icrosoft 365 desktop apps fail to sign in to school account – AADSTS9002313 (invalid_grant)

Mohammad Mehdi Banoei 0 Reputation points
2026-11-06T01:11:19.0366667+00:00

Hello Microsoft Support,

I can't sign in to the Microsoft 365 desktop apps (Word, Outlook) with my school account ( University of Calgary) on my Windows 11 laptop. After I enter my password and approve the Microsoft Authenticator code, a "Something went wrong – Please try again" window appears, with no error code, and the sign-in fails.

What works and what doesn't:

  • Signing in through the browser (office.com, outlook.office.com) works normally.
  • Some of my other devices that were already signed in still work.
  • The problem happens on my main laptop and also on a second, brand-new laptop where Office was freshly installed.
  • It also fails for a newly created local Windows user on the main laptop.

Error details from Event Viewer (Microsoft-Windows-AAD/Operational):

  • Event 1098: Error 0xCAA20003, invalid_grant, AADSTS9002313: Invalid request. Request is malformed or invalid.
  • Event 1097: Error 0xCAA90004, getting token by refresh token failed.
  • Earlier: Error 0xCAA100D8, a login hint was sent that doesn't match any WebAccount in the system.
  • Correlation ID: <Moderator's note: Personal Identifiable Information removed>
  • Trace ID: <Moderator's note: Personal Identifiable Information removed>
  • Timestamp: 2026-11-02 16:03:57 UTC
  • Tenant: <Moderator's note: Personal Identifiable Information removed>
  • Client: <Moderator's note: Personal Identifiable Information removed> (Microsoft Office)

Device: ASUS VivoBook X515EA, Windows 11 (build 26200), Microsoft 365 Apps.

What I have already tried:

  • Removed the school account from Settings > Access work or school and Email & accounts
  • Deleted the school-related entries in Credential Manager
  • Cleared the OneAuth, IdentityCache and TokenBroker cache folders
  • Checked and cleared the Office Identity registry keys
  • Reset and re-registered the Microsoft.AAD.BrokerPlugin package
  • Deleted the MS-Organization-Access certificate and the WorkplaceJoin registry key, then signed in again (both "this app only" and "allow my organization to manage my device")
  • Ran Office Online Repair
  • Rolled back the October 2026 Windows updates (including the 26H2 enablement package), then reinstalled them
  • Tried a different Windows user profile

My university's IT service asked me to contact Microsoft directly. Could you please look up the correlation ID above and tell me why the token request is being rejected, and what needs to be changed (on my device or on the account/tenant side) so I can sign in again?

Thank you for your help.

Best regards,

Mehdi Banoei

Microsoft 365 and Office | Subscription, account, billing | For education | Other
0 comments

1 answer

Sort by: Newest
Most helpful Newest Oldest
  1. Rukshan edirisinghe 2,365 Reputation points
    2026-11-06T01:55:38.1866667+00:00

    Hi @Mohammad Mehdi Banoei

    You've already done a very thorough local cleanup. The detail that matters most is that it also fails on a brand-new laptop and for a new local Windows user. That rules out your profile, caches and Office install. When browser sign-in works but the Windows sign-in broker (the AAD/WAM log you found) gets invalid_grant / AADSTS9002313 on every device, the token request is being rejected on the identity side, for your account or by your university's sign-in policies. Nothing more on the laptop is likely to fix it.

    What I'd do next:

    1. Send it to University of Calgary IT, not Microsoft. Only the school's Entra admins can open their sign-in logs, search by your correlation ID and timestamp (you already have both), and see which policy or account setting rejected the desktop request. Policies like Conditional Access, device compliance or token protection often block desktop apps while still allowing browser sign-in.
    2. Give them exactly what you posted here: AADSTS9002313, the event 1098/1097 errors, the timestamp, and the note that it fails on two laptops and a new local user. That saves them a lot of back-and-forth.
    3. In the meantime, use Word and Outlook on the web (office.com), which you've confirmed still work.

    Please keep sharing the correlation and trace IDs only with your IT team, not publicly.

    Did your university recently ask you to re-register for MFA or enrol your device, or did this start without any change on your side?

    If your IT team finds the cause from the logs, please consider accepting this as the answer. If they find nothing on their side, let me know and I'll be happy to keep helping.

    Reference:

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.