MS Office App sign-in issues

The Office desktop apps use different sign-in components than the browser, so they can show an “you’ll need the internet for this” or similar error even when the general network connection works. Common causes are blocked authentication processes, firewall/proxy restrictions, or local sign-in components being corrupted.

Use these targeted checks and fixes:

1. Confirm the specific Office sign-in issue
   On Windows 10/11 with Office 2016 or Microsoft 365 Apps, this is a known issue where Office shows:

   "You'll need the internet for this. We couldn't connect to one of the services we needed to sign you in. Please check your connection and try again. 0xCAA70007"

2. Check that Office can reach Microsoft’s sign-in service
   Even if other sites work, a firewall, antivirus, or network device can block Office’s token acquisition:
   • In Edge (not Internet Explorer), go to https://login.microsoftonline.com. You should be redirected to https://www.office.com or your normal landing page.
   • Repeat in an InPrivate window.
     If either fails, the problem is with the network, firewall, or antivirus blocking Office sign-in.
3. Unblock the required Windows processes
   Local security software can block the components Office uses to sign in:
   • Ensure your firewall/antivirus and Windows Defender do not block:
     • C:\Windows\SystemApps\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Microsoft.AAD.BrokerPlugin.exe
     • C:\Windows\System32\backgroundTaskHost.exe
   • Also ensure the network does not block https://login.microsoftonline.com (this endpoint maps to many IPs; partial blocking can cause intermittent sign-in failures in Office while the browser appears fine).
4. Check for security software interfering with the AAD Broker plugin
   On some devices with security software, the AAD Broker plugin (used by Office, Outlook, Teams, etc.) fails to load settings and causes blank or stuck sign-in windows. In Event Viewer under Windows Logs > Application, warnings from AppModel-State mentioning Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy and error codes -2147xxxxxx indicate this condition. In that case, adjust or temporarily disable the security software so it no longer interferes with the AAD Broker plugin.
5. General non‑browser app connectivity checks
   If non-browser apps (Office, Outlook, Teams) can’t sign in but the browser can:
   • Verify basic connectivity: from a command prompt, use ipconfig and ping to confirm IP connectivity and nslookup www.msn.com to confirm DNS resolution.
   • If using an authenticating proxy or enterprise firewall, configure exceptions so Microsoft 365 traffic is not blocked or re-authenticated. For example, allow outbound TCP/HTTPS (ports 80/443) to:
     • *.microsoftonline.com
     • *.microsoftonline-p.com
     • *.sharepoint.com
     • *.outlook.com
     • *.lync.com
     • osub.microsoft.com
   • Ensure any HTTPS/SSL timeout on the proxy is long enough (for example, 8 hours) so Office tokens are not dropped prematurely.
6. Optional automated repair
   If available in the environment, run the Microsoft Support and Recovery Assistant for Office sign-in issues (SaRA-OfficeSignInScenario) to automatically detect and fix common Office sign-in problems.

These steps address the typical reasons Office desktop apps cannot sign in even though the Microsoft account works in a browser: blocked AAD Broker processes, network/proxy restrictions, or corrupted local sign-in components.

References:

• Connection issues when signing in after updating to Office 2016 build 16.0.7967 on Windows 10
• Can't sign in to Microsoft 365 desktop applications
• How to troubleshoot non-browser apps that can't sign in to Microsoft 365, Azure, or Intune