How to fix Microsoft Teams error 0xcaa80000 in Windows?

0xCAA80000 is a network error of the Windows sign-in broker: Teams, Outlook or OneDrive asked it for your account, and it could not reach login.microsoftonline.com. The window says We can't connect you even though the internet works. Test the sign-in address in Edge and on a phone hotspot first, then remove the proxy, filter or setting that stands in the way.

Facts checked on 14 October 2026. Steps written for the new Microsoft Teams, Outlook, OneDrive and the Microsoft 365 apps on Windows 11 (25H2 and 26H2) and Windows 10 22H2, read against Microsoft's documentation.

What 0xCAA80000 means in Teams, Outlook and OneDrive

You type your work address into Teams and, instead of the password field, a small Microsoft window opens with the heading We can't connect you. The text says Microsoft cannot connect to one of its services and asks you to try again later or to contact your helpdesk. Under it stand the code 0xCAA80000 and, in many reports, the server name login.microsoftonline.com.

That window does not belong to Teams. It is drawn by the Web Account Manager, the part of Windows that keeps your work and personal accounts for apps. Teams, Outlook, OneDrive and the Office apps all ask it for a sign-in token. When the broker cannot open a connection to Microsoft's sign-in service, it gives up with this code, and every app that asked shows the same window.

Where 0xCAA80000 sits in the 0xCAA family of sign-in codes

Codes that start with 0xCAA come from the Teams and Microsoft 365 sign-in. Microsoft Support lists several of them for Teams, and Microsoft Learn lists more. The table shows where 0xCAA80000 belongs and which neighbours it is often confused with.

• The engineer's reading. On the MSAL.NET issue tracker, a Microsoft identity engineer wrote that any broker error of the AA3, AA7 and AA8 groups, naming 0xCAA70004, 0xCAA70007, 0xCAA3012C and 0xCAA80000, corresponds to a network environment configuration issue.
• The decimal number. The same answer says that error 3400007680 corresponds to 0xCAA80000. Apps that log through MSAL print it as NoNetwork with "Possible cause: no Internet connection", even when the connection is fine.
• Microsoft's archived article. Microsoft 365 Apps activation error codes 0xCAA70007 and 0xCAA80000 is now under Previous versions on Microsoft Learn. Its steps are still the most complete official list for this code.

0xCAA80000 in Teams, Outlook, OneDrive and Office activation

Because the broker serves every Microsoft 365 app, the code turns up wherever an app needs your account. Where it shows up tells you a little about the cause, and what still works tells you where to look.

What causes error 0xCAA80000, ranked by how often it is reported

Microsoft's articles and the engineer's answer agree that the cause is in the network path, not in Teams. The order below is our reading of the reports and of Microsoft's troubleshooting steps. It is not a statistic.

How to fix error 0xCAA80000 in Teams on Windows

Start with the two tests of Fix 1: they cost nothing and tell you whether the network, this PC or the account data is at fault. Then follow the fixes in order and try to sign in to Teams after each one. Success looks the same every time: the window asks for your password instead of showing We can't connect you.

Fix 1. Test the sign-in address in Edge and on another network

5 minutesNo riskEveryone, first. It changes nothing and tells you which fix comes next.

Microsoft's own triage for broker network errors starts here: open the main sign-in address in Edge, normally and InPrivate. A second network then shows whether the block sits in your usual network or on this PC.

1. Quit Teams: right-click the Teams icon in the corner of the taskbar and select Quit.
2. Open Microsoft Edge and go to https://login.microsoftonline.com. You should land on the Microsoft 365 start page or your organisation's sign-in page.
3. Press Ctrl + Shift + N for an InPrivate window, open the same address and sign in with your work or school account.
4. If either page fails, note the message. The block is on the network or in a proxy for the whole PC: go to Fix 2.
5. If both pages work, disconnect any VPN and connect the PC to a phone hotspot.
6. Start Teams and sign in again on the hotspot.
7. Switch back to your usual network and reconnect the VPN, whatever the result.

Use Edge for the test. Microsoft points out that Internet Explorer had a different network stack, so it did not show what Windows apps see. A sign-in that works on the hotspot is not a fix, but it is the strongest evidence you can give IT.

Fix 2. Remove a proxy that only Windows apps use

10 minutesLow riskEdge fails to open the address, or Teams works on the hotspot and fails on your usual network.

Windows has more than one proxy setting, and the sign-in components can use one that your browser ignores. Microsoft's article on 0xCAA80000 sends users to the WinHTTP proxy first, and Microsoft Support names a misconfigured proxy as the usual reason for the neighbouring code 0xCAA70004.

1. Open Settings > Network & internet > Proxy. Under Manual proxy setup, check Use a proxy server. In Windows 10 the switch is on the same Proxy page.
2. If a manual proxy is on and nobody set it on purpose, note the address and switch it off.
3. Press Win + R, type inetcpl.cpl and press Enter. On the Connections tab select LAN settings and check Use a proxy server for your LAN.
4. Right-click Start and open Terminal (Admin), or Command Prompt as administrator. Select Yes in the prompt.
5. Show the WinHTTP proxy, the setting that Windows services use:

   netsh winhttp show proxy

6. If it lists a proxy server that you do not know, and you are not on a company network, reset it to direct access:

   netsh winhttp reset proxy

7. Restart the PC and sign in to Teams.

netsh winhttp reset proxy returns the WinHTTP setting to Direct access (no proxy server). Microsoft now marks show proxy as deprecated in favour of netsh winhttp show advproxy. Both print the current setting where they are available. On a company network that needs a proxy, Microsoft's article gives netsh winhttp set proxy with the proxy address, plus an allow list of Microsoft 365 addresses.

Fix 3. Let the sign-in broker through security software and VPN filters

10 minutesLow riskThe error began after a VPN, antivirus or web filter was installed or updated, or Fix 1 pointed at this PC.

Microsoft names the two processes that fetch sign-in tokens and says that a local firewall, antivirus or Windows Defender must not block them. When they are blocked, Windows reports a network error even though the browser works.

Sign-in broker

C:\Windows\SystemApps\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Microsoft.AAD.BrokerPlugin.exe

Background task host

C:\Windows\System32\backgroundTaskHost.exe

Main destination

https://login.microsoftonline.com

1. Disconnect the VPN and quit its app completely from the taskbar corner.
2. Pause Microsoft Defender real-time protection for one attempt. Step by step: Turn off Microsoft Defender protection for a moment.
3. If you use another antivirus or a web protection tool, pause its web shield or HTTPS scanning in the same way.
4. Start Teams and try the sign-in once.
5. Turn the protection, the web shield and the VPN back on, whatever the result.
6. If the sign-in worked, add the two processes above and login.microsoftonline.com to that program's exceptions, or ask its maker or your IT department to do it.

A paused antivirus is a test, not a fix. Microsoft also notes that login.microsoftonline.com covers many IP addresses and services. A filter that blocks only some of them causes problems that come and go and hit some devices while others work.

Fix 4. Reset Winsock, TCP/IP and the DNS cache

10 minutes plus a restartLow riskOther Windows apps also fail to sign in, or the network settings were changed by a VPN or tuning tool.

Microsoft's 0xCAA80000 article lists netsh int ip reset and netsh winsock reset among its fixes. Both return the network components that the broker uses to their defaults, which removes entries that a VPN or filter left behind.

1. Open an elevated command window. Right-click Start and select Terminal (Admin), or type cmd in the search box, right-click Command Prompt and select Run as administrator. Select Yes when Windows asks for permission.

   

2. Flush the DNS cache. Type the command below and press Enter. Windows forgets the website addresses it looked up earlier and asks for them again.

   ipconfig /flushdns

3. Reset Winsock. Type the command below and press Enter. It returns the Windows sockets catalog to its default state.

   netsh winsock reset

   

4. Reset TCP/IP. Type the command below and press Enter. If you entered an IP address or DNS server by hand, note it first: you may need to enter it again.

   netsh int ip reset

5. Get a new IP address. Run these two commands one after the other. The connection drops for a moment between them.

   ipconfig /release
   ipconfig /renew

6. Restart the PC. Restart Windows so the Winsock and TCP/IP resets take effect, then test the connection. If it still does not work, continue with the network reset below.

These steps were written for Windows 11 24H2 and later. The full page with the other versions and what each result means: Reset the network and flush DNS

Every command, with the full network reset as the last step: Reset the network and flush DNS. Note any fixed IP address or DNS server before netsh int ip reset, because you may need to enter it again.

1. If the reset did not help, test IPv6. Microsoft's article turns it off for one try: press Win + R, type ncpa.cpl and press Enter.
2. Right-click your network connection and select Properties.
3. Clear Internet Protocol Version 6 (TCP/IPv6), select OK and try the Teams sign-in.
4. Tick Internet Protocol Version 6 (TCP/IPv6) again afterwards, whatever the result.

Fix 5. Start the network services that tell Windows it is online

5 minutesLow riskThe network icon shows No internet while pages open, or a service tool or tuning program changed services.

The broker trusts Windows' own idea of whether the PC is online. Microsoft's 0xCAA80000 article lists four services that must run and adds a connectivity probe that an administrator may have switched off.

1. Press Win + R, type services.msc and press Enter.
2. Find Network Connected Devices Auto-Setup and check that its status is Running.
3. Do the same for Network List Service, Network Location Awareness and Windows Event Log.
4. If one is stopped, right-click it and select Start.
5. Restart the PC and sign in to Teams.

More on the Services window and startup types: Check and restart Windows services. If a service will not start, Microsoft's article runs sfc /scannow from an elevated Command Prompt. If the services run but the icon still says No internet, the connectivity probe may be off by policy. That setting is described for administrators after the fixes.

Fix 6. Check that TLS 1.2 is on and the clock is right

5 minutesLow riskA PC that was hardened by hand or by a tool, an old Windows build, or a PC that was off for a long time.

Microsoft 365 no longer accepts TLS 1.0 and 1.1, and Microsoft's 0xCAA80000 article tells you to tick TLS 1.2 in Internet Options. A clock that is far off breaks secure connections in the same way.

1. Press Win + R, type inetcpl.cpl and press Enter.
2. Open the Advanced tab and scroll to the end of the Security group.
3. Make sure Use TLS 1.2 is ticked. Leave Use TLS 1.3 ticked if it is there.
4. Select Apply and OK, then restart the PC.
5. Check the date, time and time zone in the corner of the taskbar. If they are wrong, turn on automatic time: How to fix the date and time in Windows.

Do not tick SSL 3.0, TLS 1.0 or TLS 1.1 to make the error go away. Microsoft 365 refuses those protocols anyway. On Windows 7 and 8.1 Microsoft needed an update to make TLS 1.2 the default, but Microsoft 365 Apps are not supported there any more.

Fix 7. Remove stored Office credentials and reset Teams

15 minutesLow riskOnly one account fails, or the error stayed after an account move, a mailbox migration or an Office upgrade.

Microsoft's 0xCAA80000 article ends with this step: remove the Office entries from Credential Manager and disconnect an extra work account. A reset of new Teams also clears its own copy of the sign-in state.

1. Quit Teams from the taskbar corner and close Outlook, Word, Excel and OneDrive.
2. Select Start, type credential manager and open Credential Manager. Select Windows Credentials.
3. For every entry that starts with MicrosoftOffice16, select the arrow next to it and select Remove.
4. Open Settings > Accounts > Access work or school. If the account you use for Teams is listed but is not the account you sign in to Windows with, select it and select Disconnect.
5. Open Settings > Apps > Installed apps, select the three dots next to Microsoft Teams and select Advanced options.
6. Under Reset, select Reset. Teams loses its local settings, while chats and files stay in the cloud.
7. Restart the PC, start Teams and sign in.

Every screen of the reset, with the Windows 10 path: How to repair or reset an app in Windows. If the window that comes back is no longer We can't connect you but Something went wrong with a tag such as 7ita9, the network is fixed and the stored account is the problem. Our guide to Teams error tag 7ita9 clears the deeper account caches.

Fix 8. Update Windows, Teams and Microsoft 365

15 to 30 minutesLow riskThe PC has not installed updates for weeks, or Office came from an old installer.

The broker is part of Windows, and Microsoft has shipped fixes for it through Windows and Office updates. Microsoft's 0xCAA80000 article includes both updates, and its Teams sign-in article asks for the latest Teams client.

1. Select Start, type check for updates and open Check for updates.
2. Select Check for updates, install everything offered and restart.
3. Open Word, select File > Account > Update Options > Update Now.
4. Start Teams. If it opens, select Settings and more, the three dots next to your picture, and select Check for updates.
5. Sign in to Teams once more after the updates.

Windows 10 left support on 14 October 2025. A Windows 10 PC without Extended Security Updates no longer gets fixes for its sign-in components, so a move to Windows 11 is the lasting answer there.

If 0xCAA80000 is still there: where the real cause is written

Windows records every failed broker request in its own log. Microsoft describes how to read it, and the entries show whether the request ever reached Microsoft.

1. Right-click Start and open Event Viewer.
2. Go to Applications and Services Logs > Microsoft > Windows > AAD > Operational.
3. Look for errors at the time of your sign-in that mention XMLHTTPWebRequest.
4. Note the code. Microsoft's pattern for network failures is 0x?AA7????, 0x?AA8????, 0x?AA3????, 0x102 or 0x80070102.
5. Compare the time with the moment you were online. An error right after waking from sleep is a dropped Wi-Fi, not this problem.

• For IT or Microsoft support: the full text of the window with the server name, the time, the result of the two tests in Fix 1, and the AAD entries above.
• Teams logs: press Ctrl + Alt + Shift + 1 in Teams if it opens, or right-click the Teams icon in the taskbar corner and select Collect support files. The files go to Downloads.
• Microsoft's checks: the Teams Sign-in test of the Microsoft Remote Connectivity Analyzer, the Teams Sign-in diagnostic in the Microsoft 365 admin center, and the Microsoft 365 sign-in troubleshooter in the Get Help app.

For administrators: proxy rules, the connectivity probe and unsupported workarounds

When several users see 0xCAA80000 on the same network, the fix is on the network side. Microsoft's archived article and the identity engineer's answer give these checks.

• Allow the sign-in endpoints. Microsoft lists login.microsoftonline.com, login.microsoft.com, login.windows.net, aadcdn.msauth.net, aadcdn.msauthimages.net, enterpriseregistration.windows.net and the certificate revocation addresses under crl.microsoft.com. The full set is in Microsoft 365 URLs and IP address ranges.
• Allow the agent. Microsoft suggests an explicit allow rule that contains MSOIDCRL in the firewall or proxy for agents, placed before broader deny rules.
• Set WinHTTP where a proxy is required. netsh winhttp set proxy with your proxy address, or a PAC file that lets Microsoft 365 bypass the proxy.
• Check HTTPS inspection. Microsoft Support names traffic inspection tools that do not decrypt HTTPS correctly as a cause of 0xCAA70004, the same group as 0xCAA80000.
• Loopback for broker apps. The identity engineer noted that with Zscaler, loopback connections are not allowed for UWP apps by default and need exemptions.
• Token binding keys. The same answer says to open the files in %LOCALAPPDATA%\Packages\microsoft.aad.brokerplugin_cw5n1h2txyewy\AC\Microsoft\Crypto\TokenBindingKeys\Keys with a binary editor and delete any that contain only zeroes.

Old threads fix 0xCAA80000 by setting EnableADAL = 0 and DisableADALatopWAMOverride = 1 or DisableAADWAM = 1 under the Office Identity key. Microsoft's article says it does not support disabling ADAL or WAM to solve sign-in problems: it puts Office into a legacy state, and some security features work only through WAM.

How to keep 0xCAA80000 from coming back

Once the broker has a clear path to Microsoft, the error does not return on its own. It comes back when something new sits in that path. These habits keep it open.

• Give security tools an exception, not a pause. Allow Microsoft.AAD.BrokerPlugin.exe, backgroundTaskHost.exe and login.microsoftonline.com in antivirus, web shields and VPN filters.
• Do not leave test proxies behind. Debugging proxies and old VPN clients can leave a WinHTTP proxy that only Windows apps use. Check netsh winhttp show proxy after you remove one.
• Leave TLS 1.2 on. Tools that harden Windows by switching protocols off can break every Microsoft 365 sign-in.
• Keep automatic time on. Secure connections fail when the clock is far off.
• Keep Windows, Office and Teams updated. Fixes for the broker arrive through Windows and Office updates.
• After a network change at work, test early. A new proxy or firewall rule shows up as 0xCAA80000 on the first sign-in, so tell IT the same day.

Frequently asked questions

What does error 0xCAA80000 mean?

It means that the Windows sign-in broker could not reach Microsoft's sign-in service when an app such as Teams, Outlook or OneDrive asked for your account. A Microsoft identity engineer described the decimal form, 3400007680, as the broker error NoNetwork, "An unknown Internet error has occurred", and placed the code among network configuration issues. In practice a proxy, firewall, filter, VPN or damaged network setting stands between the broker and Microsoft, while the browser may still work. Fix 1 on this page finds out which.

Why does Teams say We can't connect you when my internet works?

Because Teams does not sign in through your browser. It asks a Windows component, the Web Account Manager, which runs its own processes and uses the Windows network settings. A proxy that only Windows apps read, a security program that filters those processes, or a company filter can stop the broker while web pages open normally. That is why Microsoft's triage tests login.microsoftonline.com in Edge and then looks at the broker processes and the proxy, not at your connection speed.

What does login.microsoftonline.com mean under the 0xCAA80000 code?

It is the address the broker tried to reach and could not. login.microsoftonline.com is Microsoft's main sign-in address for work and school accounts. Microsoft notes that this one name covers many IP addresses and services, so a filter that blocks only some of them can cause errors that come and go and affect only some devices. Open the address in Edge as in Fix 1. If it fails there too, the whole PC is blocked. If it opens, the block applies only to the broker's path.

How do I fix 0xCAA80000 in OneDrive?

The same way as in Teams, because OneDrive asks the same Windows broker for your account. Test the sign-in address in Edge and try OneDrive on a phone hotspot (Fix 1), then check the WinHTTP proxy (Fix 2) and any security software that filters the broker processes (Fix 3). If OneDrive and Teams both fail, fix the network path once and both recover. Clearing the OneDrive app alone rarely helps, because its sign-in goes through the broker and not through OneDrive itself.

Why do I get 0xCAA80000 in Outlook?

Outlook uses the same broker for Microsoft 365 mailboxes, so a blocked network path shows up there as well. Older Outlook builds show the text You'll need the internet for this with the code. Reports include one mailbox of several failing, an account lost after a migration to Microsoft 365, and new Outlook refusing a second account. Run Fix 1 to Fix 3 first. If only one mailbox fails while others work on the same PC, also clear the stored credentials in Fix 7.

Is Microsoft down when I see 0xCAA80000?

Rarely. The code comes from your side of the connection: the broker on your PC could not complete the request. If Microsoft's service had an outage, Outlook on the web and Teams on the web would usually fail as well. Sign in at teams.microsoft.com in a browser and ask a colleague on another network. If both work, the problem is on your PC or your network. Your administrator can see Microsoft's own service status in the Microsoft 365 admin center.

Will reinstalling Teams fix 0xCAA80000?

Usually not. The sign-in window, its network path and the stored accounts belong to Windows, not to Teams. In the reports we read, users who reinstalled Teams or cleared its old folder still got the same code, and one user who switched between classic and new Teams saw it only in the new one. A Teams reset is part of Fix 7 because it clears Teams' own sign-in state. It helps after the network path is clear, not before.

Should I turn on TLS 1.0 and TLS 1.1 to fix 0xCAA80000?

No. Microsoft has deprecated TLS 1.0 and 1.1 in Microsoft 365, so turning them on does not help the sign-in and only weakens security. What matters is that TLS 1.2 is on. Microsoft's article asks for an update only on Windows 8.1 and older, where TLS 1.2 was not the default, and otherwise just to check the Use TLS 1.2 box in Internet Options. One user reported that ticking TLS options made no difference, which fits: on a current PC TLS is rarely the cause.

What is erro 0xcaa80000?

It is the same error searched in Portuguese or Spanish, where erro and error mean error. The window then appears in your Windows language, but the code 0xCAA80000 and the server name stay the same, so you can match it by the code alone. The French Message erreur 0xCAA80000 and the Russian Невозможно подключиться with the same code are the same error too. The fixes on this page apply unchanged, and the menu names in Windows appear in your language.

Why do I see 0xCAA80000 when activating Office?

Activation needs the same sign-in, so the broker's network error stops it as well. Microsoft documents 0xCAA80000 with 0xCAA70007 as an activation error with the message We are unable to connect right now. Its steps match this page: TLS 1.2, updates, the proxy, the firewall, a Winsock reset, network services and stored credentials. In one report the error followed a move from Office 2013 to Microsoft 365, and a Microsoft moderator suggested the activation troubleshooter and removing old Office 2013 product keys.