OneDrive and Outlook Desktop failing to authenticate - Sub status 6008, device-bound DPTI

Question

OS: Windows 11

ISSUE

OneDrive and Outlook desktop fail to authenticate corporate account with

"The credential is invalid. Unexpected sub status (6008)" immediately after

entering the email — before password prompt. Same account works normally

on Teams Desktop and all browser apps.

All errors share the same DPTI, confirming this is device-bound and not

an account or credential issue.

RECENT ERROR REFERENCES

• Correlation Id: [Moderator note: personal info removed] (OneDrive)
• Correlation Id: [Moderator note: personal info removed] (Outlook)
• Code: 2148073494 | Tag: 657rx

TROUBLESHOOTING ALREADY PERFORMED

1. Cleared Credential Manager and MSAL/Identity cache
2. Full OneDrive reset (onedrive.exe /reset)
3. Removed all workplace registrations (dsregcmd /leave)
4. dsregcmd /join fails with 0x80041326 on all parameters
5. Disabled WAM via registry (EnableADAL=0, DisableAADWAM=1)
6. Full PC restart
7. Re-registered device via Settings → Workplace Join

CURRENT STATE

• AzureAdJoined: NO
• WorkplaceJoined: YES
• AzureAdPrt: NO
• WamDefaultAuthority: consumers
• Teams Desktop authenticates successfully on the same device
• dsregcmd /join consistently fails with 0x80041326

Answer 1

Hi Igor Lucio,

Good day, and I appreciate the clear explanation of your concern. 

Based on the error message you encountered “The credential is invalid. Unexpected sub status (6008)” and Error “657rx” this typically indicates that the authentication process is failing to recognize the required identity on the device. While it may appear to be a credential issue, the behavior you described suggests it is more likely related to device-side authentication or token handling, rather than the account itself.

You’ve already taken the right approach by clearing credential caches and resetting components on the device, and I truly appreciate the thorough effort you’ve put into troubleshooting so far.

As an additional step, I recommend performing a deeper cleanup of the authentication cache using advanced scripts or system-level reset methods. This helps ensure that any residual or corrupted identity tokens are fully removed, allowing the device to re-establish a clean authentication session.

1. Please sign out your accounts from Office applications, then close all Office applications.   
2. Open File Explorer, paste the following path, and delete all files and folders. %localappdata%\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy   
3. In the Windows search bar, search for "Access Work or School".   
4. Check if you can see your school account in "Access Work or School".   

If you don't see it, please select Connect and add your business account.   

If you can see it, please select it and select Disconnect. After that, please click "Connect" and log into your account again to register the device.   

• Open the Control Panel on your PC.   
• Go to User Accounts > Credential Manager.   
• Under both Windows Credentials and Generic Credentials, look for any entries related to your Microsoft 365 business account and Office apps.   

• Select and remove those entries.   
• Restart your computer and try adding your account in Office again.  
• Download OLicenseCleanup.vbs and run it. In this way, you can use this package to remove the license, clear the stored identities in the registry, and remove the credentials. You can follow this: Reset activation state for Microsoft 365 Apps for enterprise - Microsoft 365 Apps | Microsoft Learn to reset activation state 
• Restart your device.
• Reopen Office apps and sign in with the correct account.

However, some of the steps you performed earlier may influence the outcome. You may want to consider reverting those changes back to their default state before proceeding with clearing the credential cache, to ensure the reset process completes correctly.

If the issue persists, the most effective next step is reaching out to your IT admin and ask them to use their admin credentials to submit a support request through the Microsoft 365 Admin Center.

Microsoft also provides customer service phone numbers based on your region. Your IT admin can find the appropriate contact number here: Customer service phone numbers - Microsoft Support 

This route ensures that a Microsoft support engineer can initiate a remote session to investigate backend configurations, run advanced diagnostic tools, and, if necessary, escalate the case to specialized teams with access to internal systems and logs. These backend resources are essential for resolving issues that go beyond what’s visible in the user interface.
 In case you do not know who is your IT admin, kindly refer to this article: How do I find my Microsoft 365 admin? - Microsoft Support 

As community moderators, we’re here to guide you, but due to privacy and security limitations, we don’t have access to the backend tools required for a full resolution. For this reason, contacting Microsoft Support via the Admin Center is the most secure and efficient way forward.

I hope this helps you resolve the issue quickly. I’m glad to assist and truly hope the information provided has been useful. Please feel free to reach out anytime if you need further assistance.  

If you find my post helpful, kindly consider marking it as the accepted answer. Doing so can assist others in the community who may have similar questions in finding solutions more quickly.  

Thank you for your kindness and contributions to the forum. 

---

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.  

Answer 2

Based on the symptoms and current state, the issue is a device-side authentication problem, not an account problem. The key indicators are:

• AzureAdJoined: NO
• WorkplaceJoined: YES
• AzureAdPrt: NO
• WamDefaultAuthority: consumers
• OneDrive and Outlook fail before password, but Teams and browser sign-in work
• dsregcmd /join fails consistently

This aligns with device identity / WAM-related failures rather than user credential issues.

Recommended steps, in order:

1. Verify device is not disabled or deleted in Microsoft Entra ID
   • In the Microsoft Entra admin center, check whether this device object exists and is enabled.
   • If the device is disabled, enable it. If it was deleted, allow it to fully resync or recreate as needed.
   • If the device was removed due to security concerns, follow internal policy before re-enabling.
   The documented behavior for similar errors is that a disabled or removed device causes AADSTS errors and device-auth failures. The resolution is to enable or recover the device object in Entra ID or Active Directory, depending on how it is joined.
2. Check AAD event logs for device-auth errors
   • Open Event Viewer → Applications and Services Logs → Microsoft → Windows → AAD → Operational.
   • Look for events around the time of the failed sign-ins, especially entries with AADSTS codes or device-authentication failures (for example, messages like Device is not authenticated).
   • Use the error codes from Event ID 1007 and related events to correlate with Entra-side errors and confirm whether the device is being rejected.
3. If the device was previously hybrid-joined or Entra-joined, perform a clean rejoin For hybrid-joined devices (domain-joined + Entra):
   • Run dsregcmd /status and confirm whether DomainJoined : YES and AzureAdJoined : NO.
   • If the device should be hybrid-joined, follow the documented recovery pattern:
     • Run dsregcmd /leave in an elevated Command Prompt.
     • Restart the device.
     • Allow the hybrid join process (GPO / scheduled task) to re-register the device.
   For pure Entra-joined or work-account-only devices:
   • Remove the work account from Settings → Accounts → Access work or school.
   • Restart the device.
   • Re-add the work account or re-join to Entra as appropriate.
4. Repair WAM (Web Account Manager) components Even though WAM was disabled via registry, OneDrive and Outlook modern auth rely heavily on WAM when enabled. When re-enabling WAM, repair the WAM-related packages:
   • In user-mode PowerShell, run the documented repair commands for the AAD Broker Plugin and Cloud Experience Host:

          Add-AppxPackage -Register "$env:windir\SystemApps\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Appxmanifest.xml" -DisableDevelopmentMode -ForceApplicationShutdown
          Add-AppxPackage -Register "$env:windir\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\Appxmanifest.xml" -DisableDevelopmentMode -ForceApplicationShutdown
     

   • Reboot after running these commands.
   • Remove the WAM-disabling registry settings (EnableADAL/DisableAADWAM) if the environment requires WAM for Office apps.
   This is the documented mitigation when security software or profile issues corrupt or interfere with WAM and cause sign-in failures in desktop apps.
5. Consider security software / profile management impact
   • If endpoint security, EDR, or profile management tools are in use, verify they are not blocking or isolating AAD.BrokerPlugin or related components.
   • For non-persistent or heavily managed profiles (VDI scenarios), ensure device identity and profile handling follow the documented guidance for device identity and desktop virtualization.
6. If dsregcmd /join continues to fail
   • Because dsregcmd /join fails with the same code across all parameters, focus on:
     • Device object state in Entra ID (disabled/deleted/blocked).
     • Network/proxy requirements for device auth to Entra (device account must reach Entra endpoints and any outbound proxy silently).
   • Use the AAD event log error codes (STATUS_* or AADSTS*) from Event ID 1007 to map to the documented causes and solutions for device-auth failures.

Once the device is correctly joined (AzureAdJoined = YES or expected hybrid state) and a valid PRT is issued (AzureAdPrt = YES), OneDrive and Outlook desktop should authenticate normally, matching the behavior already seen in Teams and browser apps.

---

References:

• Connection issues when signing in after updating to Office 2016 build 16.0.7967 on Windows 10
• Error “Something Went Wrong [1001]” signing in to Microsoft 365 Desktop Applications
• Error “Something Went Wrong [1001]” signing in to Microsoft 365 Desktop Applications
• Authentication fails when a device is Workplace Joined by using Azure DRS
• Troubleshoot primary refresh token issues on Windows devices
• New AutoPilot Windows 11 build, OneDrive fails to create folder - Microsoft Q&A
• Device management could not be enabled - Microsoft Q&A