stop and escalate if any of the following.

  • Activation has worked, then stopped, repeatedly. That’s a Conditional Access compliance pattern, not a fault. Your IT team needs to look at the device’s compliance state in Intune.
  • The same account works on another device. Confirms the account is fine and the problem is local to this device. If you’ve cleared the cache, repaired Office, and reset the licensing state and the error persists, the next step is uninstalling Office and reinstalling fresh — but that’s heavier than most cases need.
  • You’re seeing other identity-related errors at the same time — Outlook prompting for sign-in repeatedly, OneDrive disconnecting, Teams not loading. The problem isn’t Office activation specifically; it’s the identity layer on this device, and the right action is a profile rebuild or a fresh Windows sign-in.
  • Critical work is at risk. Use Office on the web (office.com) as a temporary workaround while you sort out the local install. Don’t keep banging on a broken local activation when the cloud version works.

Official references

FAQ

Why does Office Repair sometimes fix this and sometimes not? Quick Repair fixes registry-side activation state. Online Repair fixes both registry state and damaged install files. Neither touches the OneAuth token cache, which is where most 0x80070005 activation problems actually live. If repair didn’t fix it, the next step is the cache clear in fix 3 above.

Will reinstalling Office fix this? Almost always, yes — but it’s a heavy hammer. Reinstall removes the local cache, the licensing state, the identity tokens, and rebuilds them all from scratch. If you’ve worked through the standard sequence and nothing has worked, reinstall is reasonable. Save your AutoCorrect entries and signatures first, because those don’t always survive cleanly.

Does my Microsoft 365 subscription expire when this error happens? No. The error is local. Your subscription is fine — you can confirm by signing in at account.microsoft.com and checking that the subscription is active. The grace period for activation is 30 days, after which Office moves into read-only mode, but the subscription itself doesn’t lapse.

Is Office Pro Plus different from Microsoft 365 for this error? The activation flow is similar but Pro Plus uses a slightly different licensing path (Shared Computer Activation in some configurations). The fix sequence above applies to both. The Microsoft Support and Recovery Assistant identifies which version you’re on if you’re unsure.

Can I use Office on the web instead while I troubleshoot? Yes — office.com gives you Word, Excel, PowerPoint, Outlook, OneNote and Teams in the browser. The web versions don’t have the local activation layer, so they work even when the desktop apps don’t. Useful as a workaround while you fix the desktop install.

What’s the difference between this and “Office keeps asking me to sign in”? 0x80070005 means activation explicitly failed and Office knows it failed. “Keeps asking to sign in” means activation is working but Office isn’t successfully persisting the signed-in state across launches — different problem, different fix path. See the keeps asking sign-in article for that one.

↑ Back to top