How to fix error tag 4vt9f in Microsoft Office apps?

The 4vt9f tag means that a Microsoft 365 app on Windows found a saved sign-in for your account and rejected it: the window shows Something went wrong. [4vt9f] and, in its details, The credential is invalid. Your password is usually fine. Empty the Office sign-in cache first, then remove the saved Office credentials and the old work or school link.

Facts checked on 14 October 2026. Steps written for Microsoft 365 apps and Office on Windows 11 (25H2 and 26H2) and Windows 10 22H2, read against Microsoft's documentation and the 4vt9f reports on Microsoft Q&A.

What Something went wrong [4vt9f] means in Microsoft 365 and Office

You start Outlook or Word, a Microsoft window asks you to sign in, and you do: the address, the password, often the approval on your phone. Then the window turns into Error with the red line Something went wrong. [4vt9f]. Many users stress that the password was right, and they are usually correct.

Microsoft publishes no list of these five-character tags, and we found no Microsoft article that defines 4vt9f. What sets this tag apart is the line in its details: Message: The credential is invalid. The reports on Microsoft Q&A show that this message comes with 4vt9f again and again, and the Code line under it is almost always 0.

Every spelling people type means the same window: 4vt9f error, error 4vt9f, error code 4vt9f, Tag: 4vt9f and [4vt9f]. In other languages only the sentence changes, as in "Se ha producido un error. [4vt9f]" in Spanish or "Ocorreu um erro. [4vt9f]" in Portuguese.

The troubleshooting details: Message, Tag, Code 0 and the 657rx link

Select the details link in the error window, or the arrow next to Troubleshooting details, to see every line. The window offers Copy info to clipboard: use it, and paste the text into a note before you close anything. Each line has a job.

Many 4vt9f reports begin with a different tag. An IT technician on Microsoft Q&A described a business PC that first showed 657rx; after a repair and a reinstall of Office it showed 4vt9f instead. The 657rx window carries Code: 2148073494, which in hexadecimal is 0x80090016. Microsoft's table of security error codes names it NTE_BAD_KEYSET, "Keyset does not exist".

4vt9f in Outlook, Teams, Word and the Copilot app

On Windows the Microsoft 365 apps do not each run their own sign-in. They share an Office identity cache and hand the token request to Web Account Manager (WAM), a part of Windows. One damaged entry can therefore block one app while another, which holds a fresher token, keeps working.

• Classic Outlook: most 4vt9f reports come from classic Outlook, often when an account is added or after a password prompt. A Microsoft Q&A moderator answered such a case, where Teams and Excel were signed in normally, as a problem of cached Outlook authentication data rather than of the account.
• New Outlook: one user found that the new Outlook connected to the same mailboxes without the error. That points at the classic Outlook side: its profile and the Office identity cache.
• Teams: the same window and tag appear at sign-in. Teams also keeps its own app data, so after Fix 1 a Teams reset can be needed. Our guide to Teams error tag 48v35 has those steps.
• Word, Excel, PowerPoint: the tag appears in the activation window after a new install, a licence change or a reinstall, and the apps stay unlicensed.
• Microsoft 365 Copilot app: an administrator reported 4vt9f in the Copilot app on a domain joined Windows 11 laptop. Copilot inside Word and Excel worked. A Microsoft moderator's cache cleanup ended it.

What causes error 4vt9f, from the most common to the rare

Microsoft has not published a cause for this tag. The ranking below comes from the 4vt9f threads on Microsoft Q&A and Spiceworks, the answers of Microsoft's forum staff, and the causes Microsoft documents for sign-in failures in the same Windows layer. Treat the order as our reading of those reports, not as a statistic.

Home PC or managed PC: who may run which fix

Fix 1 only clears data in your own user profile, and Microsoft's forum staff give it to business users as the first step. It is safe on any PC. Fix 2 and Fix 5 change how Windows is connected to an organisation, so on a PC that an employer or a school manages they belong to the administrator.

Not sure whose PC it is? Open Command Prompt and run dsregcmd /status. Microsoft documents the fields: AzureAdJoined : YES or DomainJoined : YES means the organisation owns the device. WorkplaceJoined : YES under User State means a work account was only added to your own PC, and every fix here is yours to run.

How to fix error 4vt9f in Outlook, Teams and Office

The fixes are ordered by how often they end 4vt9f and how little they change. Fix 1 is the one that users and Microsoft's forum staff report most often as the cure, and it is safe on every PC. After each fix open the app that failed and sign in: when the app shows your name and stays signed in, you are done.

Fix 1. Sign out and empty the Office sign-in cache (OneAuth and IdentityCache)

5 minutesLow riskEveryone, first. Above all when only Outlook fails, or the error began after a password change, a reinstall or a 657rx error.

OneAuth and IdentityCache hold the accounts and tokens that Office reuses at sign-in. When one of them no longer matches the account, Office keeps presenting it and Windows keeps calling it invalid. Microsoft documents removing these folders for cached identity errors, and it is the fix most often confirmed in 4vt9f threads.

1. Open Word or any Office app that still starts, go to File > Account and select Sign out. Sign out of every account listed.
2. Close Outlook, Teams, OneDrive and every other Office app. Check the taskbar corner and quit OneDrive and Teams there too.
3. Press Win + R, paste this path and press Enter:

   %localappdata%\Microsoft\OneAuth

4. Select everything inside the folder with Ctrl + A and delete it. It holds the folders accounts and blobs.
5. Press Win + R again, paste the second path and press Enter:

   %localappdata%\Microsoft\IdentityCache

6. Delete everything inside this folder as well.
7. Restart the PC, open the app that failed and sign in with the account that holds the licence.

The folders are rebuilt at the next sign-in, so nothing of value is lost: no mail, no files, only saved sign-ins. A Microsoft moderator gave exactly these three locations to a user whose Outlook showed 4vt9f with The credential is invalid, and another admin wrote that the same cleanup fixed the Copilot app.

Fix 2. Remove the saved Office credentials and reconnect the work or school account

10 minutesLow riskFix 1 did not hold, or the PC has, or once had, a work or school account in Windows Settings.

Windows keeps Office sign-ins in two places that Fix 1 does not touch: Credential Manager and the list under Access work or school. Microsoft's sign-in article for Microsoft 365 Apps clears both, and its forum staff add this step for 4vt9f right after the cache cleanup.

1. Close all Office apps and Teams.
2. Select Start, type credential manager and open Credential Manager.
3. Select Windows Credentials.
4. For each entry named MicrosoftOffice16 (older installs may also show MicrosoftOffice15), select the arrow next to it and select Remove.
5. Open Settings > Accounts > Access work or school.
6. If the account you use for Office is listed, and it is not the account you sign in to Windows with, select it and select Disconnect.
7. Restart the PC.
8. Open an Office app and sign in. If Windows asks whether to use this account everywhere on the device, choose the option for this app only on a PC you own.

A Japanese university's help desk adds a detail worth copying. When it asks whether to sign in to all desktop apps and websites on this device, its users are told to select No, this app only. That keeps the work account out of Windows and avoids the link that this fix had to undo.

Fix 3. Sign in with the account that holds the licence and the mailbox

5 to 15 minutesLow riskThe error began after a licence or mailbox change: a school licence replaced by a bought one, a business plan instead of a family plan, or a mailbox converted to a shared mailbox.

4vt9f says the credential Office used is invalid, not that your password is wrong. When the stored sign-in belongs to an account that lost its licence or can no longer sign in, Office keeps offering it. Microsoft states that a shared mailbox is not meant for direct sign-in.

First find out which account really has the product. Sign in at office.com in a browser with each address you own. The one that shows Microsoft 365 apps to install is the one Office needs. For a business plan, that is the work or school account, not a personal Microsoft account.

1. Open Word and go to File > Account.
2. Under User Information, select Sign out for every account, as in Fix 1.
3. Sign in with the account that holds the licence only.
4. If Product Information offers Switch License, select it and choose the subscription of that account. Users who moved from a school licence to a bought one report that Switch License followed by Update License ended their 4vt9f error.
5. Close Word, open the app that failed and test the sign-in.

On Spiceworks an administrator described exactly this: mailboxes converted to shared, and Outlook on PCs that had held them as normal mailboxes ending every attempt with 4vt9f. Sign-out and account removal in Settings were not enough. Removing the old sign-in data under IdentityCache and OneAuth, among other cleanup, finally let the delegated user set the mailboxes up.

Fix 4. Clear the Web Account Manager accounts and run the sign-in troubleshooter

10 minutesLow riskYour own PC, when Fix 1 to Fix 3 did not hold, or after a 657rx error.

Web Account Manager keeps its own copies of your accounts, apart from the Office cache. Microsoft's sign-in article deletes the account files of both Windows plug-ins and then runs the Microsoft 365 sign-in troubleshooter. A university help desk adds the token broker cache for the same tags.

1. Close all Office apps and Teams.
2. Open File Explorer and put this location in the address bar:

   %LOCALAPPDATA%\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\AC\TokenBroker\Accounts

3. Press Ctrl + A, right-click the selected files and choose Delete.
4. Do the same in the second location:

   %LOCALAPPDATA%\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AC\TokenBroker\Accounts

5. If this folder exists, empty it too:

   %LOCALAPPDATA%\Microsoft\TokenBroker\Cache

6. Restart the PC.
7. Run the Microsoft 365 Sign-in troubleshooter, linked at the top of Microsoft's article Authentication automatically fails in Microsoft 365 services, then sign in to Office.

If that is not enough, Microsoft offers a script. The article Reset activation state for Microsoft 365 Apps for enterprise has the download signoutofwamaccounts.zip. Microsoft says the script signoutofwamaccounts.ps1 clears the WAM accounts associated with Office, runs as administrator and needs Windows 10 version 1803 or later.

1. Download signoutofwamaccounts.zip from that Microsoft article and extract it.
2. Run signoutofwamaccounts.ps1 in Windows PowerShell opened with Run as administrator.
3. Restart, open the app and sign in.

Fix 5. Reset the Office activation and identity data

15 minutesRead the warningYour own PC, after a 657rx error, a licence change or a reinstall that did not help, and when Fix 1 to Fix 4 did not hold.

Office stores licences and cached accounts outside the sign-in caches: in licence folders and in the registry. Microsoft's reset article clears them with OLicenseCleanup.vbs, and a university help desk prescribes it for 4vt9f, 657rx and 1001 alike. Office then starts as if never activated.

1. Sign out of every account in File > Account and close all Office apps.
2. Open Reset activation state for Microsoft 365 Apps for enterprise and download OLicenseCleanup.zip from the section on automating the cleanup with scripts.
3. Extract it and run OLicenseCleanup.vbs with administrator rights. No window confirms the end: the script finishes in the background.
4. If your Windows account is not an administrator, the university help desk runs the script twice: once by double-click as yourself, then again from a Command Prompt started with an administrator account.
5. Restart the PC, open Word and sign in with the licensed account.

The same help desk notes that OLicenseCleanup.vbs cannot run on Windows 11 with Smart App Control turned on. Do not switch that protection off for this. Use the manual route of the same Microsoft article instead: remove the Office licences and the cached identity by hand.

1. Press Win + R, type regedit and press Enter.
2. Go to this key and export it as a backup:

   HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Identity

3. Right-click Identity and select Delete. Microsoft's OneDrive article removes this key when an error is caused by multiple cached identities.
4. Empty these two folders if they exist:

   %localappdata%\Microsoft\Office\Licenses
   %localappdata%\Microsoft\Office\16.0\Licensing

5. Restart the PC and sign in to Office.

Fix 6. Create a new classic Outlook profile (when only Outlook fails)

10 minutesLow riskClassic Outlook shows 4vt9f, while Teams, Word or Excel sign in with the same account.

Classic Outlook keeps the accounts it connects to in a mail profile. A profile built around a changed or converted mailbox keeps asking for that old sign-in. A new profile adds the account from scratch, and Microsoft's forum staff list it for the 4vt9f sync error in classic Outlook.

1. Close Outlook.
2. Press Win + R, type this command and press Enter. Microsoft gives it as one way to open the profile picker:

   Outlook.exe /profiles

3. In the profile picker select Options, then New.
4. Type a name for the new profile and select OK.
5. Add your email account and sign in when asked. For a Microsoft 365 address the sign-in window from Fix 1 appears.
6. Back in the profile picker, select the new profile and start Outlook.

The old profile stays in place until you delete it, so nothing is lost. Microsoft suggests the box Prompt for a profile to be used while you test, so Outlook asks every time which profile to open. When the new one works, delete the old one in Control Panel > Mail > Show Profiles.

Fix 7. Register the Windows account plug-ins again

10 minutesLow riskThe sign-in window is blank, closes at once or hangs, or Fix 1 to Fix 6 changed nothing.

Office signs in through two Windows packages: Microsoft.AAD.BrokerPlugin for work and school accounts and Microsoft.Windows.CloudExperienceHost for personal ones. If one is damaged, the credential it returns can be refused. Microsoft gives the commands that check and register both again.

1. Press Win + R, type powershell and press Enter.
2. Check that both packages exist. Each command should print the details of one package:

   Get-AppxPackage Microsoft.AAD.BrokerPlugin
   Get-AppxPackage Microsoft.Windows.CloudExperienceHost

3. If one is missing or sign-in still fails, register the work and school plug-in again:

   Add-AppxPackage -Register "$env:windir\SystemApps\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Appxmanifest.xml" -DisableDevelopmentMode -ForceApplicationShutdown

4. Then register the plug-in for personal accounts:

   Add-AppxPackage -Register "$env:windir\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\Appxmanifest.xml" -DisableDevelopmentMode -ForceApplicationShutdown

5. Restart the PC and sign in to the Office app.

The full background, with the tests that open each plug-in on its own, is in our guide to error tag 7q6ch, a sister error of the same sign-in layer.

Fix 8. Rule out security software, VPN and proxy

10 minutesLow riskThe error began after you installed or updated an antivirus, a firewall or a VPN, or it depends on the network you use.

Microsoft's sign-in article states that some antivirus, proxy and firewall software blocks the plug-in process Microsoft.AAD.BrokerPlugin, and that a VPN may need to be paused for activation. A Microsoft moderator also suggests a phone hotspot for a 4vt9f sign-in on a personal account.

1. Disconnect the VPN, or switch to another network such as a phone hotspot, and try the Office sign-in again.
2. Pause the antivirus for this one test and try the sign-in once more. Steps for Microsoft Defender: Turn off Microsoft Defender protection for a moment.
3. Turn the protection back on straight after the test, whatever the result.
4. While you are here, check that the PC clock and time zone are set automatically. It costs a minute: How to fix the date and time in Windows.

If the sign-in works with the software paused, do not leave it off. Ask its maker or your administrator to allow Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy. Behind a company proxy, Microsoft lists login.microsoftonline.com among the addresses that Office activation must reach, and opening them is the network administrator's job.

Fix 9. Update Office, then repair it

15 to 40 minutesLow riskNothing above helped, or Office has not been updated for a long time.

An update brings the current sign-in code of Office, and a repair replaces damaged program files. Neither touches the stored credentials that cause most 4vt9f errors, which is why this comes last. Users who reinstalled before clearing the caches report that the tag stayed.

1. Open Word and go to File > Account (Office Account in classic Outlook).
2. Under Product Information select Update Options > Update Now. If you only see Enable Updates, select that first.
3. Wait for the message that updates were installed or that you are up to date.
4. Restart the PC and try to sign in.

Then repair. Start with Quick Repair, which replaces damaged files and needs no internet, and run Online Repair if the tag is still there. Every screen of both on Windows 11: How to repair Microsoft 365 or Office.

If 4vt9f is still there: what to check and what to send

When all fixes fail, stop changing things and narrow the problem down. Three tests tell you whether the fault is the account, your Windows profile or the whole PC.

• The test account in full: Create a new user account to test a problem. Sign in to Office there with the same work or personal address.
• Start Office the normal way. One user reported that Run as administrator got Outlook past 4vt9f. Microsoft states that Run as administrator, Run as different user and elevation tools interfere with sign-in and are not supported in most cases, unless the admin account is your own.
• Sign-in services. In services.msc check that Microsoft Account Sign-in Assistant and Web Account Manager are not Disabled. Manual is their normal startup type. Steps: Check and restart Windows services.
• For support, send the details as text: Correlation Id, Timestamp, DPTI, Message, Tag and Code from the error window, the app, when it started, and whether office.com works.

For administrators: what to check when users report 4vt9f

A user who sends Correlation Id, Timestamp and the message The credential is invalid has given you enough to start. These checks follow Microsoft's documentation, in the order that costs the least time.

1. In the Microsoft admin center confirm that the user has a licence with the desktop apps and, for Outlook, an Exchange Online mailbox. One answer on Microsoft Q&A points at this first whenever Outlook on the web also fails.
2. In the Microsoft Entra admin center open the Sign-in logs and filter by Correlation ID. If no event matches, the attempt failed on the device before it reached the service, which fits a stale local credential.
3. If the address was converted to a shared mailbox, keep its sign-in blocked as Microsoft advises. Give the users delegate access and clear the old sign-in on their PCs with Fix 1 and Fix 6.
4. For a whole team at once, look for a recent change: a password policy, a licence swap, a tenant migration or a new conditional access rule.
5. On virtual desktops check what the profile tool roams. Microsoft says Microsoft 365 credentials must not be roamed, and for non-persistent virtual desktops it points to single sign-on set up by the administrator.

How to keep 4vt9f from coming back

4vt9f returns where the credentials stored on the PC and the real state of the account drift apart again. Most prevention is about not creating that gap.

• Sign out of Office before a licence or account change, not after. That covers a move from a school licence, a new job, or a mailbox about to be converted to a shared one.
• One licensed account per Office. Add other mailboxes to Outlook through your own account and delegate access, not with their own passwords.
• On your own PC, choose "this app only" when a work sign-in offers to manage the whole device.
• Do not reinstall Office as the first answer to a sign-in error. Clear the sign-in data first with Fix 1 and Fix 2.
• Leave Windows services and account plug-ins alone. Tools that trim services or remove built-in packages can break the sign-in layer.
• Keep Office and Windows updated. Windows 10 left support on 14 October 2025, so a Windows 10 PC no longer gets security fixes for this layer.

Frequently asked questions

What does error 4vt9f mean?

It means that a Microsoft 365 app on Windows tried to sign you in with a saved credential and Windows rejected it. The details say so in the line Message: The credential is invalid. Microsoft publishes no definition of the tag. In the reports on Microsoft's forum the account itself is fine, and the stale data sits on the PC: in the Office identity cache, in Credential Manager, in an old work or school link or in the licence data. Fix 1 clears the most common store.

Why does 4vt9f say The credential is invalid when my password is correct?

Because the credential it means is not your typed password. Office stores tokens and account records on the PC and presents them with the sign-in. When one of them belongs to an old session, an old licence or an account that changed, Windows refuses it, even right after a correct password and phone approval. Clearing OneAuth and IdentityCache (Fix 1) and the saved Office credentials (Fix 2) removes those records, so a fresh one is created.

Why does only Outlook show 4vt9f while Teams and Excel work?

Each app can hold its own token in the shared cache, and classic Outlook also has its mail profile. So Outlook can be stuck on a stale entry while Teams and Excel use fresh ones. A Microsoft moderator answered such a case as cached Outlook authentication data. Clear the cache with Fix 1. If Outlook still fails, create a new profile with Fix 6.

What is the connection between 657rx and 4vt9f?

They often appear one after the other. 657rx comes with Code 2148073494, which is 0x80090016, NTE_BAD_KEYSET or "Keyset does not exist" in Microsoft's error table: a key that Windows expects for the sign-in is missing. Users who repaired or reinstalled Office after 657rx then got 4vt9f. Both live in the user profile, so treat them the same way: Fix 1, then Fix 4 and Fix 5.

What does Code 0 under 4vt9f mean?

Nothing useful. Zero means no Windows result code was passed to the error window, so there is nothing to decode, unlike sister tags such as 7q6ch that carry TPM or service codes. For 4vt9f the Message line is the clue. If your window shows a number other than 0, write it down and send it with the other details to your administrator or to Microsoft support.

Will running Outlook as administrator fix 4vt9f?

One user on Microsoft Q&A wrote that it did, but it is not a fix to keep. Microsoft states that Run as administrator, Run as different user and other elevation methods interfere with the authentication of Microsoft 365 apps and are not supported in most scenarios. The exception is when the administrator account is the same account you are signed in with. If elevation seems to help, your normal session holds the stale data, which Fix 1 to Fix 4 remove.

Will reinstalling Office remove error 4vt9f?

Usually not. The credential that 4vt9f rejects lives in your Windows profile, in Credential Manager and in the registry, not in the Office program files. An IT technician on Microsoft Q&A reinstalled Office after a 657rx error and got 4vt9f instead. Clear the stored sign-in data with Fix 1, Fix 2, Fix 4 and Fix 5 first. Update and repair Office once with Fix 9, and reinstall only if a repair fails.

Is "Se ha producido un error. [4vt9f]" or "Ocorreu um erro. [4vt9f]" the same error?

Yes. Office translates the sentence and keeps the tag, so Spanish, Portuguese, French ("erreur 4vt9f") and Japanese users see the same 4vt9f after their own wording. A Japanese national university's help desk lists 4vt9f with 657rx, 1001 and 1200 as one group of sign-in errors. This page is in English, and the steps, paths and commands are the same in every language. Only the menu labels are translated.

Is it safe to delete the OneAuth and IdentityCache folders?

Yes, for the contents. They hold cached accounts and tokens for your Windows user, and Office creates them again at the next sign-in. Your mail, files and settings are elsewhere. Microsoft documents removing these folders for a OneDrive sign-in error caused by cached identities, and its forum staff give them for 4vt9f. Sign out and close all Office apps first. If you want an undo, rename the folders instead of emptying them.