Fix "Trusted Platform Module Has Malfunctioned" (80090016)

"Your computer's Trusted Platform Module has malfunctioned" is one of the most common Microsoft 365 sign-in errors I see on the help desk. It stops Outlook, Teams, OneDrive or Word from signing in, usually with error code 80090016, and sometimes 80090030 or 80090034. Despite the wording, the TPM chip is almost never broken. The problem is the saved sign-in data that Windows keeps for your work or school account.

Below are the fixes in the order I use them. The first two solve most cases in a few minutes.

Quick answer

Close all Office apps. Rename the folder %LOCALAPPDATA%\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy by adding .old to the end, restart the PC and sign in again. If that does not work, disconnect the account under Settings > Accounts > Access work or school, then sign back in and choose No, sign in to this app only. Do not clear the TPM.

What causes the TPM malfunctioned error?

When you sign in to Microsoft 365, Windows stores your sign-in keys in a component called the Web Account Manager, protected by the TPM. The error appears when those stored keys no longer match what the TPM expects. The usual triggers:

• The motherboard was replaced, or the TPM was cleared or reset in the BIOS.
• A Windows or BIOS update changed the TPM state.
• The device was joined, removed and joined again to Microsoft Entra ID (Azure AD).
• The user's profile was copied or restored from another PC.
• The sign-in cache simply got corrupted.

Fix 1: Reset the AAD Broker Plugin folder

This is the fix that works most often, and it is safe: Windows rebuilds the folder automatically.

1. Close Outlook, Teams, OneDrive and every other Office app.
2. Press Win + R, paste %LOCALAPPDATA%\Packages and press Enter.
3. Find Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy and rename it to Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy.old. If Windows says the folder is in use, sign out and in again, then try once more.
4. Restart the PC.
5. Open Outlook or Teams and sign in. Windows creates a fresh folder.

Once everything works for a day or two, you can delete the .old folder.

Fix 2: Disconnect and reconnect the work or school account

1. Open Settings > Accounts > Access work or school.
2. Select the account that will not sign in and click Disconnect, then Yes.

3. Restart the PC and open the Office app again.
4. Sign in with your email and password. If Windows asks whether to let your organization manage the device, choose No, sign in to this app only.

If the account keeps coming back under Access work or school by itself, the PC is probably joined to your organization's Entra ID. In that case, do not disconnect it yourself; go to Fix 4 or ask your IT team.

Fix 3: Re-register the sign-in components

If the folder reset did not help, the Web Account Manager package itself may be damaged. Open PowerShell as administrator and run the line that matches your account.

Work or school account:

if (-not (Get-AppxPackage Microsoft.AAD.BrokerPlugin)) { Add-AppxPackage -Register "$env:windir\SystemApps\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Appxmanifest.xml" -DisableDevelopmentMode -ForceApplicationShutdown }; Get-AppxPackage Microsoft.AAD.BrokerPlugin

Personal Microsoft account (Outlook.com, Hotmail):

if (-not (Get-AppxPackage Microsoft.Windows.CloudExperienceHost)) { Add-AppxPackage -Register "$env:windir\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\Appxmanifest.xml" -DisableDevelopmentMode -ForceApplicationShutdown }; Get-AppxPackage Microsoft.Windows.CloudExperienceHost

Restart and try signing in again.

Fix 4: Check the device's Entra ID join (IT admins)

On company laptops, run dsregcmd /status in Command Prompt and look at the Device State and SSO State sections. If AzureAdPrt is NO, the device cannot get a sign-in token. After a motherboard swap, the clean fix is usually to remove the device from Entra ID and Intune and join it again. I cover more sign-in failures in troubleshooting SSO authentication failures.

Fix 5: PIN or Windows Hello stopped working too

After a motherboard replacement, Windows Hello can break at the same time, and the PIN sign-in fails. Sign in with your password, then:

1. Open Settings > Accounts > Sign-in options > PIN (Windows Hello) and click Remove.
2. Restart and set up a new PIN from the same page.

If Remove is greyed out or fails, an administrator can reset the Hello container by renaming C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Ngc to Ngc.old. You need to take ownership of the folder first, and every user on that PC will have to set up their PIN again.

Fix 6: Repair Office and update Windows

• Install all pending updates under Settings > Windows Update, including optional driver and firmware updates.
• Run a Quick Repair, then an Online Repair, from Settings > Apps > Installed apps > Microsoft 365 > Modify.
• If the user profile itself is damaged, you may see other symptoms as well, such as being signed in with a temporary profile.

What not to do

• Do not clear the TPM in the BIOS or in tpm.msc to fix this. It does not fix the sign-in cache, and if BitLocker is on, the PC will ask for the 48-digit recovery key at the next boot. Without that key, the data is gone.
• Do not disable ADAL or WAM with old registry tweaks. Microsoft no longer supports them and they cause more sign-in problems than they solve.

Frequently asked questions

Is my TPM chip broken if I see this error?

Almost never. The error is about the sign-in data that Windows saved for your Microsoft 365 account. Resetting the AAD Broker Plugin folder or reconnecting the account fixes it in most cases.

What does error code 80090016 mean?

It means "keyset does not exist": the key Windows saved for your account can no longer be found or opened by the TPM. It usually follows a motherboard replacement, a TPM reset or a corrupted sign-in cache.

Can I delete the Microsoft.AAD.BrokerPlugin folder?

Yes, after renaming it and confirming that sign-in works. Windows creates a new one when you sign in again. Renaming it first is safer than deleting, so you can roll back.

Should I clear the TPM to fix this?

No. Clearing the TPM does not fix the sign-in error, and if BitLocker is enabled you will need the recovery key to start Windows. Make sure you have it backed up before touching any TPM setting.

The error came back after a few days. What now?

Check whether the device is joined to Microsoft Entra ID with dsregcmd /status. If the join is broken, the IT team needs to remove and re-join the device. Install the latest Windows and BIOS updates as well.