This is an Entra ID (Azure AD) token error that stops you signing in to a work or school account. Clearing the cached sign-in state usually resolves it. Jump to your situation below or work through the methods in order.
By Neeraj Singh ~6 min Updated Jun 2026 86% found this helpful
Error message
CAA2000B. We couldn't sign you in. There was a problem acquiring a token for your account.
Summary
CAA2000B is an Entra ID (Azure AD) authentication token error that blocks sign-in to enterprise work or school accounts in New Outlook. The CAA family of codes comes from the Windows authentication broker, and CAA2000B means it could not acquire a valid token, typically because of a stale or looping cached sign-in state. Because New Outlook signs in through the default web browser, a corrupt browser cookie or cache often traps the token request in a loop. The fix is to clear the cookies and cache in your default browser to break that loop, then sign out and back in. If it persists, remove and re-add the work or school account so the device re-registers, and for a managed device check with your administrator whether a Conditional Access policy is blocking the sign-in.
What this error means
To sign you in to a work account, Windows acquires an authentication token from Entra ID. CAA2000B means that acquisition failed. Since New Outlook hands the sign-in to your default browser, the failure usually traces back to a cached browser state rather than your password being wrong.
A stale cookie or cached token can put the request into a loop where it keeps trying and failing. Clearing the browser cookies and cache removes that bad state so a fresh, clean token can be issued. Re-adding the account and checking Conditional Access cover the deeper, policy-driven cases.
Common causes
A stale or corrupt cached sign-in state.
Bad cookies or cache in the default browser.
A token acquisition loop.
The work or school account needs re-registering.
A Conditional Access policy on a managed device.
Expert insight
“CAA2000B is a token error, not a password error. New Outlook signs you in through your default browser, so when a stale cookie traps the token request in a loop, you get this. The fix that works most often is almost too simple: clear the cookies and cache in your default browser, then sign out and back in. If it sticks around, I remove and re-add the work account so the device re-registers, and on a managed laptop I get IT to check Conditional Access.”
Manager, Tech Support & Operations · 19+ years fixing Windows and system errors
✓ How to fix it
Method 1
Clear the default browser cookies and cache
1Open your default browser's settings and clear cookies and cached files (especially for microsoft.com and login.microsoftonline.com).
2This breaks the token loop.
3Reopen Outlook and try signing in.
Method 2
Sign out and back in
1Sign out of the account in Outlook, close the app, then reopen and sign back in.
2A fresh sign-in requests a clean token.
3Approve any multi-factor prompt.
Method 3
Remove and re-add the work account
1Open Settings, Accounts, Access work or school, disconnect the affected account, restart, then add it back.
2This re-registers the device with Entra ID.
3Sign in again.
Method 4
Confirm the system clock is correct
1Make sure the date, time and time zone are accurate (Settings, Time and language).
2A wrong clock breaks token validation.
3Set time automatically and retry.
Method 5
Check Conditional Access on a managed device
1On a work device, a Conditional Access policy may be blocking the sign-in.
2Ask your administrator to review the policy and your device compliance state.
3They can adjust it if needed.
CAA2000B is an Entra ID token error, not a password problem, so clear the cookies and cache in your default browser to break the token loop, then sign out and back in. If it persists, remove and re-add the work account to re-register the device, and have your administrator check Conditional Access on a managed machine.
Frequently asked questions
What does Outlook error CAA2000B mean?
It is an Entra ID (Azure AD) authentication token error. The Windows authentication broker could not acquire a valid token for your work or school account, usually from a stale cached sign-in state.
How do I fix CAA2000B?
Clear the cookies and cache in your default browser to break the token loop, then sign out of Outlook and back in. If it persists, remove and re-add the work or school account.
Why does the browser matter?
New Outlook signs in through your default browser, so a corrupt cookie or cached token there can trap the sign-in in a loop. Clearing the browser cookies and cache removes that bad state.
Is my password wrong?
Usually not. CAA2000B is a token acquisition failure rather than a credentials error. The fix is clearing the cached sign-in state, not resetting your password.
It still fails after clearing cookies
Remove and re-add the work or school account under Access work or school to re-register the device, confirm the system clock is correct, and check Conditional Access on a managed device.
Could it be a company policy?
Yes. On a managed device a Conditional Access policy or a device compliance issue can block the token. Your administrator can review and adjust the policy.
Still not working?
If CAA2000B continues after clearing cookies, re-adding the account and confirming the clock, the device may have a broken Entra ID registration; on a managed machine your administrator can re-join or re-register it. You can also submit your error to us for a tailored fix.
