Quick answer: “A required authentication broker is missing” means the Windows component that signs Microsoft 365 apps in to your work or school account, the Microsoft.AAD.BrokerPlugin system app, is missing, damaged or blocked. Restart and update Windows, then re-register the broker with one PowerShell command (below). If that doesn’t help, run Microsoft’s Access work or school troubleshooter, reconnect the account, or repair Microsoft 365 apps.
Applies to: Outlook, Teams, Word, Excel, OneDrive and other Microsoft 365 apps on Windows 11 and Windows 10, signed in with a work or school (Microsoft Entra ID) account.
In this guide
What the error means
Microsoft 365 apps on Windows don’t handle your work password themselves. They ask a built-in Windows service, the Web Account Manager, for a sign-in token, and it uses a system app called the Work or school account broker (Microsoft.AAD.BrokerPlugin) to talk to Microsoft Entra ID. If that app isn’t registered for your user profile, has a damaged cache, or is blocked by security software, the apps can’t get a token and show this error. It often appears after a Windows update, a profile migration, or a clean-up tool removing “unused” apps.
Quick checks first
- Restart the PC. A pending update can leave the broker half-installed until the next restart.
- Install pending updates in Settings > Windows Update, then restart again.
- Try signing in at
office.comin a browser. If that fails too, the problem is your account or your organization’s policy, not the PC; contact your IT team. - If you use a third-party antivirus or a “debloat” tool, check whether it blocked or removed Windows system apps.
Fix 1: Re-register the authentication broker
Close all Microsoft 365 apps. Open Windows PowerShell from the Start menu as your normal user (not as administrator, because the app is registered per user) and run:
if (-not (Get-AppxPackage Microsoft.AAD.BrokerPlugin)) { Add-AppxPackage -Register "$env:windir\SystemApps\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Appxmanifest.xml" -DisableDevelopmentMode -ForceApplicationShutdown }
Get-AppxPackage Microsoft.AAD.BrokerPluginThe last command should list the package with a Status of Ok. If PowerShell says the manifest file can’t be found, the system files themselves are damaged; run DISM /Online /Cleanup-Image /RestoreHealth and sfc /scannow in an admin Command Prompt, restart, and try again. Then open Outlook or Teams and sign in.
Fix 2: Run the Access work or school troubleshooter
Microsoft has an automated troubleshooter for Microsoft 365 desktop sign-in problems. Open the Get Help app, search for Access work or school troubleshooter, and follow the steps. It checks the broker and the account connection and can repair common problems for you. The official page is linked in the sources below.
Fix 3: Reconnect the work or school account
Open Settings > Accounts > Access work or school. If your work account is listed there as a work or school account, select it and choose Disconnect, restart, then sign in again from Outlook or Teams. Windows adds the account back automatically.
If the entry says the PC is connected to your organization’s Microsoft Entra ID (or Azure AD), the whole device is joined: don’t disconnect it unless IT tells you to; doing so can remove the device from management. If the account shows that the device was removed, see Your organization has deleted this device.
Fix 4: Clear the broker cache
A damaged token cache can cause the same error. Sign out of Microsoft 365 apps, close them, then open File Explorer and go to:
%LOCALAPPDATA%\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewyRename the folder to Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy.old (if Windows says it’s in use, restart and try again before opening any Office app), then run the PowerShell command from Fix 1 and sign in again. Renaming instead of deleting lets you undo the change. You’ll have to sign in to your work apps again afterwards.
Fix 5: Repair Microsoft 365 apps
Open Settings > Apps > Installed apps, find Microsoft 365 (or Microsoft Office), select the three dots and choose Modify. Try Quick Repair first, and Online Repair if that doesn’t help. In Windows 10, the list is under Settings > Apps > Apps & features. If Teams alone fails, see how to fix Teams not connecting.
For IT admins
If many users see the error, check whether AppLocker, Windows Defender Application Control or a security tool blocks apps under C:\Windows\SystemApps, whether a user profile tool such as FSLogix excludes the broker’s package folder, and whether provisioning scripts removed system packages. Microsoft’s Microsoft 365 sign-in troubleshooting article covers the Web Account Manager in more detail. Device enrollment problems are covered in Device management could not be enabled.
Related guides
- Teams not connecting: how to fix it
- How to remove an account from Teams
- Your organization has deleted this device: how to fix it
- Device management could not be enabled: how to fix it
- Outlook classic download: how to get it back
- How to fix error 0x801c001d (Microsoft Entra hybrid join)
Official sources:
- Microsoft Support: Access work or school troubleshooter for Microsoft 365 desktop apps
- Microsoft Learn: Can’t sign in to Microsoft 365 desktop apps
Frequently asked questions
Is it safe to re-register the broker?
Yes. The command only registers a Windows system app that should already be there for your profile. It doesn’t remove anything or change your account.
Why does it work on another PC?
The broker is registered per Windows user profile, so one damaged profile or PC can fail while others work fine with the same account.
Can I use the apps while I fix it?
Yes. Outlook, Teams, Word and the other apps work in a browser at office.com, which doesn’t use the Windows broker.
Leave a Reply