OneDrive Silent Sign-In Fails on Entra Joined Devices

When you sign in to a Windows device that is joined to Microsoft Entra ID, OneDrive should sign in automatically without prompting for credentials. Many users report that OneDrive instead shows a blank sign-in window, an error message, or repeatedly asks for a password. This failure usually occurs because the Entra joined device lacks the correct Web Account Manager token or because OneDrive is not configured to trust the device identity. This article explains why silent sign-in fails on Entra joined devices and provides step-by-step fixes to restore automatic authentication.

Why OneDrive Silent Sign-In Fails on Entra Joined Devices

OneDrive uses the Web Account Manager service in Windows to obtain an authentication token silently. On an Entra joined device, the machine itself has a device identity that WAM can use to request tokens without user interaction. When silent sign-in fails, one of three technical conditions is usually broken:

First, the device may not be fully Entra joined. A device that is only Azure AD registered or hybrid joined may not expose the same device-level token to OneDrive. Second, the WAM token cache may contain a stale or corrupted entry for the user’s Microsoft 365 account. Third, a policy setting in Microsoft Entra ID or in OneDrive itself may block silent token acquisition for the specific user or device.

Device Join Status

Open Settings > Accounts > Access work or school. If you see “Connected to .onmicrosoft.com” with the word “Joined” underneath, the device is Entra joined. If you see “Azure AD registered” or “Workplace joined,” the device is not Entra joined and silent sign-in will not work. Only Entra joined devices provide the device-level credential that OneDrive uses for silent sign-in.

WAM Token Cache Corruption

The Web Account Manager stores tokens in a local database. If this database becomes corrupted after a password change, a conditional access policy update, or a failed sign-in attempt, OneDrive cannot retrieve a valid token. The result is a sign-in prompt that either hangs or shows an error.

Conditional Access or Authentication Policy

Your tenant administrator may have configured a conditional access policy that requires multi-factor authentication, a compliant device, or an approved client app. If the device does not meet these requirements, the Entra ID token endpoint will deny the silent request and force an interactive sign-in.

Steps to Restore Silent Sign-In for OneDrive

Follow these methods in the order shown. Test after each method before moving to the next.

Method 1: Verify Device Join Status and Reconnect

1. Open Windows Settings
   Press Windows key + I and go to Accounts > Access work or school.
2. Check the connection type
   If you see “Connected to .onmicrosoft.com” and the word “Joined,” proceed to the next method. If you see “Registered,” click Disconnect, restart the device, then go to Settings > Accounts > Access work or school > Connect and sign in with your work or school account. After the device is fully joined, restart OneDrive.

Method 2: Unlink and Re-link OneDrive

1. Open OneDrive Settings
   Right-click the OneDrive cloud icon in the notification area and select Settings.
2. Unlink your account
   Go to the Account tab and click Unlink this PC. Confirm the prompt.
3. Restart OneDrive
   Press Windows key + R, type %localappdata%\Microsoft\OneDrive\onedrive.exe, and press Enter.
4. Sign in again
   When the OneDrive setup window appears, enter your work or school email address. On an Entra joined device, OneDrive should sign in silently without asking for a password. If it still prompts for credentials, proceed to Method 3.

Method 3: Clear the WAM Token Cache via Registry

1. Close OneDrive completely
   Right-click the OneDrive cloud icon and select Exit. Confirm that no OneDrive process is running in Task Manager.
2. Open Registry Editor
   Press Windows key + R, type regedit, and press Enter. Click Yes on the User Account Control prompt.
3. Navigate to the OneDrive accounts key
   Go to HKEY_CURRENT_USER\Software\Microsoft\OneDrive\Accounts\Business1. If you have multiple accounts, you may see Business2, Business3, and so on. Expand each until you find the key that contains your tenant URL.
4. Delete the account subkey
   Right-click the subkey (for example, Business1) and select Delete. Confirm the deletion.
5. Restart OneDrive
   Press Windows key + R, type %localappdata%\Microsoft\OneDrive\onedrive.exe, and press Enter. OneDrive will reinitialize and attempt silent sign-in using the device identity.

Method 4: Reset the WAM Token Cache Using PowerShell

1. Open PowerShell as administrator
   Right-click the Start button and select Windows PowerShell (Admin) or Terminal (Admin).
2. Run the WAM reset command
   Type the following command and press Enter:
   Get-AppxPackage accountscontrol | Reset-AppxPackage
3. Restart the device
   After the command completes, restart your computer. When Windows restarts, open OneDrive and check whether silent sign-in works.

Method 5: Check Conditional Access Policies

If the above methods do not resolve the issue, the problem may be a conditional access policy. Contact your Microsoft 365 administrator and ask them to review the Entra ID sign-in logs for your account. Look for the error code AADSTS50076 (requires multi-factor authentication) or AADSTS53003 (blocked by conditional access). The administrator can create an exception for the OneDrive desktop client or adjust the policy to allow silent token acquisition for the device.

If OneDrive Still Has Issues After the Main Fix

OneDrive Shows Error 0x8004de40 After Clearing Tokens

This error indicates that the WAM token store is still corrupted. Run the PowerShell command from Method 4 again, then delete the following folder: %localappdata%\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy. Restart the device and retry OneDrive sign-in.

OneDrive Prompts for Password Every Time the PC Restarts

This symptom usually means the device is not fully Entra joined. Re-run the verification from Method 1. If the device shows “Registered” after reconnection, the organization may require a hybrid join configuration. Contact your IT department to enable Entra hybrid join.

Other Apps Also Fail to Sign In Silently

If Microsoft Teams, Outlook, or the Microsoft 365 apps also prompt for credentials, the issue is with the WAM service itself, not OneDrive. Run the command sfc /scannow in an elevated Command Prompt to repair system files, then run the PowerShell reset from Method 4 again.

Entra Joined vs Hybrid Joined vs Registered: Key Differences for Silent Sign-In

Item	Entra Joined	Hybrid Joined	Azure AD Registered
Device identity	Full device identity in Entra ID	Device identity synced from on-premises Active Directory	Only the user account is registered, not the device
Silent sign-in support	Yes, fully supported	Yes, but requires line-of-sight to domain controller for first sign-in	No, silent sign-in is not supported
OneDrive behavior	Signs in automatically without password	Signs in automatically after user authenticates to domain	Always prompts for credentials
Typical configuration	Windows 11/10 devices managed by Intune	Corporate devices joined to on-premises AD with sync to Entra ID	Bring-your-own devices with work or school account added

OneDrive silent sign-in only works when the device is Entra joined or hybrid joined. If your device shows as Azure AD Registered, silent sign-in will always fail. Rejoining the device as Entra joined is the only permanent fix in that scenario.

After completing the methods above, OneDrive should sign in automatically on your Entra joined device. If the issue persists, check the Entra ID sign-in logs for your account to identify the exact policy or token error. As an advanced tip, you can enable verbose OneDrive logging by setting the registry key HKEY_CURRENT_USER\Software\Microsoft\OneDrive\EnableLogging to 1 and reviewing the logs in %localappdata%\Microsoft\OneDrive\logs for the specific authentication failure code.