How to fix Microsoft 365 activation error "Trusted Platform Module has malfunctioned"?

Office 365 shows Your computer's Trusted Platform Module has malfunctioned when Windows cannot use the key that protects your work or school sign-in. The chip is rarely broken: the key is usually lost or stale. Remove the saved Office credentials and the old work account link first, and clear the TPM only as the last step.

Facts checked on 15 October 2026. Steps written for Microsoft 365 apps on Windows 11 (25H2 and 26H2) and Windows 10 22H2, read against Microsoft's own article on this error and Microsoft's sign-in troubleshooting documentation.

What "Your computer's Trusted Platform Module has malfunctioned" means

The Trusted Platform Module (TPM) is a security chip, or a firmware part of the processor, that holds keys Windows must not lose. When you sign in to Office 365 with a work or school account, Windows ties that sign-in to a device key the TPM guards. Office never talks to the chip itself: it asks Windows for a token, and Windows needs the key to get one.

When that step fails, Office shows a window titled Something went wrong with the sentence Your computer's Trusted Platform Module has malfunctioned. and a code. Under it you may see More information: https://www.microsoft.com/wamerrors, which names Web Account Manager (WAM), the part of Windows that handles the sign-in.

Newer Office builds can show a shorter heading. People search for Device TPM problem and There's a problem with your device's Trusted Platform Module, often from Outlook or Teams. We treat these as the same failure, because they come with the same codes and need the same fixes.

What causes the TPM malfunction error in Office 365, from the most common

Microsoft writes that Windows uses the TPM to protect your credentials, and that the chip may become corrupted or reset in some conditions. Dell describes the most common chain: the TPM was cleared, the protected data was lost, and Azure AD authentication fails. The order below is our reading of Microsoft's and Dell's articles, not a statistic.

Work PC or your own PC: who should run which fix

Microsoft's article notes that some of its fixes can only be done by a Microsoft 365 admin. On a PC your employer or school manages, Fix 1 and Fix 2 are safe for you. Fix 3, Fix 4 and Fix 8 change how the PC is joined to the organisation or touch the chip, so ask IT first.

To see how your PC is joined, open Command Prompt and run dsregcmd /status. Microsoft reads the result like this:

• AzureAdJoined : YES and DomainJoined : YES: a hybrid joined company PC. Recovery belongs to IT.
• AzureAdJoined : YES and DomainJoined : NO: joined to Microsoft Entra ID only. Recovery needs a second local administrator account.
• WorkplaceJoined : YES under User State: a work account added to your own PC. Every fix here is yours to run.

How to fix "Trusted Platform Module has malfunctioned" in Office 365

The fixes are ordered from the cheapest and safest to the ones that touch the chip. Fix 1 and Fix 2 come straight from Microsoft's article on this error and clear what most often holds the old key. After each fix, open the Office app and sign in: when your name stays at the top after a restart, you are done.

Fix 1. Remove the saved Office credentials and the extra work or school account

5 minutesLow riskEveryone, first. Above all when Office keeps asking for your password before the error appears.

Office saves its sign-in in Credential Manager under MicrosoftOffice16, and a work account added in Settings keeps its own link to the device key. If either was made with a key the TPM no longer holds, Office keeps presenting it. Microsoft lists this as one of the first fixes for this error.

1. Close Outlook, Teams, Word and every other Office app.
2. Select Start, type credential manager and open Credential Manager.
3. Select Windows Credentials.
4. For each entry named MicrosoftOffice16, select the arrow next to it and select Remove, then confirm with Yes.
5. Open Settings > Accounts > Access work or school.
6. If the account you use for office.com is listed there and it is not the account you sign in to Windows with, select it and select Disconnect.
7. Restart the PC, open an Office app and sign in.

Fix 2. Delete the TokenBroker account data and run the sign-in troubleshooter

10 minutesLow riskFix 1 did not hold, or every Office app shows the error while office.com works in the browser.

The plug-in Microsoft.AAD.BrokerPlugin keeps its own copies of your accounts and the tokens made with the device key. Microsoft's article for this error deletes them so Windows builds new ones, and notes that antivirus, proxy or firewall software can block the plug-in.

1. Close all Office apps and Teams.
2. Open File Explorer and paste this location into the address bar, then press Enter:

   %LOCALAPPDATA%\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\AC\TokenBroker\Accounts

3. Press Ctrl + A, right-click the selected files and choose Delete.
4. Do the same in the second location:

   %LOCALAPPDATA%\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AC\TokenBroker\Accounts

5. Restart the PC.
6. Run the Microsoft 365 sign-in troubleshooter that Microsoft links from its article (aka.ms/SaRA-OfficeSignIn-sarahome), then sign in to Office.

The address bar opens these folders even though AppData is hidden, so you do not need to show hidden items. The files are rebuilt at the next sign-in. Only saved sign-ins go: no mail, no documents.

Fix 3. Register the device again: disconnect and reconnect the work or school account

15 minutesRead the warningThe error began after the TPM was cleared, a BIOS or firmware update, or a motherboard repair. Code 80090030 or 80090016 that survives Fix 1 and Fix 2.

When the TPM is cleared, the device key is gone and Microsoft Entra ID can no longer accept tokens from this PC. Dell's fix for C0090030 is to disconnect from the Azure domain and connect again. Microsoft's article describes the same, which creates a new key in the TPM.

Run dsregcmd /status first and follow the line that matches your PC. These are Microsoft's recovery steps for a TPM failure.

1. For a work account on your own PC, open Settings > Accounts > Access work or school.
2. Select the work or school connection and select Disconnect, then confirm.
3. Restart the PC and return to Access work or school.
4. Select Connect. On a PC that the organisation should manage, choose Join this device to Microsoft Entra ID (older builds say Azure Active Directory).
5. Enter your work account and password, approve the sign-in, and select Let my organization manage my device if it is offered.
6. Restart and open Office.

Fix 4. Turn on the Office protection policy in the registry

10 minutesRead the warningYour own PC, when Fix 1 to Fix 3 work for a while and then the error returns.

Microsoft's article for this error adds a value named ProtectionPolicy under the Windows data protection provider key. It changes how Windows protects the master keys used for your saved credentials, so they no longer depend on the step that fails.

1. Open Word, select your name at the top and select Sign out, then close Word.
2. In Settings > Accounts > Access work or school, select the account you use for office.com and select Disconnect (only if it is not your Windows sign-in, as in Fix 1).
3. Press Win + R, type regedit and press Enter.
4. Go to this key:

   HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Protect\Providers\df9d8cd0-1501-11d1-8c7a-00c04fc297eb

5. Right-click an empty area on the right, select New > DWORD (32-bit) Value and name it ProtectionPolicy.
6. Double-click ProtectionPolicy, set Value data to 1 and select OK.
7. Restart the PC and sign in to Office again.

To undo it, delete the ProtectionPolicy value and restart. Microsoft gives no more detail on this setting in the article, so use it only when the error keeps coming back.

Fix 5. Reset the Microsoft 365 activation state

15 minutesRead the warningThe error began after a licence change, a reinstall, or a move from one organisation to another.

Office keeps licences and cached identities outside the credential stores, and those can still name the old sign-in. Microsoft's article for this error points to its reset activation state guide, which removes them so Office starts as if never activated.

1. Sign out of every account in File > Account and close all Office apps.
2. Open Microsoft's article Reset activation state for Microsoft 365 Apps for enterprise and download the cleanup scripts it offers, OLicenseCleanup.zip and signoutofwamaccounts.zip.
3. Run OLicenseCleanup.vbs as administrator, then signoutofwamaccounts.ps1 in Windows PowerShell opened as administrator.
4. Restart the PC, open Word and sign in with the licensed account.

Our guide to error tag 4vt9f walks through both scripts and the manual route, including what to do when Smart App Control blocks the script.

Fix 6. Turn on Memory integrity

5 minutesLow riskWindows Security shows Memory integrity as off, and the fixes above did not hold.

Microsoft lists this switch in its article for this error. It turns on a Windows security feature rather than off, so it is safe to keep. If an old driver blocks it, Windows names that driver.

1. Select Start, type Windows Security and open it.
2. Select Device security.
3. Under Core isolation, select Core isolation details.
4. Turn Memory integrity on.
5. Restart the PC and sign in to Office.

Fix 7. Update the BIOS and check that the TPM is active

15 to 30 minutesRead the warningA code that starts with 8028 or 8029, a TPM warning in Windows Security, or the error on several accounts of the same PC.

Microsoft recommends updating the TPM firmware to keep this error from coming back, and the firmware arrives with the BIOS or UEFI update of the PC maker. Microsoft also says to check that the TPM is set to active in the BIOS.

1. Press Win + R, type tpm.msc and press Enter. Under Status, Windows should say The TPM is ready for use.
2. Note the Specification Version under TPM Manufacturer Information. Microsoft recommends TPM 2.0.
3. Open your PC maker's support page (Dell, HP, Lenovo, Microsoft Surface and others) and install the newest BIOS or UEFI update for your model.
4. If tpm.msc says no compatible TPM is found, restart into the BIOS setup and check the Security tab. Microsoft's example presses F1 before Windows loads; your PC maker may use another key. If TPM 1.2 is selected there, the Security Chip must be set to Active.
5. Save, restart and sign in to Office.

Fix 8. Clear the TPM (last resort)

15 minutes plus setupRead the warningOnly your own PC, only after Fix 1 to Fix 7, and only when Windows Security or tpm.msc reports a TPM fault.

Clearing resets the chip to its default state and Windows prepares it again. Microsoft lists it in its article for this error. It also deletes every key the chip holds, which is why it comes last.

1. Open Windows Security and select Device security.
2. Under Security processor, select Security processor details.
3. Select Security processor troubleshooting.
4. Select Clear TPM, then Clear and restart.
5. If the PC asks you to press a key during the restart, do so to confirm.
6. After Windows starts, set up your PIN again, then run Fix 3 so the work account gets a new device key, and sign in to Office.

Clearing alone is not the cure: it is what usually starts this error in the first place. The account must be registered again afterwards, which is why Dell's fix for the same message is to reconnect the work account.

If the TPM error is still there: the log, the test account and what to send

Stop changing things and look at where Windows writes the real reason. Microsoft points to one log for TPM sign-in failures.

1. Press Win + R, type eventvwr.msc and press Enter.
2. Go to Applications and Services Logs > Microsoft > Windows > AAD > Operational.
3. Look for errors at the time of your sign-in with codes like 0x?028????, 0x?029???? or 0x?009????. Microsoft names these as TPM problems.
4. Look for AADSTS135011: Device used during the authentication is disabled or AADSTS50155: Device is not authenticated. Those mean the administrator disabled or deleted the device, and only they can fix it.

• Create the test account: Create a new user account to test a problem. Microsoft suggests a clean boot first: How to perform a clean boot in Windows.
• Send to IT or Microsoft support: the error code, the Correlation ID and Timestamp from the window, the output of dsregcmd /status, and the AAD log entries.
• When it is hardware: TPM errors that return after a clear and a BIOS update point to the chip or the motherboard. Contact the PC maker and use the web apps meanwhile.

How to keep the TPM error from coming back

The error returns when the TPM loses its keys while Windows still expects them. Most prevention is about knowing when that happens.

• Never clear the TPM casually. Do it only as Fix 8 describes, and reconnect the work account straight after.
• After a BIOS update or board repair, expect to sign in again and reconnect the work account. Do Fix 1 and Fix 3 at once if Office complains.
• Keep the BIOS and TPM firmware current. Microsoft recommends it to avoid this exact failure.
• Add a work account to your own PC as "this app only" when Office offers it. Fewer device links mean fewer keys to lose.
• Keep Windows updated. Windows 10 left support on 14 October 2025, so a Windows 10 PC no longer gets security fixes for this layer.

Frequently asked questions

What is a device TPM problem in Office 365?

It is the same failure as "Your computer's Trusted Platform Module has malfunctioned": Office asked Windows for a sign-in token, and Windows could not use the key in the TPM chip that protects your work or school sign-in. The chip is rarely broken. Usually the key is lost or stale after a TPM clear, a BIOS update or a board change. Remove the saved Office credentials and the extra work account first (Fix 1).

What does error code 80090030 mean?

80090030 is the Windows code NTE_DEVICE_NOT_READY: "The device that is required by this cryptographic provider is not ready for use." In the Office window it means the TPM did not answer when Windows needed the key for your sign-in. Office sometimes shows it as C0090030. Start with Fix 1 and Fix 2. If it started after BIOS or TPM work, register the device again with Fix 3.

What is error C0090030 or C0090016?

These are the same codes as 80090030 and 80090016 with a different first digit, as Office shows them in the Something went wrong window. C0090030 points to a TPM that is not ready, and C0090016 to a key that no longer exists. Dell documents C0090030 on its laptops after the TPM was cleared, and fixes it by reconnecting the work account. That is Fix 3 here.

Why does Outlook show the TPM error and keep asking for my password?

Microsoft describes this exact pattern: Outlook prompts for credentials, you enter them, and it prompts again, because the TPM chip or firmware is malfunctioning. Outlook signs in through the same Windows layer as the other Office apps, so the fixes are the same. Remove the saved credentials (Fix 1), clear the TokenBroker data (Fix 2), and look in the AAD log for TPM codes if it continues.

Is it safe to clear the TPM to fix the Office error?

It is safe for Windows, but it deletes every key the chip holds: your Windows Hello PIN, virtual smart cards and the BitLocker TPM protector. Save the BitLocker recovery key first, and never clear it on a work or school PC without IT. Clearing also does not fix Office alone: you must reconnect the work account afterwards. That is why it is Fix 8, the last one.

Can I fix the TPM error without admin rights?

Partly. Fix 1 and Fix 2 only touch your own user profile, and Microsoft's sign-in troubleshooter runs for a normal user. Registering the device again, the registry setting, a BIOS update and clearing the TPM need administrator rights, and on a company PC they belong to IT. Microsoft's article says some of its fixes can only be done by a Microsoft 365 admin.

Does the TPM error mean my computer's chip is broken?

Rarely. Most cases are a lost or stale key, not a dead chip. Signs of real hardware trouble are a TPM warning in Windows Security, tpm.msc not reporting The TPM is ready for use, and TPM errors that return after a firmware update and a clear. Then contact the PC maker. Meanwhile, office.com and Outlook on the web work in the browser, because they do not use the TPM.

Will reinstalling Office fix Trusted Platform Module has malfunctioned?

Usually not. The key that fails lives in Windows and the TPM, not in the Office program files, so a reinstall leaves it where it was. Clear the saved credentials and token data first (Fix 1 and Fix 2), and reset the activation state (Fix 5) if a licence change is involved. Microsoft's last step is a new Windows user account with a fresh Office install, not a reinstall in the old profile.

Does this error also appear in Teams?

Yes. Teams signs in through the same Web Account Manager and device key, so it shows the same device TPM problem with the same codes. The fixes on this page apply unchanged. After Fix 1 and Fix 2, quit Teams from the taskbar corner and start it again so it asks for a fresh sign-in.