Microsoft Teams error CAA20002, explained and fixed
CAA20002 shows at sign-in, typically with wording that something went wrong and the account could not be signed in. It belongs to the Microsoft 365 authentication error family shared with Outlook and OneDrive: the app reached the sign-in service but the authentication exchange failed. Corrupt cache, a stale stored credential after a password change, a mismatched Windows account, and older TLS settings are the documented causes.
The fix, in order
- Sign out everywhere in the app first. If Teams opens far enough, sign out from the profile menu, close Teams fully from the tray, reopen, and sign in. This refreshes the token the app keeps reusing.
- Clear the Teams cache. Exit Teams completely, then delete the contents of %appdata%\Microsoft\Teams (classic) or reset the new Teams app in Settings, Apps, Microsoft Teams, Advanced options, Reset. A corrupted cache is the most frequently reported cause of this code.
- Remove stale credentials. Credential Manager, Windows Credentials, delete entries relating to Teams, Office, and the work account, then sign in again with the current password. This step is the fix in most post-password-change cases.
- Reconnect the Windows account. Settings, Accounts, Access work or school: disconnect the account and reconnect it. A mismatch between the account Windows holds and the account Teams expects produces persistent CAA20002 that cache clearing alone does not shift.
- Enable TLS 1.2 and check the clock. inetcpl.cpl, Advanced, Use TLS 1.2 on; and Settings, Time, Set time automatically on with a fresh sync. Both are quiet blockers of the modern authentication endpoints.
- Test the web version, then reinstall only if needed. teams.microsoft.com working confirms the account is healthy. If the desktop app alone still fails after all of the above, uninstall it and install the current build from Microsoft's site.
If it still happens
When CAA20002 appears for many users in one organization at once, the cause sits with the identity setup: a conditional-access policy change, an expired federation certificate, or a Microsoft sign-in incident. Individual fixes cannot move those; the sign-in logs an admin can pull show the exact policy that refused the request.
Common questions
Why does CAA20002 keep coming back after clearing the cache? Because the cache is only one of its homes. If the stored Windows credential or the work-or-school account connection is the stale piece, the error returns until that is removed and reconnected, which is why the steps above go beyond the cache.
Is CAA20002 a problem with my account or my computer? The web test answers it: if teams.microsoft.com signs in fine, the account is healthy and the fault is local to the app, its cache, or this PC's stored credentials.
Related errors