When Teams can't sign a user in, it shows a status code in the bottom-left corner of the sign-in window. Those 0xCAA… codes describe what the device saw (a timeout, a missing proxy, a clock problem), while Microsoft Entra ID records the reason it refused, as an AADSTS code, in the sign-in log. This quick reference covers both, with the usual cause and the first thing to check.
Codes in this quick reference
0xCAA82EE2: The request has timed outTeams sign-in screen0xCAA82EE7: The server name couldn't be resolvedTeams sign-in screen0xCAA70004: The server or proxy wasn't foundTeams sign-in screen0xCAA70007: The download has failed because the connection was interruptedTeams sign-in screen0xCAA20003: You ran into an authorization problem (device date and time)Teams sign-in screen0xCAA20004: Your request needs to be approved by a resource owner or authorization serverTeams sign-in screen0xCAA90018: You're not using the right credentialsTeams sign-in screenNo code: You'll need to re-enter your PIN using a smart cardTeams sign-in screen
+ 11 more codes in the tables below.
How to read these codes#
- On the device. Ask the user for the status code and the time it happened. Among the codes Microsoft documents, those starting
0xCAA7and0xCAA82Econcern the network path, while0xCAA2and0xCAA9codes concern authorization or credentials. If Outlook and other Office apps fail as well, the problem usually sits in the sign-in components the apps share on the device, not in Teams. - In Microsoft Entra ID. Open Entra ID › Monitoring & health › Sign-in logs, filter on the user and the Microsoft Teams application, and read the failure reason and the Conditional Access tab. No entry at all usually means the request never reached Entra ID, so look at the network.
- Microsoft's diagnostics. In the Microsoft 365 admin center, run the Teams Sign-in diagnostic and enter the affected user. The Teams Sign in test in the Microsoft Remote Connectivity Analyzer checks the same account from outside your network. Neither is available in every cloud (the diagnostic isn't offered in Microsoft 365 Government or 21Vianet, and the analyzer doesn't support GCC or GCC High).
PowerShell
Connect-MgGraph -Scopes "AuditLog.Read.All","Directory.Read.All"
Get-MgAuditLogSignIn -Filter "appDisplayName eq 'Microsoft Teams' and userPrincipalName eq 'user@contoso.com'" -Top 20 |
Select-Object CreatedDateTime, ClientAppUsed, IPAddress,
@{n='Code';e={$_.Status.ErrorCode}}, @{n='Reason';e={$_.Status.FailureReason}}Network and connectivity codes#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
0xCAA82EE2 | "The request has timed out." | No working route to Microsoft 365, or a firewall or other app blocking it | Internet access, then the Microsoft 365 URLs and IP ranges on the firewall and proxy; Microsoft also points to its network assessment tool |
0xCAA82EE7 | "The server name couldn't be resolved." | DNS or connectivity, or a firewall rule | Name resolution of Microsoft 365 endpoints from the device, then the same firewall checks |
0xCAA70004 | "The server or proxy wasn't found." | A misconfigured proxy, or a traffic inspector such as Fiddler running without HTTPS decryption set up | Proxy settings; stop the tool and relaunch Teams. If other Office apps fail too, see Microsoft's article on sign-in connection issues after the Office 2016 build 16.0.7967 update |
0xCAA70007 | "The download has failed because the connection was interrupted." | Unstable connection, or another app or firewall cutting it | Connection stability and firewall; same Office article if other apps fail |
Authorization, credential and policy codes#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
0xCAA20003 | "You ran into an authorization problem." | Wrong date or time on the device, so secure (https) connections fail | Set the time automatically and confirm the time zone |
0xCAA20004 | "Your request needs to be approved by a resource owner or authorization server." | Conditional Access | The Teams sign-in log entry: which policy applied and which grant failed. Guide |
0xCAA90018 | "You're not using the right credentials." | The Windows credentials differ from the user's Microsoft 365 credentials | Sign in with the correct work account; compare the Windows sign-in with the user's UPN |
| No code | "You'll need to re-enter your PIN using a smart card." | Smart card removed, or its certificate is corrupt | Reinsert the card; reissue the certificate if it persists |
Device and client issues#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
80090016 | "Your computer's Trusted Platform Module has malfunctioned." | Reported by admins: the device's stored sign-in keys no longer match, for example after a TPM or motherboard change or a damaged token cache | Admins report success with disconnecting and reconnecting the work account under Settings › Accounts › Access work or school. Don't clear the TPM on a work PC unless IT says so: Microsoft warns that it deletes TPM-protected keys such as a sign-in PIN. Guide |
| No code | The Teams web client keeps returning to sign-in | Browser settings for the user's preferred browser | Microsoft's "Teams is stuck in a login loop" article for that browser; test in another browser |
AADSTS codes behind Teams sign-in failures#
These come from Microsoft Entra ID and are covered in depth in the AADSTS error code quick reference; here is how they show up in Teams.
| Code | Meaning | Usual cause in Teams | First check |
|---|---|---|---|
AADSTS53003 BlockedByConditionalAccess | A policy doesn't allow the token | A block for a location, platform or client app hits Teams | Conditional Access tab, then What If. Guide |
AADSTS53000 DeviceNotCompliant | A compliant device is required | Teams opened on an unenrolled or noncompliant device | Device compliance in Intune. Guide |
AADSTS50076 UserStrongAuthClientAuthNRequired | MFA is required | Policy or a new location; often an interrupt before success | Whether a later attempt succeeded. Guide |
AADSTS50079 UserStrongAuthEnrollmentRequired | MFA registration is required | First Teams sign-in after MFA enforcement | Registration settings; a Temporary Access Pass. Guide |
AADSTS70043 BadTokenDueToSignInFrequency | Refresh token expired under sign-in frequency | Teams asks the user to sign in again on schedule | Expected behavior; review the policy. Guide |
AADSTS50020 UserUnauthorized | The account isn't in the tenant being accessed | A guest who was never invited, was removed, or picked the wrong organization | The guest user object and its redemption state. Guide |
AADSTS90072 | External account isn't in the tenant, so MFA can't be satisfied | A guest signing in with an identity that doesn't match the invitation | Which account the guest used. Guide |
AADSTS500213 NotAllowedByInboundPolicyTenant | The resource tenant blocks this user | Cross-tenant access settings for guests or shared channels | Inbound settings for that organization. Guide |
AADSTS500014 | The resource's service principal is disabled | A lapsed subscription or a disabled app; admins have reported it for a Teams resource together with client code CAA2000B | Enterprise applications: find the disabled Microsoft app and its Enabled for users to sign-in? setting. Guide |
Triage in three questions#
- Does Teams on the web work for the same user? If yes, the account, license and policies are probably fine; focus on the device, its network path and the desktop app.
- Do other Microsoft 365 apps fail on the same device? If yes, look at the device's shared sign-in state (credentials, device registration, TPM) rather than Teams.
- Is there a failed entry in the sign-in log? If yes, its AADSTS code and Conditional Access results tell you what Entra ID refused. If not, the request never arrived: check DNS, proxy and firewall.
Before escalating, check that the client is current (Settings and more › Check for updates). Microsoft's last resort is a clean reinstall of Teams, including removing the old Teams folder from the user's profile. If you open a support request, include the status code from the sign-in screen and the Teams debug logs.
Patterns that point to the cause#
- Everyone at one site sees
0xCAA82EE2or0xCAA82EE7at the same time: suspect that site's proxy, firewall or DNS, not the users. - One user, every Microsoft 365 app, after a hardware repair or a profile change: suspect the device's sign-in state (
80090016is typical) and reconnect the work account before going anywhere near the TPM. - Only guests or partner users: check the guest objects and cross-tenant access settings (
AADSTS50020,AADSTS90072,AADSTS500213). - Right after a Conditional Access change: compare the failed sign-in's Conditional Access tab with the change, and use report-only mode to test the next one.
- Nobody in the tenant can sign in: check Service health in the Microsoft 365 admin center first.
How to verify a fix#
- The user signs in to the Teams desktop app without a status code, and chat and presence load.
- The sign-in log shows a successful Microsoft Teams sign-in from the same device and network, with the expected Conditional Access results.
- The Teams Sign-in diagnostic reports no issues for the user.
- For network codes, test again from the user's real location, VPN state and proxy, not from an admin workstation.
References#
- Resolve sign-in errors in Teams (Microsoft Learn)
- Why am I having trouble signing in to Microsoft Teams? (Microsoft Support), the source of the status code descriptions
- Troubleshoot the TPM (Microsoft Learn)
