Fixes / Teams · Checked September 30, 2026

Teams error CAA50021: what it means and how to fix it

Short answer

Teams error CAA50021 means the Windows sign-in component that Teams relies on (Web Account Manager) tried to get a token for your work account too many times and gave up. It usually comes from stale cached accounts or a broken device registration. The most likely fix is to remove old Office and Teams credentials, disconnect extra work accounts under Access work or school, then restart.

What this message means

CAA50021 is a Windows sign-in error (full code 0xCAA50021). Teams on Windows does not sign you in by itself. It asks Windows' Web Account Manager (WAM), through the Microsoft.AAD.BrokerPlugin component, for a token for your work or school account. When the broker keeps failing and passes its retry limit, you get "Number of retry attempts exceeds expectation". Outlook, OneDrive and Office activation can show the same code because they all use the same broker. The usual causes are cached tokens that no longer match your account (often after a password change), a second work account conflicting with the one your organization manages, a broken or expired Microsoft Entra ID (Azure AD) device registration, or security software blocking the broker.

Common causes

Cause	How to tell
Stale cached credentials or tokens after a password change or account change	The error started right after you changed your password or your account was migrated, and Outlook or OneDrive also keep asking you to sign in or fail with the same code.
Conflicting work or school accounts in Windows	Settings > Accounts > Access work or school lists more than one work account, or lists an account that isn't the one you use for Teams (for example an old employer or a client's tenant).
Broken or expired Microsoft Entra ID (Azure AD) device registration	Running dsregcmd /status shows AzureAdPrt : NO, DeviceAuthStatus is FAILED, or the SSO State section reports a failed PRT attempt with an error code.
Antivirus, firewall, proxy or VPN blocking the sign-in broker	Sign-in works on another network or with the VPN off, or your security software logs blocks for Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy.
Corrupt sign-in broker data on the PC	Sign-in keeps failing even after you remove credentials, and the same account works fine in Teams on the web (teams.microsoft.com) or on another computer.
Tenant-side settings such as a missing license or device registration being disabled	Several people in your organization see CAA50021 on new PCs, or the account works on an existing PC but fails on every newly set up one.

How to fix it

1. Remove cached Office and Teams credentials

Windows 10 and Windows 11

Quit Teams completely: right-click the Teams icon in the taskbar notification area and select Quit.
Open Start, type credential manager and open Credential Manager.
Select Windows Credentials.
Remove every entry whose name starts with MicrosoftOffice16 or contains msteams or Teams (open each with the arrow, then select Remove).
Restart the PC, open Teams and sign in again.

2. Disconnect extra work or school accounts

Windows 10 and Windows 11. Do not disconnect the account you use to sign in to Windows itself.

Open Settings > Accounts > Access work or school.
Look for work or school accounts other than the one you use in Teams, or old accounts you no longer use.
Select that account and choose Disconnect, then confirm.
Restart the PC.
Open Teams and sign in with your work account. If Windows asks to let your organization manage the device, follow your IT department's policy.

3. Clean up Web Account Manager accounts with dsregcmd

Windows 10 and Windows 11. Needs administrator rights. Widely confirmed on Microsoft Q&A, not in Microsoft's official CAA50021 steps.

Quit Teams, Outlook and OneDrive.
Open Start, type cmd, right-click Command Prompt and select Run as administrator.
Run: dsregcmd /cleanupaccounts
Restart the PC.
Sign in to Teams again, then to Outlook and OneDrive if they ask.

4. Rule out antivirus, VPN or proxy blocking the sign-in broker

Disconnect from your VPN and try to sign in to Teams again.
If you use third-party antivirus or firewall software, pause it briefly and try again.
If sign-in now works, add an exception for Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy, then turn protection back on.
On a company network, ask IT whether a proxy or firewall blocks the broker or login.microsoftonline.com.

5. Delete the sign-in broker's token cache and reset Teams

Windows 10 and Windows 11, new Teams

Quit Teams, then press Windows key + R.
Paste %LOCALAPPDATA%\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\AC\TokenBroker\Accounts and press Enter. Select all files (Ctrl + A) and delete them.
Repeat for %LOCALAPPDATA%\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AC\TokenBroker\Accounts.
Reset Teams: Settings > Apps > Installed apps, search Microsoft Teams, select the three dots (...) > Advanced options > Reset.
Restart the PC and sign in to Teams.

6. Re-register the device with Microsoft Entra ID (IT admin)

Microsoft Entra joined or hybrid joined Windows PCs. Leaving Entra ID can stop users from signing in to Windows with their work account, so IT should do this.

In an administrator Command Prompt, run dsregcmd /status and check AzureAdJoined, DeviceAuthStatus and AzureAdPrt.
If AzureAdJoined is YES but the PRT or device auth is failing, run dsregcmd /leave, then dsregcmd /status to confirm AzureAdJoined is NO.
Restart the device and run dsregcmd /status again. Hybrid joined devices normally rejoin automatically.
If it doesn't rejoin, run psexec -i -s cmd.exe (Sysinternals PsExec), then dsregcmd /join in the new window.
In the Microsoft Entra admin center (Devices > All devices > Device settings), check that users are allowed to join and register devices, and in the Microsoft 365 admin center check that the user has a Teams license.

Next time, skip the search

Crade is an AI assistant for Mac and Windows that sees your screen. When a message like this pops up, ask “what does this mean?” and it explains the exact error in front of you, step by step.

Download Crade

Still not fixed?

Check whether the same account works in Teams on the web at teams.microsoft.com. If it does, the problem is on your PC. If it doesn't, the problem is with the account or tenant. Either way, send your IT admin the error code CAA50021, the time it happened and the output of dsregcmd /status. They can run the Teams Sign-in diagnostic in the Microsoft 365 admin center, look at the Entra sign-in logs for your account, and open a Microsoft support request with Teams debug logs if needed. Microsoft's Get Help app also has a Microsoft 365 sign-in troubleshooter that checks the same broker settings.

Questions people ask

What does "Number of retry attempts exceeds expectation" mean in Teams?

The Windows sign-in broker tried to get a token for your work account several times, failed each time, and stopped. It doesn't mean your password is wrong. It usually points to stale cached credentials or a device registration problem.

Why do Outlook and OneDrive show CAA50021 too?

Teams, Outlook, OneDrive and Office activation all sign in through the same Windows component (Web Account Manager). When it breaks, every app that uses it fails with the same code, and fixing it once fixes them all.

Is dsregcmd /cleanupaccounts safe to run?

It removes cached work and school account tokens from Web Account Manager on that PC, so you will have to sign in to Teams, Outlook and OneDrive again. It doesn't unjoin the device or delete files. dsregcmd /leave is the command that removes the device from Entra ID and should be left to IT.

Can I still use Teams while the desktop app shows CAA50021?

Usually yes. Teams on the web at teams.microsoft.com uses browser sign-in instead of the Windows broker, so it often works while the desktop app is failing.

Does CAA50021 happen on Mac?

It's a Windows-specific code tied to Web Account Manager and Microsoft Entra device registration. On a Mac, Teams sign-in problems show different codes and are usually fixed by clearing the Teams cache or checking the Keychain.

Sources

Related errors