Microsoft 365 Apps activation error 0xCAA50021

  • Article
  • Applies to:
    Microsoft 365

When activating Microsoft 365 apps, you might encounter the following error:

ERROR: 0xCAA50021

Try the following troubleshooting methods to solve the problem.

Note Some of these troubleshooting methods can only be performed by a Microsoft 365 admin. If you aren’t an admin, see How do I find my Microsoft 365 admin?

Reset Microsoft 365 activation state

Run the Microsoft Support and Recovery Assistant (SaRA) to reset the Microsoft 365 activation state.

For manual steps or more information, see Reset Microsoft 365 Apps for enterprise activation state.

Remove Office credentials
  1. From Start, type credential manager, and then select Credential Manager from the search results.
  2. Select Windows credentials.
  3. If there are any credentials for MicrosoftOffice16, select the arrow next to them and then select Remove.
  4. Close Credential Manager.
  5. From Start, select Settings (the gear icon) > Accounts > Access work or school.
  6. If the account you use to sign in to office.com is listed there, but it isn’t the account you use to sign in to Windows, select it, and then select Disconnect.
  7. Restart the device and try to activate Microsoft 365 again.

Perform a manual recovery

See the “Manual recovery” section of Connection issues in sign-in after update to Office 2016 build 16.0.7967 on Windows 10.



Check BrokerPlugin process

Some antivirus, proxy, or firewall software might block the following plug-in process:

Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy

Temporarily disable your antivirus software. Contact your system administrator to find out if you are behind a proxy or firewall that is blocking this process. If so, you will also need to temporarily disable your proxy or firewall connection. If you connect through a Virtual Private Network (VPN), you might need to temporarily disable your VPN also.

If the process isn’t blocked, but you still can’t activate Microsoft 365, delete your BrokerPlugin data and then reinstall it using the following steps:

  1. Open File Explorer, and put the following location in the address bar: %LOCALAPPDATA%\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\AC\TokenBroker\Accounts
  2. Press CTRL + A to select all.
  3. Right-click in the selected files and choose Delete.
  4. Put the following location in the File Explorer address bar: %LOCALAPPDATA%\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AC\TokenBroker\Accounts
  5. Select all files and delete them.
  6. Restart the device.
  7. Download and run the SaRA package for sign in issues.

For manual troubleshooting for step 7, or for more information, see Fix authentication issues in Office applications when you try to connect to a Microsoft 365 service.

Make sure user licenses are assigned
  1. In the Microsoft 365 Admin Center, go to the Users > Active users page.
  2. Select the row of the user that you want to assign a license to.
  3. In the right pane, select Licenses and Apps.
  4. Expand the Licenses section, select the boxes for the licenses that you want to assign, then select Save changes.
  5. If the license is already assigned, uncheck it, select Save changes, then check it again and select Save changes again.

Check if user device registration is enabled in Microsoft Entra ID
  1. Sign in to the Microsoft 365 Admin Center with a global administrator account.
  2. Select Microsoft Entra ID from the menu. If Microsoft Entra ID is not displayed in the menu, select Show All.
  3. Select Microsoft Entra ID in the menu of the Microsoft Entra admin center.
  4. Select Device > Device Settings.
  5. Make sure Users can join devices to Microsoft Entra ID is set to All.
  6. Make sure Users can register their devices with Microsoft Entra ID is set to All.

Leave and rejoin Microsoft Entra ID
  1. Open a Command Prompt window as an administrator. From Start, type cmd.exe in the search box, right-click Command Prompt in the list, and then select Run as administrator.
  2. Type the following command, and then press Enter: dsregcmd /status
  3. Check if the device is joined to Microsoft Entra ID. For more details, see Troubleshoot devices by using the dsregcmd command.
  4. If the AzureAdjoined value is YES, continue to step 5. If it’s NO, skip to step 11.
  5. Type the following command, and then press Enter: dsregcmd /leave
  6. Type the command dsregcmd /status again and press Enter.
  7. Verify that the AzureAdjoined value is NO.
  8. Restart the device.
  9. Open a Command Prompt as administrator, and type the dsregcmd /status command again.
  10. If the AzureAdjoined value is YES, try to activate Microsoft 365 Apps again. If it’s NO, continue to the next step.
  11. Download PsExec.
  12. Return to the Command Prompt and type the following command: psexec -i -s cmd.exe
  13. In the new Command Prompt window that opens, type the following command: dsregcmd /join
  14. Type the dsregcmd /status command again, and verify that the AzureAdjoined value is YES.
  15. Try to activate Microsoft 365 Apps again.

Additional troubleshooting

If the above steps don’t solve the problem, try the steps in the following articles: