OneDrive Admin Checklist: 0x8004de40 sign-in error keeps returning for Microsoft support cases

When users report the OneDrive sign-in error 0x8004de40, the issue often reappears even after standard fixes like clearing credentials or reinstalling the sync app. This error indicates that OneDrive cannot verify the user’s identity with the Microsoft 365 authentication service, typically due to a misconfigured Conditional Access policy, a broken Azure AD token cache, or a blocked authentication endpoint. This article provides a structured checklist for Microsoft support administrators to permanently resolve the 0x8004de40 error and prevent its return.

The error 0x8004de40 is distinct from other sign-in failures because it occurs after the user enters valid credentials. The sync client successfully authenticates with the Microsoft identity platform but then fails to establish a secure channel with the OneDrive service. This points to a policy or network-level block, not a simple password issue.

By following the steps below, you will identify the exact cause and apply the correct fix. The checklist covers Conditional Access policies, Azure AD device registration, TLS settings, and DNS resolution. Each step includes a verification method so you can confirm the fix before closing the case.

Why OneDrive Error 0x8004de40 Returns After Standard Fixes

The 0x8004de40 error has a specific technical root cause: the OneDrive sync client receives a valid access token from Azure AD but then fails to validate that token against the OneDrive service endpoint. This mismatch typically occurs because of one of three conditions:

1. Conditional Access policy blocks the token exchange. If a policy requires device compliance, location-based access, or a specific client app, and the user’s device does not meet the requirement, the OneDrive service rejects the token even though Azure AD issued it. The user sees the error immediately after signing in.

2. Stale or corrupted token cache. When the cached token expires or becomes corrupted, the sync client cannot refresh it silently. The user is prompted to sign in again, but the cached data interferes with the new authentication flow, causing the error to reappear.

3. Network or proxy blocks the authentication endpoint. OneDrive requires access to login.microsoftonline.com and onedrive.com. If a firewall, proxy, or DNS filter blocks these endpoints, the token validation fails. The error returns every time the sync client attempts to connect.

Standard fixes such as clearing credentials or resetting the app only address the symptom temporarily. The policy or network condition remains, so the error reappears on the next sign-in attempt.

Step-by-Step Checklist to Permanently Fix 0x8004de40

Follow these steps in order. After each step, ask the user to restart OneDrive and attempt to sign in. Do not skip steps — each addresses a different potential cause.

Step 1: Verify Conditional Access Policies in Azure AD

1. Open the Azure AD admin center
   Sign in to https://aad.portal.azure.com with an account that has Conditional Access administrator privileges.
2. Navigate to Conditional Access policies
   Go to Azure Active Directory > Security > Conditional Access > Policies. Review all policies that apply to the affected user or group.
3. Check for blocking conditions
   Look for policies that require device compliance, location-based access, or approved client apps. If a policy blocks all client apps or requires a compliant device and the user’s PC is not registered in Azure AD, OneDrive will fail with 0x8004de40.
4. Create an exclusion if needed
   If the policy is necessary for security, add the OneDrive sync app as an exclusion. Under Assignments > Cloud apps or actions > Exclude, select Office 365 OneDrive Sync (client ID: 2abdc806-e091-4815-b16f-91e9b7e7f0c3).

Step 2: Clear All Cached Credentials on the User’s Device

1. Open Credential Manager
   On the user’s PC, press Windows + R, type control /name Microsoft.CredentialManager, and press Enter.
2. Delete OneDrive and ADAL entries
   Under Windows Credentials, remove every entry that contains “OneDrive Cached Credential” or “MicrosoftOffice16_Data:ADAL:”. There may be multiple entries per user.
3. Delete Microsoft Office entries
   Also remove entries starting with “MicrosoftOffice16_Data:” that are not for the user’s current account. These can interfere with token refresh.
4. Restart OneDrive
   Right-click the OneDrive icon in the system tray and select Close OneDrive. Then restart OneDrive from the Start menu.

Step 3: Unlink and Relink the User’s OneDrive Account

1. Open OneDrive settings
   Right-click the OneDrive cloud icon and select Settings.
2. Unlink the PC
   Go to the Account tab and click Unlink this PC. Confirm the action.
3. Sign in again
   OneDrive will restart and prompt for sign-in. Enter the user’s credentials. If the error appears again, proceed to Step 4.

Step 4: Verify Device Registration in Azure AD

1. Check Azure AD device status
   In the Azure AD admin center, go to Devices > All devices. Search for the user’s device by name. If the device is not listed, it is not registered.
2. Register the device
   On the user’s PC, open Settings > Accounts > Access work or school. Click Connect and sign in with the user’s Microsoft 365 account. This registers the device in Azure AD.
3. Verify compliance
   If your Conditional Access policy requires compliant devices, ensure the device is enrolled in Microsoft Intune or another MDM solution. Open Settings > Accounts > Access work or school and confirm the device shows as “Compliant.”

Step 5: Test Network and Proxy Access to Authentication Endpoints

1. Run a connectivity test
   On the user’s PC, open a web browser and navigate to https://login.microsoftonline.com. If the page does not load, a firewall or proxy is blocking authentication.
2. Check DNS resolution
   Open a Command Prompt and run nslookup login.microsoftonline.com. The response should return valid IP addresses. If it fails, the DNS server is not resolving Microsoft 365 endpoints.
3. Allow required URLs
   Ensure the network allows traffic to login.microsoftonline.com, onedrive.com, and all subdomains listed in the Microsoft 365 URLs and IP address ranges documentation. If using a proxy, add these endpoints to the bypass list.

If OneDrive Still Has Issues After the Main Fix

OneDrive Shows Error 0x8004de40 on a Hybrid Azure AD Joined Device

Hybrid Azure AD joined devices synchronize from on-premises Active Directory. If the synchronization is incomplete, the device appears in Azure AD but lacks the required registration token. On the user’s PC, open Settings > Accounts > Access work or school. If the device shows as “Pending registration,” run dsregcmd /join in an elevated Command Prompt to force registration. After the command completes, restart OneDrive.

Error Appears Only When Using a VPN

Some VPN configurations route traffic through a proxy that strips TLS headers or blocks modern authentication. Ask the user to disconnect from the VPN and attempt OneDrive sign-in. If the error disappears, configure the VPN to exclude Microsoft 365 traffic from the proxy. Alternatively, enable split tunneling so authentication traffic goes directly to the internet.

Error Returns After a Windows Update

A Windows update can reset the credential cache or modify the TLS settings. OneDrive requires TLS 1.2 or higher. In the affected user’s PC, open Internet Options, go to the Advanced tab, and ensure Use TLS 1.2 is checked. Also check that the OneDrive sync app is updated to the latest version. In OneDrive settings, go to the About tab and click Check for updates.

Item	Standard User Fix	Admin Checklist Fix
Scope	Clears local credentials and resets app	Investigates and modifies Conditional Access policies, device registration, and network rules
Persistence	Error returns after next sign-in or policy change	Error does not return if the root cause is resolved
Tools used	Credential Manager, OneDrive Settings	Azure AD admin center, Command Prompt, nslookup, dsregcmd
Time to apply	5 minutes	15-30 minutes depending on environment

The 0x8004de40 error in OneDrive is a sign-in failure that standard user-level fixes cannot permanently resolve. By following this admin checklist, you can identify whether the cause is a Conditional Access policy, a stale token cache, a missing device registration, or a network block. After applying the correct fix, verify the result by having the user sign in and sync files. For ongoing management, consider creating a Conditional Access policy that excludes the OneDrive sync client by its app ID, and enable Azure AD device registration for all Windows 10 and Windows 11 PCs. This prevents the error from recurring across your organization.