We manage several Microsoft 365 environments, and over the past month users across different tenants have randomly reported that Outlook displays an "Access Denied" badge instead of their mail. Sometimes signing in again works, while other times the sign-in loops before eventually letting them in. The issue has appeared with multiple antivirus products, so we do not currently suspect endpoint security software.
Clearing the SSO entries from Credential Manager sometimes restores access, but the problem returns later. We recently had three users in separate tenants experience it around the same time. Microsoft support has suggested resetting, removing, and reinstalling Outlook, but those steps have not produced a consistent improvement. Sign-in logs show successful authentication rather than rejected attempts or Conditional Access failures.
Has anyone else been experiencing this intermittently, and has anything provided a reliable fix?
3 Answers
I have encountered the same behavior in New Outlook. Restarting the computer usually clears the immediate error, but it is not a dependable fix. I have also seen notifications arrive while the messages fail to appear in the inbox, which makes the client difficult to trust for day-to-day use.
A similar issue can sometimes affect Outlook in a browser while the mobile apps continue working. If the service is having a temporary Microsoft-side authentication problem, waiting and trying again later may resolve it, but checking the service health dashboard and tenant sign-in logs can help distinguish an outage from a local client problem.
I would still check the Entra sign-in logs for the affected users and compare the timestamps with the client error. Look for Conditional Access decisions, token failures, or other authentication details. In our case, though, the logs showed successful sign-ins even when Outlook was stuck in a sign-in loop, so the problem appeared to be on the client side rather than an actual access rejection.
That is what we are seeing too. The sign-in logs show successful authentication, including during the looping behavior, with no obvious policy rejection.