How to fix Office 365 sign-in error 0xcaa70010 in Windows?

0xCAA70010 is a sign-in error of the Windows account broker: Word, Outlook or Teams asked it for your work account, and it could not finish the connection to a sign-in server. The window says We can't connect you. Read the server name under the code and open it in Edge first: it tells you which fix applies.

Facts checked on 15 October 2026. Steps written for Microsoft 365 Apps (Word, Excel, Outlook, Teams) on Windows 11 (25H2 and 26H2) and Windows 10 22H2, read against Microsoft's documentation.

What Office 365 error 0xCAA70010 means

You open Word or Outlook, enter your work address, and instead of the password page a small window says We can't connect you. It asks you to try again later or to contact your helpdesk. Under the text stand the code 0xCAA70010 and a server name.

The window does not come from Office. It is drawn by the Web Account Manager, the part of Windows that holds work and school accounts for apps. Microsoft says Office has used it for sign-in since build 16.0.7967. When the broker cannot finish its connection to a sign-in server, every Office app that asked shows the same window.

0xCAA70010, 0xCAA70004 and the other 0xCAA7 sign-in codes

Microsoft's article on Office sign-in connection issues tells you to look in the AAD log for codes of the pattern 0x?AA7????, 0x?AA8???? and 0x?AA3????. It treats all of them as connection failures, even when the rest of the network works. 0xCAA70010 belongs to that group.

We could not find a Microsoft page that gives 0xCAA70010 its own name or text. What is known comes from the group pattern, from Microsoft's checks for the group, and from administrators who found the cause in their own setup.

What causes error 0xCAA70010, ranked

The order below is our reading of the reports and of Microsoft's checks for this group. It is not a statistic. Each cause points at the fix that tests it.

How to fix Office 365 sign-in error 0xCAA70010 in Windows

Start with Fix 1. It changes nothing and tells you whether the cause is a certificate, the network or this PC. Then go to the fix it points at and try the sign-in after each one. Success looks the same every time: the password page appears instead of We can't connect you.

Fix 1. Open the server under the code in Edge and try another network

5 minutesNo riskEveryone, first. It changes nothing and decides the next fix.

Microsoft's own check for broker connection errors is to open login.microsoftonline.com in Edge, normally and InPrivate. With 0xCAA70010 the window also names the server it failed on, so you can test exactly that one.

1. Write down the server name under 0xCAA70010 and close the Office apps.
2. Open Microsoft Edge and go to https://login.microsoftonline.com. You should land on the Microsoft 365 start page or your organisation's sign-in page.
3. Press Ctrl + Shift + N for an InPrivate window, open the same address and sign in with your work account.
4. If the code showed another server, such as sts.company.com, open https:// plus that name in Edge too.
5. Note what you see: a certificate warning such as Your connection isn't private, a page that does not open, or a normal page.
6. If every page opened, disconnect any VPN, connect to a phone hotspot and start Word again.
7. Return to your usual network and reconnect the VPN, whatever the result.

Use Edge, not an old browser. Microsoft notes that Internet Explorer used a different network stack. A sign-in that works on the hotspot is not a fix, but it shows IT that the usual network blocks the broker.

Fix 2. Make the PC trust the sign-in server: clock, root certificates and IT

10 minutesLow riskEdge showed a certificate warning, or a company server such as sts. stands under the code.

An administrator traced 0xCAA70010 to an AD FS server whose certificate the PC did not trust. He named an outdated list of trusted certificates and an expired certificate as the other causes. A wrong clock makes valid certificates look invalid too.

1. Check the date, time and time zone in the corner of the taskbar.
2. If they are wrong, turn on automatic time and sync. Step by step: How to fix the date and time in Windows.
3. Select Start, type check for updates and open Check for updates. Install everything offered and restart. Windows Update also refreshes the trusted root certificates.
4. Open the server address from Fix 1 in Edge again.
5. If the warning is still there, select the warning icon next to the address and open the certificate details. Note the Issued by name and the Valid to date.
6. Send the server name, the warning text and these two details to IT. Do not install a certificate from an unknown source yourself.

Fix 3. Remove a proxy that only Windows apps use

10 minutesLow riskThe server did not open in Edge, or Office signs in on the hotspot only.

Windows keeps more than one proxy setting, and the broker can use one your browser ignores. Microsoft says the network environment must not block login.microsoftonline.com, and a stray proxy is the most common block on a single PC.

1. Open Settings > Network & internet > Proxy. Under Manual proxy setup, check Use a proxy server. Windows 10 has the same Proxy page.
2. If a manual proxy is on and nobody set it on purpose, note the address and switch it off.
3. Right-click Start and open Terminal (Admin). Select Yes in the prompt.
4. Show the WinHTTP proxy that Windows components use:

   netsh winhttp show proxy

5. If it lists a proxy you do not know, and you are not on a company network, reset it:

   netsh winhttp reset proxy

6. Restart the PC and open Word.

If no proxy was set and other Windows apps also fail to sign in, reset Winsock, TCP/IP and the DNS cache: Reset the network and flush DNS. Note any fixed IP address or DNS server first.

Fix 4. Let the sign-in broker through security software and VPN filters

10 minutesLow riskThe error began after a VPN, antivirus or HTTPS scanning tool was installed or updated.

Microsoft names two processes that fetch sign-in tokens and says that a local firewall, antivirus or Windows Defender must not block them. A tool that scans HTTPS traffic can also replace the server's certificate, which looks like an untrusted server.

Sign-in broker

C:\Windows\SystemApps\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Microsoft.AAD.BrokerPlugin.exe

Background task host

C:\Windows\System32\backgroundTaskHost.exe

Main destination

https://login.microsoftonline.com

1. Disconnect the VPN and quit its app.
2. Pause Microsoft Defender real-time protection for one attempt: Turn off Microsoft Defender protection for a moment.
3. If you use another antivirus, pause its web shield or HTTPS scanning the same way.
4. Open Word and try the sign-in once.
5. Turn the protection, the web shield and the VPN back on, whatever the result.
6. If the sign-in worked, add the two processes and the sign-in server to that program's exceptions, or ask its maker or IT to do it.

Fix 5. Remove stored Office credentials and reconnect the work account

10 minutesLow riskOnly one account fails, or the error began after a password change, a migration or a new company sign-in server.

Windows keeps a copy of the account and the server it last used. Microsoft's recovery for a broken work account link is to remove the account under Access work or school and add it again.

1. Close Word, Excel, Outlook, Teams and OneDrive.
2. Select Start, type credential manager and open Credential Manager. Select Windows Credentials.
3. Expand every entry that starts with MicrosoftOffice and select Remove, then Yes.
4. Open Settings > Accounts > Access work or school. If the work account is listed and you do not sign in to Windows with it, select it and select Disconnect.
5. Restart the PC, open Word and sign in with the work account again.

Fix 6. Repair Office with Quick Repair, then Online Repair

10 to 30 minutesLow riskThe error stays on every network and with cleared credentials.

An administrator on Microsoft Q&A cleared the same window for several users by running the Microsoft 365 installer over the existing installation. Online Repair does the same with Microsoft's own tool and keeps your files.

1. Open Installed apps. Right-click the Start button and select Installed apps.
2. Find Microsoft 365 or Office. Find your Microsoft 365 or Office product in the list. If you have a standalone app such as Visio or Project, search for it by its own name.
3. Open the repair window. Select the three dots next to the product and select Modify.
4. Start with Quick Repair. In the repair window, select Quick Repair, then Repair. It is the faster option: it finds damaged files and replaces them.
5. Finish and test. Follow the instructions on the screen until the repair is done. Restart the PC if you are asked to, then open the app that had the problem.
6. Run Online Repair if the problem is still there. Open the same repair window again and select Online Repair, then Repair. Microsoft recommends this option to make sure everything gets fixed. It takes longer than Quick Repair.

These steps were written for Windows 11 25H2 and 26H2. The full page with the other versions and what each result means: How to repair Microsoft 365 or Office

Full steps for Windows 11 and Windows 10: How to repair Microsoft 365 or Office. Online Repair downloads Office again, so it needs a working connection to Microsoft's download servers.

Fix 7. Update Office and Windows and run Microsoft's sign-in troubleshooter

15 to 30 minutesLow riskOffice or Windows has not updated for weeks, or every other fix failed.

Microsoft's first advice for Office sign-in connection issues is the latest Office build for your channel and a supported Windows. Its article also points to the Microsoft 365 Sign-in troubleshooter, which tests the common causes.

1. Open Word and select File > Account > Update Options > Update Now.
2. Select Start, type check for updates, install everything offered and restart.
3. Open the Microsoft 365 Sign-in troubleshooter from Microsoft's link https://aka.ms/SaRA-OfficeSignIn-sarahome and follow it.
4. Sign in to Office once more.

Windows 10 left support on 14 October 2025. A Windows 10 PC without Extended Security Updates no longer gets fixes for the sign-in broker or new root certificates through Windows Update.

If 0xCAA70010 is still there: where the real cause is written

Windows records each failed broker request. Microsoft describes where to find it, and the entry shows the server and the code at the moment of the failure.

1. Right-click Start and open Event Viewer.
2. Go to Applications and Services Logs > Microsoft > Windows > AAD > Operational.
3. Look for errors at the time of your sign-in that mention XMLHTTPWebRequest.
4. Note the code and the server. Microsoft's pattern for connection failures is 0x?AA7????, 0x?AA8????, 0x?AA3????, 0x102 or 0x80070102.
5. Check that the time matches a moment you were online, not a wake from sleep.

• Send to IT: the full text of the window, the server name, the time, the Edge result from Fix 1 and the AAD log entry.
• When it is not your PC: if colleagues on the same network get 0xCAA70010 with the same server, the cause is the server or the network, and no change on your PC will fix it.

How to keep 0xCAA70010 from coming back

Once the broker can reach and trust the sign-in server, the error does not return by itself. It comes back when a certificate expires or something new sits in the path.

• Keep automatic time on. A wrong clock makes every certificate look invalid.
• Install Windows updates. They carry new root certificates and broker fixes.
• Give security tools an exception, not a pause. Allow the two broker processes and the sign-in server in antivirus, HTTPS scanning and VPN filters.
• Do not leave test proxies behind. Check netsh winhttp show proxy after you remove a VPN or debugging tool.
• For administrators: watch certificate dates. Renew the AD FS certificate before it expires and use one that client PCs trust.

Frequently asked questions

What does error 0xCAA70010 mean?

It means the Windows sign-in broker could not finish a secure connection to the sign-in server when Office asked for your account. Microsoft groups codes of the pattern 0x?AA7???? with connection failures. Reports tie this one most often to a server certificate the PC does not trust, and to proxies or filters in the way. The server name under the code shows whether Microsoft's address or your organisation's own server failed. Fix 1 on this page tests it in two minutes.

Why does 0xCAA70010 show login.microsoftonline.com?

Because that is the server the broker tried to reach and could not. login.microsoftonline.com is Microsoft's main sign-in address for work and school accounts. Microsoft notes that this one name covers many IP addresses and services, so a filter that blocks only some of them causes errors that come and go. Open the address in Edge as in Fix 1. If it fails there too, the whole PC is blocked. If it opens, check the proxy in Fix 3 and security software in Fix 4.

What is the difference between 0xCAA70010 and 0xCAA70004?

Both belong to the same AA7 group of broker connection errors and show the same We can't connect you window. The code 0xCAA70004 is usually described as a server or proxy that was not found, so the proxy check comes first. The code 0xCAA70010 more often appears when the server was reached but the secure connection failed, for example on an untrusted certificate. The first test is the same for both: open the server under the code in Edge. If you see caa70004 in Teams, the steps on this page still apply.

Is 0xCAA70010 a problem with my internet connection?

Usually not. In the reports the browser and other apps work, and the reader says the connection is good. The broker uses its own processes and the Windows network settings, and it checks the server's certificate strictly. A proxy, a filter, a wrong clock or an untrusted certificate stops it while web pages still open. Test the server under the code in Edge and on a phone hotspot (Fix 1) to see where the block sits.

Why do I get 0xCAA70010 only on the company network?

Because something on that network stands between the broker and the sign-in server. A company proxy, firewall or HTTPS inspection device can let browsers through while blocking or rewriting the broker's connection. If Office signs in on a phone hotspot and fails at work, nothing on your PC needs changing. Send IT the server name under the code, the time, and the hotspot result. Searches such as the Japanese 社内ネットワーク, company network, describe exactly this case.

Can I fix 0xCAA70010 by turning off modern authentication?

We do not recommend it. Old guides add EnableADAL = 0 under the Office Identity registry key, which sends Office back to an older sign-in method. Microsoft says Office uses the Web Account Manager for sign-in since build 16.0.7967, and it does not support turning off ADAL or WAM to solve sign-in issues. Some security features only work through WAM. Find the certificate, proxy or filter problem instead, with Fix 1 to Fix 4.

Will reinstalling Office fix 0xCAA70010?

Sometimes, but only after the network and certificate checks. One administrator cleared the same window for several users by running the Microsoft 365 installer over the existing installation. Another reader reinstalled several times without success, because the cause was outside Office. Online Repair in Fix 6 reinstalls Office with Microsoft's own tool and keeps your files. Deleting Office folders and registry keys by hand is not needed and can leave Office half removed.

Is Microsoft 365 down when I see 0xCAA70010?

Rarely. The code comes from your PC: its broker could not finish the connection. If Microsoft's service had an outage, Outlook on the web and Word on the web would usually fail as well. Sign in at https://www.office.com in a browser and ask a colleague on another network. If both work, the problem is on your PC, your network or your organisation's sign-in server. Your administrator can see Microsoft's service status in the Microsoft 365 admin center.

I searched for this error in Spanish, Vietnamese or Japanese. Does this page apply?

Yes. Searches such as me sale igual (it still shows the same), nó bị sao đây (what is wrong with it) and エラーになります (it gives an error) came to this page with the same code. The window appears in your Windows language, but 0xCAA70010 and the server name stay the same. Match the error by the code, then follow the fixes in order. Menu names in Windows and Office appear in your language.