Microsoft 365 “Something Went Wrong” Sign-In Error: How to Read the Bracket Code and Fix It

If Word, Excel, Outlook, or another Microsoft 365 app shows you “Something went wrong” when you try to sign in, the first thing to do is stop trying random fixes. The error message is generic on purpose — but the small code in square brackets at the end of the message is not. That code tells you which subsystem failed, and which fix is going to actually work.

Most of the troubleshooting guides for this error online don’t bother to look at the bracket code. They run through the same five suggestions — restart, repair, reinstall — until something happens to work. That’s not a fix. It’s a coin toss. Read the code first, then run exactly the fix that maps to it.

Quick answer

The “Something went wrong” error in Microsoft 365 desktop apps is almost always one of three things: a corrupted authentication token cached on your PC, a Windows account broker (WAM) failure, or a stale credential in Windows Credential Manager. The code in the brackets — [1001], [657rx], [4vt9f], and others — narrows it down. The fix order that resolves the most cases, fastest, is:

  1. Sign out fully (File → Account → Sign out) and restart the app.
  2. Clear stale Office credentials from Windows Credential Manager.
  3. Disconnect and re-add your work or school account in Windows Settings.
  4. Reset the AAD Broker Plugin token cache.
  5. Run an Online Repair on the Microsoft 365 install.

Eight times out of ten, the fix is in the first two steps. Don’t reinstall Office. Don’t call support. The data is local, and the fix is local.

Before you start

Three things to confirm before you touch anything:

  • Check the Microsoft 365 service status. Go to admin.microsoft.com/servicestatus (admin) or portal.office.com/servicestatus (signed-in user). If there’s an active incident affecting Authentication, the fix is to wait, not to debug.
  • Note the exact text of the error, including the bracket code. Take a screenshot. The bracket code is not visible after you dismiss the dialog.
  • Confirm you can sign in to office.com in a browser. Open a private/InPrivate window and go to office.com. If you can sign in there, your account and password are fine — the problem is local to your installed Office. If you can’t sign in there either, the problem is your account, and you need a different troubleshooting path. See Microsoft 365 Error CAA50021 for account-side issues.

What the bracket code actually means

The text “Something went wrong” is Microsoft’s deliberately vague catch-all for sign-in failures in Office apps. The code in the square brackets is a correlation ID category that maps to a subsystem. Here’s the translation:

Bracket codeWhat it meansMost likely fix
[1001]Web Account Manager (WAM) plugin failure or security software interferenceRe-register the work account; check antivirus exclusions
[4vt9f]Invalid credential — token rejected by the identity serviceClear cached credentials; sign out fully and back in
[657rx]Broken work/school account registration on this deviceReset AAD Broker Plugin; disconnect and re-add the work account
[hrkp], [oo7vh], similar 4–6 char codesGeneric identity broker errors — almost always token cacheClear identity cache folder; sign out and back in

These codes don’t appear in any official Microsoft documentation as a complete reference. They surface in Microsoft Q&A threads, support cases, and IT forums. The pattern is consistent: the codes change, but the failure surface is one of three places — token cache, WAM plugin, or Credential Manager.

If your code isn’t in the table above, treat it as a generic identity-broker failure and run the fix order from the top.

Where this error appears

The “Something went wrong” sign-in error shows up in:

  • Word, Excel, PowerPoint, OneNote on Windows when you click File → Account → Sign in or when launching a freshly-installed Office app.
  • Outlook (classic and new) on Windows during account setup or when re-authenticating after a token expires.
  • Microsoft 365 apps on macOS with the same bracket-code pattern, though the error wording sometimes differs.
  • The Microsoft 365 portal at office.com for some Copilot and account-management flows, where it appears as “Something is wrong” rather than “Something went wrong.”

It does not typically appear in Microsoft 365 web apps used in a fresh browser session — those use a different sign-in flow. If you see it there, the issue is account-side, not local.

Common causes (in order of frequency)

The fix order in the Quick Answer maps to the cause frequency order. From most to least common:

1. Stale or corrupted authentication token in the local cache. Office stores sign-in tokens locally so you don’t have to re-authenticate every time you open Word. When those tokens become corrupted — often after a Windows update, a password change, or a Conditional Access policy change — Office can’t refresh them and falls back to the generic error.

2. Windows Credential Manager has bad entries. Older or partial sign-in attempts leave credential entries that conflict with the new authentication flow. Office sees the credentials, tries to use them, fails, and shows the generic error.

3. Broken work/school account registration on the device. When you sign in to Office with a work or school account, Windows registers the device with Entra ID (formerly Azure AD). If that registration breaks — often when a device is moved between tenants or when Conditional Access policies are tightened — Office fails to authenticate against the broker.

4. AAD Broker Plugin cache corruption. The Web Account Manager (WAM) and AAD Broker handle cross-app sign-in on Windows. Their token cache lives in your user profile. Corruption here causes failures across all Office apps simultaneously.

5. Security software blocking WAM. Some endpoint security products (notably some EDR agents) block the WAM plugin from running. This produces the [1001] bracket code more than any other, and it’s the only cause on this list that requires admin involvement to fix permanently.

6. Multiple Microsoft accounts confusing the sign-in flow. If you have a personal Microsoft account (@outlook.com, @hotmail.com) signed in to Windows alongside a work account, Office sometimes tries to authenticate the wrong one.

Fixes

Run these in order. Don’t skip steps unless you’ve already done the equivalent.

Fix 1: Sign out fully and sign back in

This solves a surprisingly large share of cases — not because the act of signing out fixes the token, but because it forces Office to re-fetch one.

  1. Open any Microsoft 365 app (Word is fine).
  2. Go to File → Account.
  3. Under User Information, click Sign out. Confirm if prompted.
  4. Close all Office apps. All of them. Outlook included. Check Task Manager for stragglers — OUTLOOK.EXE, WINWORD.EXE, EXCEL.EXE, OfficeClickToRun.exe. Kill any you see.
  5. Reopen Word.
  6. Sign back in.

If this works, you’re done. If not, continue.

Fix 2: Clear cached Office credentials in Credential Manager

Stale entries in Credential Manager cause the [4vt9f] family of errors more than anything else.

  1. Press Windows key + R, type control /name Microsoft.CredentialManager, press Enter.
  2. Click Windows Credentials.
  3. Under Generic Credentials, look for entries that start with:
    • MicrosoftOffice16_Data:
    • MicrosoftAccount:
    • OneDrive Cached Credential
    • Anything containing office365 or your work email address
  4. For each, click the dropdown arrow → Remove.
  5. Close Credential Manager.
  6. Reopen Word and sign in. Office will re-create the credentials cleanly.

Do not delete entries that don’t relate to Office or your account. Other apps store credentials here too.

Fix 3: Re-register your work or school account in Windows

This fixes the [657rx] bracket code and most account-registration failures.

  1. Open Settings → Accounts → Access work or school.
  2. Click your work account → Disconnect.
  3. Important caveat: if your device is Entra ID-joined (managed by your employer), do not disconnect — that will lock you out of corporate resources. In that case, skip to Fix 4. If you’re unsure, ask your IT admin first.
  4. Restart Windows.
  5. Open Settings → Accounts → Access work or school → Connect.
  6. Sign in with your work email. Walk through the flow.
  7. Open Word and sign in. The credentials will use the freshly-registered account.

Fix 4: Reset the AAD Broker Plugin token cache

This is the deepest of the standard fixes. It clears the modern authentication token store.

  1. Sign out of Office.
  2. Close all Office apps.
  3. Open File Explorer and navigate to %LOCALAPPDATA%\Microsoft.
  4. Rename (don’t delete — you may need to undo this) these folders if they exist:
    • IdentityCache → IdentityCache.bak
    • OneAuth → OneAuth.bak
    • TokenBroker → TokenBroker.bak
  5. Restart your PC (a restart, not a sign-out — the broker service needs to fully stop).
  6. Open Word and sign in.
  7. If the sign-in works, you can delete the .bak folders later. If it doesn’t, rename them back and continue to advanced fixes.

Fix 5: Online Repair of Microsoft 365

This is the last resort before reinstalling. It rewrites the Office install but keeps your settings.

  1. Close all Office apps.
  2. Open Settings → Apps → Installed apps.
  3. Find Microsoft 365 Apps (or Microsoft 365 Apps for Enterprise) → click the three-dot menu → Modify.
  4. Choose Online Repair (not Quick Repair).
  5. Click Repair. Walk through the prompts. This takes 5–15 minutes and requires an internet connection.
  6. Restart when prompted.
  7. Open Word and sign in.

If you’re on a network with metered or restricted internet, Quick Repair won’t fix this — you need Online Repair.

Advanced fixes

If the standard fixes haven’t worked, you’re in territory where the cause is environmental (security software, organization policy, registry corruption) rather than user-state. These fixes assume you’re comfortable editing the registry or that you have admin support available.

Force Modern Authentication via registry. If you suspect Office is falling back to legacy auth (which Microsoft retired in 2023 and which doesn’t exist on the server side anymore), set these values under HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Identity:

  • EnableADAL (DWORD) = 1
  • DisableADALatopWAMOverride (DWORD) = 0
  • Version (DWORD) = 1

Restart Office afterwards.

Check antivirus / EDR exclusions for WAM. If you’re seeing [1001] consistently, your security software is likely blocking the Web Account Manager. Check exclusions for:

  • C:\Windows\System32\Microsoft.AAD.BrokerPlugin*
  • C:\Windows\SystemApps\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\

Most enterprise EDR products (CrowdStrike Falcon, SentinelOne, Defender for Endpoint) need explicit exclusions for these paths. If you’re not the admin, raise this as a ticket — it’s an organization-level fix.

Reset Office user data location. In rare cases, the C:\Users\<you>\AppData\Local\Microsoft\Office\16.0\Licensing folder gets corrupted in a way Online Repair doesn’t catch. Rename that folder, restart, and sign back in.

Work or school device — when to involve IT

If this is a device managed by your employer, three of the fixes above (re-registering the account, AAD Broker reset, antivirus exclusions) need IT to authorize or perform them. Don’t fight it — if Fix 1 and Fix 2 don’t resolve the issue and you’re on a managed device, raise a ticket and reference:

  • The exact bracket code from the error message.
  • Which apps are affected (just Word, or all M365 apps).
  • Whether you can sign in to office.com in a browser.
  • Whether other users on the same device are affected.

Persona 2 readers — small business owners, office managers, the de-facto IT person at the company — should also see our admin checklist for Microsoft 365 sign-in failures for the tenant-side checks (license assignment, Conditional Access, MFA enforcement) that complement these client-side fixes.

When to stop troubleshooting

Some scenarios mean the fix isn’t local. Stop and escalate if:

  • The error happens for every user on the same device → Windows or Office install corruption; reinstall Office.
  • The error happens for one user across multiple devices → account-side issue; check service status, then license assignment, then Conditional Access. Likely CAA50021 territory.
  • You’ve completed all five fixes and Online Repair without success → reinstall Microsoft 365 from scratch (uninstall via Settings → Apps, then download fresh from office.com).
  • Bracket code is [1001] and you’re on a managed corporate device → it’s a security software / WAM block; only IT can fix it.

What you should not do: download a “Microsoft 365 repair tool” from a third-party site, call a phone number that appears in a search result, or grant remote access to anyone who calls you about this error. Microsoft does not call users about sign-in errors. Anyone who does is running a scam.

Official references

FAQ

Why does Microsoft show a generic error message instead of the actual problem?

The “Something went wrong” wording is intentional — Microsoft doesn’t want to expose authentication-flow details to potentially malicious sign-in attempts. The bracket code is the diagnostic information that’s safe to expose to legitimate users. It’s frustrating, but it’s a security trade-off rather than a bug.

Will reinstalling Office fix this?

Sometimes. If the cause is corrupted Office user state (cause #4 above), reinstalling resets it. If the cause is Credential Manager entries or device-registration state (causes #2 and #3), reinstalling won’t help — those live outside the Office install. Try the five-step fix order before you reinstall.

Does this error mean my account has been compromised?

No. The error is local to the device or the device-account binding. If your account were genuinely locked out for security reasons, you’d see explicit messaging — typically “Your account has been temporarily locked” or a CAA-prefix code. The generic “Something went wrong” is a technical failure, not a security action.

My Microsoft account works fine on the web but not in the desktop apps. Why?

Web sign-in uses your browser’s session cookies; desktop sign-in uses the Windows account broker and local token cache. The two share the account but not the authentication state. A working browser sign-in confirms your account is fine. The desktop failure is local to the device’s token store. Fix 1 and Fix 2 typically resolve the disconnect.

Should I clear my browser cookies as part of fixing this?

Only if you can’t sign in to office.com in a browser either. If browser sign-in works, leave the cookies alone — clearing them won’t fix the desktop apps and will sign you out of other things.

Is this related to the new Outlook vs classic Outlook?

The error appears in both. New Outlook (the Mail-and-Calendar-replacement client) uses a slightly different sign-in flow but shares the same WAM/AAD Broker dependency. If new Outlook fails with this error and classic Outlook works, the issue is specific to new Outlook’s auth integration — typically resolved by removing and re-adding the account in new Outlook itself rather than the system-wide fixes here.

How long should the fixes take?

Fix 1 (sign out / back in): 30 seconds. Fix 2 (Credential Manager): 2 minutes. Fix 3 (re-register account): 5 minutes including restart. Fix 4 (AAD Broker reset): 5 minutes including restart. Fix 5 (Online Repair): 5–15 minutes plus restart. If you’re past 30 minutes total and nothing has worked, you’re in the territory where the cause is environmental and you should escalate to IT (work device) or move to reinstalling (personal device).

↑ Back to top