A Tier-1 helpdesk card for "Outlook keeps asking for my password"
It's one of the most common tickets in any Microsoft 365 shop: "Outlook keeps popping up a password box. I type it, it goes away, and it comes back." Sometimes Teams and OneDrive do it too.
Most Tier-1 techs handle it from memory, and that's how you get a mix of results. One tech resets the password, which rarely fixes it and sometimes makes it worse. Another removes the work account from Windows and breaks single sign-on for the whole device.
A ticket card fixes that. It's one page: what the user sees, what to check in order, what Tier-1 is allowed to fix, and the exact point where you stop and escalate. Here's one you can copy into your knowledge base.
Scope: Windows 10/11 with Microsoft 365 Apps, Entra ID (Azure AD) accounts. Menu names move around, so check them against your build and your own policies.
The card
CARD: Outlook / M365 apps keep prompting for password (Windows)
SYMPTOMS
- Repeated password prompt in Outlook (sometimes Teams/OneDrive too)
- "Need password" banner in Outlook or OneDrive
- Password is accepted, then the prompt comes back minutes/hours later
- Often follows: password change, new laptop, VPN change, recent reboot
CHECKS (in order — stop when you find the cause)
1. Scope: one user or many? One app or all M365 apps?
Many users at once -> check service health / tell your lead. Don't touch devices yet.
2. Web test: can the user sign in at outlook.office.com in a private window?
- Fails -> account problem (password, lockout, MFA). Go to the password/MFA card.
- Works -> account is fine. Problem is on the device/app. Continue.
3. Recent password change? Other devices (phone, old laptop) may still be
using the old password and causing lockouts.
4. Device time: Settings > Time & language. Set automatically = On, correct time zone.
5. Network: on VPN, hotel/guest Wi-Fi, or a proxy? Test once off VPN / on another network.
6. Device state (read-only): run dsregcmd /status and note:
AzureAdJoined / DomainJoined / WorkplaceJoined, AzureAdPrt (YES/NO)
Paste the output into the ticket.
7. Error text: any message like "Your sign-in was successful but doesn't
meet the criteria..." or "device must be managed/compliant"? Screenshot it.
That is NOT a password problem. Go straight to ESCALATE.
TIER-1 FIXES (only what your playbook allows)
- Fully close Outlook/Teams (check the system tray), then reopen.
- In Outlook/Office: File > Office Account > Sign out, reboot, sign back in.
- Clear cached Office creds: Credential Manager > Windows Credentials >
remove entries for MicrosoftOffice / the user's M365 address. Reboot.
- Make sure Office is up to date (File > Office Account > Update Options).
- Retest with a fresh Outlook profile only if the mailbox is cloud-only
and your playbook allows it.
DO NOT (at Tier-1)
- Reset the password "just to see" if the web test worked
- Disconnect the work/school account from Windows Settings > Accounts
- Remove MFA methods without verified identity and the right role
- Unenroll, reset, or reimage the device
ESCALATE WHEN
- Web sign-in fails after password/lockout checks -> Identity / Tier-2
- AzureAdPrt = NO on a device that should be Entra joined -> Tier-2 / endpoint
- Any "device must be compliant/managed" or CA error -> Endpoint / Intune admin
- Same symptom across many users -> Lead + service health
- Fixes above done and prompt returns within a day -> Tier-2
ATTACH TO THE ESCALATION
- User, device name, time of last prompt, app(s) affected
- Web test result, dsregcmd /status output, screenshot of any error
- What you already tried (so Tier-2 doesn't repeat it)
Why the order matters
The web test (check 2) does most of the work. If the user can sign in to Outlook on the web in a private window, the password and the account are fine. Resetting the password at that point only adds a new problem: every other device now has a stale password and starts locking the account.
Device state comes before "fixes." If dsregcmd /status shows AzureAdPrt : NO on a laptop that should be Entra joined, the device has no valid primary refresh token, so apps keep falling back to asking for a password. Tier-1 can capture that. Fixing it usually needs Tier-2.
Compliance errors look like password problems. When Conditional Access requires a compliant device and the laptop isn't compliant (it isn't enrolled, it's missing an update, BitLocker isn't reporting, and so on), the user sees a sign-in failure right after typing a correct password. Tier-1 can't fix compliance from the user's desk. The best move is a clean escalation with the screenshot and the dsregcmd output attached.
A note template that saves Tier-2 time
[Tier-1] Outlook repeated password prompt — <user> / <device>
Scope: single user, Outlook + Teams
Web sign-in (private window): WORKS
Time sync: OK | VPN: tested off VPN, same result
dsregcmd: AzureAdJoined YES, AzureAdPrt NO
Tried: Office sign-out/in + reboot, cleared Office creds in Credential Manager
Result: prompt returns within ~1 hour
Escalating to: endpoint team (PRT missing)
Two minutes of notes like this keep the ticket from bouncing back to the user with "can you try restarting?"
Want the rest of the cards?
This card is a sample of the format in the IT Helpdesk Tier-1 Break/Fix Runbook Pack ($24). The pack uses the same Symptoms → Verify → Fix → Prevent/Escalate layout for the tickets that fill Tier-1's day: password and MFA loops, VPN with no internal access, slow PCs, full disks, Wi-Fi, printers, Outlook search and send, Teams audio, and OneDrive sync. It also includes intake and escalation rules, note and handoff templates, and one read-only PowerShell local snapshot script. The script only reads. It makes no password changes, takes no device actions, and makes no Graph writes.
👉 https://cashflow4375.gumroad.com/l/tezla
If your escalations keep landing on Intune enrollment or compliance, the Intune & M365 Admin Starter Pack covers that side for admins ($19 during launch week, normally $29): https://cashflow4375.gumroad.com/l/joonf
Neither is required. The card above works fine on its own.
Admin Pack Studio. Not affiliated with Microsoft. For IT staff authorized to support their organization's users and devices. Follow your own policies, and check current Microsoft documentation for menu names and behavior.
Top comments (0)