Fix Office 365 Sign-In Loop on Windows (AAD Identity Cache Reset)

If a user can log into their Windows profile just fine, but Office apps (Outlook, Teams, Word) keep bouncing them back to a sign-in prompt in an endless loop – never actually completing authentication – you’re likely dealing with a corrupted Azure AD Broker Plugin or Identity Cache on that machine. This is a common issue on domain-joined and Azure AD-joined workstations, and it’s usually fixable in a few minutes without a full profile rebuild.

Why this happens

Windows caches Azure AD authentication tokens locally so users aren’t re-prompted constantly. When that cache – specifically the AAD Broker Plugin data or the Identity Cache folder – becomes corrupted or falls out of sync with the actual account state in Azure AD, Windows keeps trying to validate against stale, broken tokens. The result is Office repeatedly prompting for sign-in without ever resolving it, even with correct credentials.

Fix: Reset the AAD Broker and Identity Cache

Before you start: sign out of the affected user’s Windows profile and sign in with an admin account, since you’ll need admin permissions to access their AppData folders.

1. Go to C:\Users, select the affected user’s folder. Windows will prompt for admin permission — accept it and wait for the folder to load.
2. Enable View hidden items (View tab in File Explorer) so you can see the AppData folder.
3. Navigate to AppData\Local\Packages (i.e. %LocalAppData%\Packages) and locate the folder starting with Microsoft.AAD.BrokerPlugin_. Either rename it or delete the contents inside.
4. Go to AppData\Local\Microsoft\IdentityCache. Rename the numbered subfolder inside (e.g. if it’s named 1, rename it to 1-old).
5. Go to AppData\Local\Microsoft\Office\Licenses and rename the numbered subfolder there the same way (e.g. 5 → 5-old) to clear the Office-specific identity cache.
6. Reboot the machine.
7. Log back in with the user’s own account (not the admin account).
8. Go to Settings > Accounts > Access work or school, click Add account, and re-add the user’s Office 365 account.

Office should now authenticate normally without looping. If it doesn’t resolve immediately, a second reboot after step 8 usually clears any remaining cached prompt state.

Notes

• You don’t need to delete the renamed folders – Windows and Office will regenerate fresh ones automatically. Keeping the -old versions around briefly gives you a fallback if something looks off after the reboot.
• This fix targets local cache corruption specifically. If the loop persists across multiple machines for the same user, the issue is more likely on the Azure AD account side (token revocation, conditional access policy, or MFA state) rather than local cache – worth checking the user’s sign-in logs in Entra ID before repeating this on more machines.

If you liked this post, view more here