Error code 2148073520: how to fix sign in error 2148073520 (tag 657rx) in Windows?

Error code 2148073520 under Something went wrong. [657rx] means that Outlook, Teams, OneDrive or another Microsoft 365 app on Windows could not use the security key that protects your sign-in. The account itself is usually fine, so the fix is on this PC. Remove the saved Office credentials and reconnect your account first.

Facts checked on 15 October 2026. Steps written for Microsoft 365 apps on Windows 11 (25H2 and 26H2) and Windows 10 22H2, read against Microsoft's documentation and the 2148073520 reports on Microsoft Q&A.

What error code 2148073520 with tag 657rx means

You open Outlook or Teams, type your address, and a small Microsoft window answers with Something went wrong. [657rx]. Under Troubleshooting details it lists a Correlation Id, a Timestamp, a DPTI string, the line Message: The credential is invalid. Unexpected sub status (6008)., the tag 657rx and Code: 2148073520.

The message says the credential is invalid, but your password is usually not the problem. Users on Microsoft Q&A report that the same account works in a browser while the desktop apps fail, and one wrote that all his errors shared the same DPTI, which ties the fault to the device.

Decode Code: 2148073520 and the codes that come with tag 657rx

Converted to hexadecimal, 2148073520 is 0x80090030. Microsoft's table of COM error codes lists it as NTE_DEVICE_NOT_READY: "The device that is required by this cryptographic provider is not ready for use." The 0x8009 family belongs to Windows cryptography, where your sign-in keys live.

Outlook error code 2148073520, Teams and OneDrive: one shared sign-in

Office for Windows does not sign in by itself. It asks Web Account Manager (WAM), a part of Windows, for a token. Microsoft names two packages behind it: Microsoft.AAD.BrokerPlugin for work and school accounts and Microsoft.Windows.CloudExperienceHost for personal accounts. Windows protects the keys behind these tokens with the TPM.

• Outlook: the 657rx window appears at start or when Outlook asks for the password, and mail stops syncing. Classic Outlook for business is the most common place in the reports.
• Teams and OneDrive: the same window. One user reported OneDrive and Outlook failing while Teams on the same PC signed in.
• Word, Excel, PowerPoint: the apps cannot activate with your subscription and may open in reduced mode.
• Browser: Outlook on the web and office.com usually work, because they do not use WAM or the TPM key.

What causes error 2148073520, from the most common to the rare

Microsoft has not published a cause for tag 657rx. The ranking below comes from the code, from Microsoft's page on the TPM malfunction message in Microsoft 365 apps, and from the outcomes users posted on Microsoft Q&A. Treat it as our reading, not a statistic.

How to fix error code 2148073520

The fixes are ordered by how often users report them to end the error and by how little they change. After each fix open Outlook or Word and sign in: when the password box or the approval request appears where 657rx was, you are done.

Fix 1. Remove the Office credentials and reconnect your work or school account

10 minutesLow riskEveryone with the error on a PC they own. On a managed PC do only steps 1 to 4.

Windows keeps your Microsoft 365 sign-in in two places outside Office: Credential Manager and Access work or school. Microsoft's page on the TPM malfunction message clears both first, and the most helpful answer on the 2148073520 thread, marked helpful by more than 90 users, removes the work account.

1. Save your work and close Outlook, Teams, OneDrive and the other Office apps.
2. Select Start, type credential manager and open Credential Manager, then select Windows Credentials.
3. Under Windows Credentials and Generic Credentials, expand each entry that starts with MicrosoftOffice16 and select Remove. Microsoft's forum staff also remove other Microsoft 365 entries of the same account.
4. Open Settings > Accounts > Access work or school.
5. If the account you use for Microsoft 365 is listed and it is not your Windows sign-in, select it and select Disconnect.
6. Restart the PC.
7. Go back to Access work or school, select Connect and sign in with the work or school address, including the second factor.
8. Open Outlook and sign in.

With a personal account and nothing under Access work or school, open Settings > Accounts > Email & accounts instead, remove old or extra Microsoft accounts under Accounts used by other apps, restart and add your account again.

Fix 2. Reset the Windows sign-in tokens and run Microsoft's sign-in troubleshooter

10 minutesLow riskFix 1 did not help, the code is 2148073494, or the error came after a password change.

The account plug-ins keep their own token files, apart from Credential Manager. When those tokens were sealed with a key the TPM can no longer use, every app fails the same way. Microsoft deletes them in its TPM troubleshooting page, and users on Q&A report that this step ended their 657rx error.

1. Sign out of Office (File > Account > Sign out) and close all Office apps, Teams and OneDrive.
2. Open File Explorer, paste this location in the address bar, press Ctrl + A and delete the files:

   %LOCALAPPDATA%\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\AC\TokenBroker\Accounts

3. Do the same in the folder of personal accounts:

   %LOCALAPPDATA%\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AC\TokenBroker\Accounts

4. Restart the PC.
5. Run the Microsoft 365 Sign-in troubleshooter from Microsoft's page Fix authentication issues in Microsoft 365 apps, then sign in to Outlook.

Microsoft's forum moderators go one step further for 2148073520 and empty the whole BrokerPlugin folder. Renaming does the same and keeps a copy, so prefer it.

Fix 3. Check that the TPM is ready, read its log and update the BIOS

15 minutesLow riskFix 1 and Fix 2 did not help, or the error began after a BIOS update, a repair or a BitLocker recovery screen.

The code says a cryptographic device was not ready. Microsoft explains that Windows uses the TPM to protect your credentials, that the chip can become corrupted or reset, and that a TPM fault breaks Modern Authentication. These checks show whether the chip is the cause before you change anything.

1. Press Win + R, type tpm.msc and press Enter.
2. Under Status read the line. The TPM is ready for use is the healthy state. Any other text, or Compatible TPM cannot be found, points to the chip or the BIOS.
3. Press Win + R, type eventvwr.msc and press Enter. Open Windows Logs > System and filter by the source TPM.
4. Look for Event ID 14 (the TPM driver met a non-recoverable error) or Event ID 17 (the TPM failed to run a command) around the time of your sign-in.
5. Open Applications and Services Logs > Microsoft > Windows > AAD > Operational and look for error codes of the pattern 0x?028????, 0x?029???? or 0x?009????.
6. If you found TPM errors, install the latest BIOS or UEFI firmware from your PC maker's support site, together with the newest Windows update.

Fix 4. Repair the account plug-ins and make sure nothing blocks them

15 minutesLow riskThe sign-in window is blank or closes at once, or you use a VPN, a proxy or a third-party antivirus.

Microsoft states that some antivirus, proxy or firewall software can block the Microsoft.AAD.BrokerPlugin process, and gives PowerShell commands that register both account plug-ins again when their package information is missing.

1. Disconnect any VPN and test the sign-in once. Turn the VPN back on afterwards.
2. Right-click Start and select Terminal on Windows 11 or Windows PowerShell on Windows 10, as the user who sees the error.
3. For a work or school account, check and register the work account plug-in:

   if (-not (Get-AppxPackage Microsoft.AAD.BrokerPlugin)) { Add-AppxPackage -Register "$env:windir\SystemApps\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Appxmanifest.xml" -DisableDevelopmentMode -ForceApplicationShutdown } Get-AppxPackage Microsoft.AAD.BrokerPlugin

4. For a personal account, do the same for the Live ID package:

   if (-not (Get-AppxPackage Microsoft.Windows.CloudExperienceHost)) { Add-AppxPackage -Register "$env:windir\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\Appxmanifest.xml" -DisableDevelopmentMode -ForceApplicationShutdown } Get-AppxPackage Microsoft.Windows.CloudExperienceHost

5. Restart the PC and sign in to Outlook.

If the error ends only with your antivirus paused, update it and allow Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy in its application or web control. Pause protection for one test only and turn it back on at once: Turn off Microsoft Defender protection for a moment. More on the commands: How to re-register Microsoft Store apps with PowerShell.

Fix 5. Reset the Office activation state on a work or school PC

10 minutesLow riskWork or school accounts, when Office keeps returning to an old account after Fix 1 to Fix 4.

Office keeps licences and stored identities of its own. Microsoft's article for Microsoft 365 Apps for enterprise ships a script that clears them, and Microsoft's forum staff recommend it for the 657rx window with code 2148073520.

1. Sign out of every Office app and close them all.
2. Open Microsoft's article Reset activation state for Microsoft 365 Apps for enterprise and download OLicenseCleanup.zip from the section on scripts.
3. Extract OLicenseCleanup.vbs and run it with administrator rights, as the article says.
4. Restart the PC.
5. Open Word, sign in with the work or school account and let Office activate.

Microsoft wrote this script for the enterprise edition. We could not confirm that it is meant for Microsoft 365 Personal or Family, so home users skip this fix. If your company manages the PC, IT may run it for you.

Fix 6. Check the device registration with dsregcmd and recover it

10 to 30 minutesLow riskWork and school accounts, above all on laptops that IT manages or that are joined to Microsoft Entra ID.

A work sign-in also proves the device, using a key held in the TPM. Microsoft's forum staff tie 2148073520 to a device that is wrongly registered, duplicated or restricted in Microsoft Entra ID, and Microsoft documents a recovery for each way a PC can be joined.

1. Open Command Prompt and run dsregcmd /status.
2. Under Device State read AzureAdJoined and DomainJoined. Under User State read WorkplaceJoined. Under SSO State read AzureAdPrt.
3. AzureAdPrt : NO means Windows holds no Primary Refresh Token for you, which matches this error.
4. Copy the output and pick your recovery from the table below.

Fix 7. Clear the TPM as the last step on your own PC

20 minutesRead the warningYour own PC, when Fix 3 showed that the TPM is not ready, or everything above failed after a hardware repair.

Microsoft lists Clear TPM in its troubleshooting page for the TPM malfunction message in Microsoft 365 apps. Clearing resets the chip to factory state and Windows prepares it again, so new keys replace the ones the sign-in could not use.

1. Make sure you know your Microsoft account password, because the PIN will stop working.
2. Open Windows Security from the Start menu and select Device security.
3. Under Security processor select Security processor details, then Security processor troubleshooting.
4. Select Clear TPM and restart when asked. The PC may ask you to press a key during the restart to confirm.
5. Sign in with your password, set up a new PIN, then run Fix 1 and sign in to Outlook.

Microsoft says to clear the TPM from Windows, not from the UEFI menu. The earlier version of this page cleared it from tpm.msc without a warning; the Windows Security route above is the one Microsoft documents today.

Fix 8. Test with a new Windows user account

15 minutesLow riskFix 1 to Fix 4 did not help on a home PC, or IT asks whether the fault follows your profile.

The token files, the stored accounts and the plug-in data belong to each Windows user. Microsoft's TPM troubleshooting page ends with a new Windows user account, and the Microsoft Q&A answer for 80090030 suggests the same test.

1. Open Settings > Accounts > Other users and select Add account.
2. Select I don't have this person's sign-in information, then Add a user without a Microsoft account, and give it a name and a password.
3. Sign out, sign in to the new account and wait for the desktop.
4. Open Outlook or Word and sign in with your Microsoft 365 address.

If Office signs in from the new account, your old profile holds the fault: move your files over or keep repairing the old profile. If it fails there too, the cause is the TPM or the device registration. Every screen of the procedure: Create a new user account to test a problem.

If error 2148073520 is still there: where the cause is written and who can help

When every fix has failed, stop changing things and collect evidence. The window hides the reason, but Windows logs it, and Microsoft support or IT can match the attempt with the details. Send everything as text, not as a photo.

• Personal subscription: contact Microsoft support through support.microsoft.com, signed in with the account that pays for Microsoft 365.
• Work or school account: send the lines to IT. Microsoft's forum staff ask admins to open a support request in the Microsoft 365 admin center.
• After a repair or a new system board: tell the PC maker. Dell documents this exact failure, with the TPM error 80090016, after a board replacement.

How to keep error 2148073520 from coming back

Most cases start with a change to the keys or accounts on the PC: a firmware update, a repair, a new account or a password change. A few habits keep Windows, the TPM and your account in step.

• Update the BIOS and TPM firmware from your PC maker. Microsoft recommends it to avoid TPM sign-in failures.
• Keep the BitLocker recovery key in your Microsoft account, so a TPM reset never locks you out.
• After a password change, sign out of Office and sign in once on each PC.
• After a repair or a new system board, run Fix 1 before you open Outlook, since the new TPM cannot read the old keys.
• Leave WAM and ADAL on and remove old EnableADAL values from forum fixes.
• Keep Windows updated. Windows 10 support ended on 14 October 2025, so a Windows 10 PC no longer gets TPM and security fixes.

Frequently asked questions

What does error code 2148073520 mean?

It means a Microsoft 365 app on Windows could not finish your sign-in because a cryptographic device was not ready. In hexadecimal the code is 0x80090030, which Microsoft lists as NTE_DEVICE_NOT_READY. For sign-in that device is normally the TPM chip that guards your token keys. The account usually still works in a browser. Start with Fix 1: remove the Office credentials and reconnect the account.

What is "The credential is invalid. Unexpected sub status (6008)" with tag 657rx?

It is the Message line of the same window. Office checked the token it got from Windows and could not validate it. Microsoft has not published what sub status 6008 or tag 657rx mean, and we found no Microsoft article that defines them. The Code line under them is the useful part: 2148073520 points to a key device that is not ready, 2148073494 to a key set that is missing.

Is 2148073520 the same as error 80090030 "Trusted Platform Module has malfunctioned"?

Yes, it is the same Windows code written two ways. Older Office builds showed "Your computer's Trusted Platform Module has malfunctioned" with error code 80090030, and Microsoft Q&A has threads about it since 2019. Newer builds show the 657rx window with the decimal 2148073520. Microsoft's own page on the TPM malfunction message in Microsoft 365 apps uses the same fixes as this guide.

What is the difference between codes 2148073520 and 2148073494?

Both come from Windows cryptography and appear under tag 657rx. 2148073520 is 0x80090030, a device that is not ready. 2148073494 is 0x80090016, NTE_BAD_KEYSET, "Keyset does not exist": the key the token was sealed with is gone, as after a new system board. Microsoft's forum staff answer both with the same cache reset, so run Fix 2 and Fix 1 for 2148073494.

Should I set EnableADAL to 0 to fix error 2148073520?

No. That registry value comes from a 2019 forum answer and from the earlier version of this page. Microsoft now says that disabling ADAL or WAM is not supported as a fix for Microsoft 365 sign-in problems and can harm your setup. It puts Office into a legacy sign-in. If you added EnableADAL or DisableAADWAM before, delete those values and use Fix 2 and Fix 4 instead.

Is it safe to clear the TPM to fix this error?

It is safe for the PC but not for every key on it. Microsoft warns that clearing the TPM removes all keys made with it and the data they protect, such as your Windows Hello PIN. With BitLocker on you need the recovery key. That is why clearing is Fix 7, after the checks in Fix 3, and only on your own PC. On a work or school PC, leave it to IT.

Will I lose my emails if I disconnect my work account?

No. Mail, calendar and contacts of a Microsoft 365 account live on Microsoft's servers. Dell's support article for the related error 80090016 says the same: once you reconnect, Outlook syncs your data back. What you lose is the sign-in on this PC, so have your password and second factor ready. On a managed PC, ask IT before you disconnect, because it removes the device registration.

Why did error 2148073520 start after a motherboard repair or BIOS update?

Because the keys behind your tokens live in the TPM. Dell explains that a new system board brings a new TPM, and the tokens made with the old chip fail. A BIOS update can also reset or change the TPM. Microsoft adds that the chip can become corrupted or reset in some conditions. Reconnect the account with Fix 1 and reset the tokens with Fix 2.

The window says to contact my administrator, but this is my home PC. What now?

That sentence is standard text in the Microsoft sign-in window. On a home PC with your own Microsoft account, you are the administrator, so you can run every fix on this page. If the account is a work or school account that your employer gave you, the administrator is their IT team, and you should send them the Correlation Id, Timestamp and Code.