Hello community,
Posting this because I spent quite a bit of time tracking down a resolution.
If you are trying to activate Office, sign into Microsoft 365 desktop applications, or simply add a Microsoft work account and receive only “Something went wrong. Please try again.” with no useful error code, this may be worth checking.
In my case:
- Microsoft 365 worked normally in a browser.
- Office desktop applications would not authenticate.
- Reinstalling/repairing Office did not resolve the problem.
- SFC and DISM did not resolve it.
- Clearing OneAuth, TokenBroker, IdentityCache, and AAD BrokerPlugin data did not resolve it.
-
Microsoft.AAD.BrokerPlugin itself was installed and reported Status: OK.
Reviewing the Microsoft-Windows-AAD/Operational log showed errors including:
- 0xCAA100D8
- A login hint was sent that doesn't match any WebAccount in the system.
I also found an old/stale Microsoft Entra registered device object for the computer in the Entra admin center.
This computer intentionally uses a local Windows account and is not supposed to be Entra joined, Entra registered, or Intune managed.
What ultimately resolved the problem was:
1. Remove the stale device registration from Microsoft Entra ID
I located the affected computer under Entra ID → Devices and deleted the stale Microsoft Entra registered device object.
2. Prevent Windows from attempting Workplace Join on this PC
From elevated PowerShell:
New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WorkplaceJoin" -Force | Out-Null
New-ItemProperty `
-Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WorkplaceJoin" `
-Name "BlockAADWorkplaceJoin" `
-PropertyType DWord `
-Value 1 `
-Force
This creates:
- HKLM\SOFTWARE\Policies\Microsoft\Windows\WorkplaceJoin
- BlockAADWorkplaceJoin = 1
After rebooting, Microsoft 365/Office authentication began working normally again.
Important: I would only recommend this workaround where the computer is intentionally supposed to remain a local/unmanaged device. Do not blindly apply BlockAADWorkplaceJoin to computers that are supposed to be Microsoft Entra registered/joined or managed through Intune.
Hopefully this saves someone else the troubleshooting time.