How to fix Microsoft Teams error CAA20008 in Windows?

CAA20008 is a sign-in error of the Windows account broker: Teams, Outlook or OneDrive asked it for a token for your work or school account and did not get one. The password is usually fine. Empty the broker's token store and restart first, then reconnect the account.

Facts checked on 15 October 2026. Steps written for The new Microsoft Teams, Outlook and OneDrive sign-in, the Access work or school settings and Internet Options on Windows 11 (25H2 and 26H2) and Windows 10 22H2, read against Microsoft's documentation and Microsoft Q&A answers.

What Microsoft Teams error CAA20008 means

You open Teams, or sign out and back in, and a small window appears instead of your chats. Its heading is Something went wrong. Under Additional problem information it shows Error code: CAA20008.

Teams does not draw this window. It comes from the Web Account Manager, the part of Windows that keeps work, school and personal accounts for apps. Every code that starts with CAA comes from it, which is why Outlook, OneDrive and Word can show the same CAA20008 on the same PC.

What causes error CAA20008, ranked

Microsoft has not published a cause for CAA20008. The order below is our reading of the Microsoft Q&A answers and of what fixes this family of broker errors. It is not a statistic.

How to fix Microsoft Teams error CAA20008 in Windows

Follow the fixes in order and try to sign in after each one. Fix 1 takes five minutes and clears the most common cause. Success looks the same every time: Teams asks for your work or school address, accepts it and opens your chats.

Fix 1. Empty the Windows token store for work and school accounts

5 minutesLow riskEveryone first, and especially when the error started suddenly and the account works in a browser.

CAA20008 comes from the broker that stores your account's tokens. Deleting its cached account files makes Windows fetch fresh ones at the next sign-in, the same step that clears the sister codes CAA2000C and CAA90063.

1. Right-click the Teams icon in the corner of the taskbar and select Quit. Close Outlook, Word, Excel and OneDrive.
2. Open File Explorer, paste this path into the address bar and press Enter:

   %LOCALAPPDATA%\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\AC\TokenBroker\Accounts

3. Press Ctrl + A to select all files, right-click the selection and select Delete.
4. If Windows says a file is in use, restart the PC and delete the files before you open any app.
5. Restart the PC.
6. Open Teams and sign in with your work or school address.

The files hold the broker's cached account data, not your chats, mail or documents. Windows rebuilds them at the next sign-in, so every Microsoft 365 app asks for your account once. If the Accounts folder is empty or missing, nothing is cached there: go to Fix 2.

Fix 2. Remove saved Office credentials and reconnect the work or school account

10 minutesRead the warningThe error began after a password change or a sign-out, or Fix 1 helped only until the next restart.

In the Microsoft Q&A report, CAA20008 appeared on several devices right after users signed out and in again with their institution's login. A fresh connection replaces the saved account data that the broker can no longer use.

1. In Teams, select your profile picture and select Sign out. Quit Teams and close Outlook, Word and OneDrive.
2. Select Start, type credential manager and open Credential Manager. Select Windows Credentials.
3. For every entry that starts with MicrosoftOffice16, select the arrow next to it and select Remove.
4. Restart the PC, open Teams and sign in. If CAA20008 is gone, stop here.
5. Press Win + I and open Accounts > Access work or school.
6. Select your work or school account and select Disconnect. Confirm, then restart the PC.
7. Go back to Access work or school, select Connect, sign in with your work or school address and open Teams again.

Fix 3. Register the Windows sign-in plug-in again

5 minutesLow riskTeams, Outlook and Word all fail to sign in with CAA codes, or the token store in Fix 1 was missing.

The broker for work and school accounts is a Windows package, Microsoft.AAD.BrokerPlugin. Microsoft's command registers it again when it is missing, which restores the part of Windows that returns CAA20008.

1. Stay signed in to Windows as the person who gets the error.
2. Right-click Start and open Terminal (Admin) or Windows PowerShell (Admin). Select Yes in the User Account Control prompt.
3. Run this command:

   if (-not (Get-AppxPackage Microsoft.AAD.BrokerPlugin)) { Add-AppxPackage -Register "$env:windir\SystemApps\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Appxmanifest.xml" -DisableDevelopmentMode -ForceApplicationShutdown } Get-AppxPackage Microsoft.AAD.BrokerPlugin

4. Check the result: a block of package details means the plug-in is present. Red text means it did not work; copy it for IT.
5. Restart the PC and sign in to Teams again.

The command registers the package only when it is missing and then prints its details, so on a healthy PC it changes nothing. The same check is explained for another Teams code in our guide to Teams error CAA90063.

Fix 4. Check the clock, TLS 1.2 and Windows updates

15 to 30 minutesLow riskThe PC is old, was off for a long time, shows the wrong time, or a tweak tool or security program changed network settings.

A Microsoft Community moderator answered a CAA20008 report by sending the user to Internet Options: turn on TLS 1.2 and 1.3, turn off SSL 3.0, TLS 1.0 and 1.1, and restore the advanced settings. A clock that is far off breaks the secure exchange too.

1. Check the date, time and time zone in the corner of the taskbar. If they are wrong, turn on automatic time: How to fix the date and time in Windows.
2. Press Win + R, type inetcpl.cpl and press Enter. Open the Advanced tab.
3. Scroll to Security. Tick Use TLS 1.2 and, where it is listed, Use TLS 1.3. Untick Use SSL 3.0, Use TLS 1.0 and Use TLS 1.1.
4. Select Restore advanced settings, check that Use TLS 1.2 is still ticked and select OK.
5. Select Start, type check for updates and open Check for updates.
6. Select Check for updates, install everything offered, including optional quality updates, and restart.

On Windows 10 and 11, TLS 1.2 is on by default, so this step matters mainly when a policy or a tool turned it off. Windows 10 left support on 14 October 2025: without Extended Security Updates, its sign-in parts get no more fixes.

Fix 5. Update Teams and sign in again

5 minutesLow riskOnly Teams shows CAA20008 while Outlook and OneDrive sign in, or Teams has not updated for a long time.

Microsoft's own steps for every Teams sign-in error start with the latest Teams update. An old client can keep asking the broker for a token in a way the service no longer accepts.

1. If Teams opens past the error, select Settings and more (the three dots) next to your profile picture at the top right.
2. Select Check for updates and wait until Teams says it is up to date or asks to restart.
3. Restart Teams, select your profile picture, select Sign out, then sign in again.
4. If Teams does not open at all, skip to Fix 6: a reset gives you a current copy too.

Fix 6. Repair or reset Teams, then reinstall as a last step

10 minutesLow riskOnly Teams shows CAA20008 and Fix 1 to Fix 5 did not help.

A reset clears the app's own stored sign-in state and cache in one step. Microsoft's steps for Teams sign-in errors end with a clean reinstall, and on the new Teams a reset does most of that without a download.

1. Right-click the Teams icon in the taskbar corner and select Quit.
2. Open Settings > Apps > Installed apps and find Microsoft Teams.
3. Select the three dots next to it and select Advanced options.
4. Select Repair first and try to sign in.
5. If the error stays, go back and select Reset. Teams loses its local settings, while chats and files stay in the cloud.
6. If it still fails, select Uninstall, restart, and install Teams again from Microsoft's Teams download page.

Every screen, with the Windows 10 path: How to repair or reset an app in Windows. The new Teams keeps its cache in %LOCALAPPDATA%\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams, which a reset empties. Classic Teams, if it is still on the PC, keeps its data in %appdata%\Microsoft\Teams, the folder Microsoft says to delete after an uninstall.

If CAA20008 is still there: what to collect and who can fix it

When the PC side is clean and the error stays, the cause is usually in the organisation's settings for your account or device. Collect these details before you contact anyone.

• From the error window: the error code and, if shown, the Correlation ID and Timestamp.
• Windows' own log: right-click Start, open Event Viewer and go to Applications and Services Logs > Microsoft > Windows > AAD > Operational. Note the errors at the time of your sign-in.
• Microsoft's Teams sign-in test: open https://testconnectivity.microsoft.com/tests/TeamsSignin/input, sign in with the affected account, enter the code and select Verify. It checks that the account meets the requirements to sign in to Teams.
• Teams debug logs for a support request: Microsoft asks for them together with the error code shown on the sign-in screen.

For administrators: what to check for CAA20008

CAA20008 is not in Microsoft's table of Teams sign-in codes, so start with the tools Microsoft names for all Teams sign-in errors, then the organisation's federation.

• Teams Sign-in diagnostic in the Microsoft 365 admin center (https://aka.ms/TeamsSignInDiag): enter the user's address and select Run Tests. It needs an administrator account.
• AD FS: a Microsoft Community moderator asks organisations with AD FS to check whether the token-signing certificate expired and to follow Microsoft's steps to renew federation certificates for Microsoft 365. That fits reports of many users and devices failing at once.
• Sign-in logs in Microsoft Entra ID: search by the user, the time and the correlation ID.
• Conditional Access: Microsoft ties the neighbour code 0xCAA20004 to Conditional Access. Check the policies that apply to the user and device.
• Device state: run dsregcmd /status on the PC and check the join and token fields before you change the registration.

How to keep CAA20008 from coming back

Once the broker has clean data for your account, the error does not return on its own. It comes back when that data and the account drift apart.

• After a password change, lock and unlock Windows with the new password while online, before you open Teams or Outlook.
• Remove accounts you no longer use under Access work or school, after asking IT on a managed PC.
• Keep automatic time on and leave Use TLS 1.2 ticked.
• Keep Windows and Teams updated. Fixes for the broker arrive through Windows updates.
• Do not use registry tweak tools that turn off protocols or Windows components to speed up the PC.

Frequently asked questions

What does error code CAA20008 mean in Teams?

It means the Windows Web Account Manager, the broker that keeps work and school accounts for apps, could not get a token for your account. The window says Something went wrong and We couldn't sign you in, and asks you to contact your administrator. Microsoft does not list the code in its public table of Teams sign-in errors. Clearing the broker's stored account data in Fix 1 is the first step.

Is CAA20008 a problem with my account or my PC?

Usually the PC. If you can sign in with the same account at office.com or teams.microsoft.com in a browser, the account and password are fine and the stored copy on Windows is the problem. Work through Fix 1 to Fix 4. If the browser fails too, or colleagues get the same code at the same time, the cause is the account or the organisation's settings, and only IT can change those.

Why does OneDrive or Outlook show CAA20008 too?

Because the error does not come from Teams. OneDrive, Outlook, Word and Teams all ask the same Windows broker for the work or school account, so one damaged entry breaks all of them. In a Microsoft Q&A thread from a OneDrive user, more than 300 people marked the same question. The fixes are the same: Fix 1 and Fix 2 repair the shared account data for every app at once.

Does turning on TLS 1.2 fix CAA20008?

Sometimes. A Microsoft Community moderator answered a CAA20008 report by asking the user to turn on TLS 1.2 and 1.3 and turn off SSL 3.0, TLS 1.0 and 1.1 in Internet Options, then restore the advanced settings. On Windows 10 22H2 and Windows 11, TLS 1.2 is on by default. If it is already ticked, the stored account data in Fix 1 and Fix 2 is the likelier cause.

Why did CAA20008 start after I signed out and back in?

Signing out drops the token the broker had, so the next sign-in needs a new one. If the stored account data is stale, or the organisation's sign-in service refuses to issue a token, the new request fails with CAA20008. One Microsoft Q&A report describes exactly this on several devices of an organisation with institutional single sign-on. Start with Fix 1 on one PC; if many users are hit, IT should check the federation certificate.

Is CAA20008 the same as CAA2000C?

No, but they are close relatives. Both come from the Windows account broker, show the same Something went wrong window and respond to the same first fixes: the token store, the work or school connection and TLS 1.2. Microsoft has not published what separates them. If your window says CAA2000C, our guide to sign in error CAA2000C covers that code and the Microsoft Store case.

Is it safe to delete the files in the TokenBroker folder?

Yes, for the Accounts folder that Fix 1 empties. It holds the broker's cached account data, not chats, mail or documents, and Windows builds it again at the next sign-in. The cost is that Teams, Outlook and the other Microsoft 365 apps ask for your account once more. Do not delete the whole Packages folder: it holds the data of every Store app on the PC.

Will reinstalling Teams fix CAA20008?

Rarely on its own. The error comes from the Windows broker, not from Teams, and the same code appears in Outlook and OneDrive. Microsoft's steps for Teams sign-in errors do end with a clean reinstall, which is why Fix 6 resets and then reinstalls Teams. Start with Fix 1 and Fix 2, which change the account data that the error is about.

Should I run dsregcmd /leave and dsregcmd /join?

No, not on your own. On a PC joined to Microsoft Entra ID, dsregcmd /leave removes the device from the organisation, which can cut you off from company apps, files and Wi-Fi. The /join switch does not reliably register it again from a user's command line. If IT suspects the device registration, they can check it with dsregcmd /status and re-register the PC in a controlled way.

Can I see CAA20008 on a Mac?

The code itself comes from the Windows broker, so the fixes on this page are for Windows. In one Microsoft Q&A report, an organisation saw sign-in failures on Windows PCs and Macs at the same time after users signed out and in. When both systems fail together, the cause is almost always on the organisation's side, such as an expired federation certificate, and IT should check it first.