Microsoft 365 Copilot Authentication Required Loop: Fix

You open Copilot in Word, Excel, or Outlook and see a prompt that says “Authentication Required” over and over. Even after you sign in successfully, the same dialog returns within seconds or on the next action. This loop prevents you from using Copilot to draft documents, summarize emails, or generate spreadsheet formulas. The root cause is almost always a mismatch between cached credentials and the identity provider token that Copilot needs to verify your Microsoft 365 license. This article explains why the loop occurs and provides the exact steps to break it.

Why Copilot Gets Stuck in an Authentication Loop

Copilot in Microsoft 365 apps relies on OAuth 2.0 tokens issued by Microsoft Entra ID formerly Azure Active Directory. Each time you ask Copilot to generate text or analyze data, the app sends a token to the Copilot service. If the token is expired, revoked, or malformed, the service returns an HTTP 401 status, which triggers the app to show the authentication dialog again.

The most common technical cause is a cached credential conflict. Office applications store multiple credential sets in Windows Credential Manager. When one credential set is valid for signing into the Office app but another set is invalid for the Copilot API endpoint, the loop starts. The app thinks you are signed in but the Copilot backend disagrees, so it keeps asking for re-authentication.

Another frequent cause is a conditional access policy in your Microsoft 365 tenant that requires multi-factor authentication or device compliance. If the app did not fully process the policy challenge, the token may be missing the required claim. Copilot then rejects the token and the loop resumes.

Steps to Clear Stale Credentials and Break the Loop

The following steps remove the conflicting cached credentials and force a clean token request. Perform them in the order shown. Do not skip any step unless a specific step does not apply to your app.

1. Close all Microsoft 365 apps
   Exit Word, Excel, PowerPoint, Outlook, Teams, and any other Office application. Also close any browser tabs that are signed into Microsoft 365. This ensures no process holds a lock on the credential cache.
2. Open Windows Credential Manager
   Press the Windows key, type Credential Manager, and select the result. In the Credential Manager window, click Windows Credentials.
3. Remove MicrosoftOffice16 credential entries
   Scroll down to the Generic Credentials section. Look for any entry that starts with MicrosoftOffice16. You may see multiple entries such as MicrosoftOffice16_Data:ADAL: followed by a GUID. Click the arrow to expand each entry, then click Remove. Confirm the deletion. Remove all entries that begin with MicrosoftOffice16.
4. Clear the Microsoft 365 sign-in cache
   Open File Explorer and navigate to %localappdata%\Microsoft\OneAuth. Delete all files and folders inside the OneAuth folder. If a file is in use, restart the computer and try again. This folder stores the token cache for Office on Windows.
5. Restart the computer
   A full restart clears any remaining in-memory tokens and resets the authentication service. Do not use Sleep or Hibernate. Select Restart from the Start menu.
6. Open a Microsoft 365 app and sign in
   Launch Word or Outlook. You will be prompted to sign in again. Enter your Microsoft 365 work or school account credentials. If your tenant requires multi-factor authentication, complete the prompt. Do not check the box that says Keep me signed in until you confirm Copilot works.
7. Test Copilot
   In Word, open a blank document and click the Copilot icon in the ribbon. Type a prompt such as “Write a paragraph about quarterly results.” If Copilot generates a response without asking for authentication again, the loop is resolved.

If Copilot Still Shows the Authentication Loop After Clearing Credentials

Copilot authentication loop in Outlook only

Outlook caches its own connection state separately from other Office apps. Run the Outlook repair tool. Open Outlook, go to File > Account Settings > Account Settings. Select your Microsoft 365 account and click Repair. Follow the on-screen prompts. This resets the Outlook profile connection without deleting your email data.

Loop appears after a Microsoft 365 license change

If your administrator assigned or removed a Copilot license recently, the token may still reference the old license state. Sign out of all Office apps. Open a Command Prompt as administrator and run cd %programfiles%\Microsoft Office\Office16 then cscript ospp.vbs /dstatus. Look for the LICENSE STATUS line. If it shows —OOB_GRACE—, the license is not fully activated. Run cscript ospp.vbs /act to re-arm the activation. Then test Copilot again.

Conditional access policy blocks Copilot API calls

Your Microsoft 365 tenant may have a conditional access policy that requires a compliant device or a specific client app. Open a browser and navigate to https://login.microsoftonline.com. Sign in with your work account. Go to My Security Info and verify that your device is registered. If the policy requires the Microsoft Authenticator app, install it and add your account. Then repeat the credential clearing steps above.

Copilot Authentication Loop vs Other Sign-In Errors: Key Differences

Item	Authentication Loop	Sign-In Failed Error	License Not Found Error
Description	Repeated prompt after successful sign-in	One-time failure with error code	Copilot grayed out or shows upgrade message
Primary cause	Stale cached credentials or token mismatch	Incorrect password or blocked account	Missing or expired Copilot license assignment
Fix method	Clear Credential Manager entries and OneAuth cache	Reset password or contact IT admin	Verify license in Microsoft 365 admin center
User action needed	Delete credentials and restart	Update password or MFA method	Ask admin to assign Copilot license

The table above helps you distinguish the authentication loop from other sign-in problems. If you see a single error message that says “Cannot sign in” or “Account not found,” follow the sign-in failed fix path. If Copilot does not appear at all in the ribbon, the issue is a missing license, not an authentication loop.

You can now break the Copilot authentication loop by clearing the MicrosoftOffice16 credentials in Windows Credential Manager and deleting the OneAuth cache. If the loop returns, check your tenant’s conditional access policies and run the Outlook repair tool for persistent issues in that app. For a more proactive approach, configure a persistent browser session policy in Microsoft Entra ID to reduce token refresh frequency for your device.