Device TPM Problem Error -2146893802: Complete Fix Guide

The device TPM problem error appears when Outlook, Teams or another Microsoft 365 app can't use the security keys it stored in your PC's Trusted Platform Module (TPM). The fix is usually to clear stale sign-in data: disconnect and reconnect your work or school account, remove cached Office credentials, and reset the token broker folder. Clearing the TPM is a last resort because it deletes every key stored on the chip.

You may also see the message worded as "Your computer's Trusted Platform Module has malfunctioned", followed by error code 80090016 or -2146893802. This guide explains what those codes mean, why the error happens, and the safest order to fix it.

What Does "Device TPM Problem" Mean in Office 365?

It means Office asked the TPM for a key it saved earlier and the TPM couldn't find or use it. The TPM is a small security chip, or firmware equivalent, on your motherboard that stores encryption keys so they can't be copied off the device.

When you sign in to Microsoft 365 with a work or school account, Windows creates sign-in tokens and protects them with keys held in the TPM. If those keys go missing or the TPM changes, the saved tokens point to keys that no longer exist, and the sign-in fails. That cause and effect is why the error often follows hardware repairs, firmware updates or TPM resets.

In short, "device TPM problem -2146893802" and "TPM malfunctioned 80090016" are the same fault shown in two number formats.

What Causes This TPM Sign-In Error?

The error is caused by a mismatch between the sign-in data Windows has cached and the keys the TPM actually holds. The most common triggers are:

• Motherboard replacement: a new board brings a new TPM, so tokens created on the old chip can't be read.
• TPM cleared or reset: a BIOS or UEFI firmware update, a manual TPM clear, or switching TPM settings in firmware wipes the stored keys.
• Corrupted token broker data: the Windows component that manages work-account sign-ins (the AAD Broker Plugin) holds damaged cached accounts.
• Stale Office credentials: old entries in Windows Credential Manager conflict with your current account.
• Device problems in Microsoft Entra ID: the device was disabled or removed from your organisation's directory.
• Security software, VPN or proxy: these can block the broker process from reaching Microsoft's sign-in service.

How Do I Fix Device TPM Problem -2146893802?

Work through the fixes below in order, from least to most disruptive, and try signing in to Office after each one. If the PC belongs to your employer or school, check with IT before you start, because some steps affect device registration.

Fix 1: Disconnect and reconnect your work or school account

1. Close all Office apps.
2. Open Settings → Accounts → Access work or school.
3. Select the account Office uses, choose Disconnect and confirm.
4. Restart the PC.
5. Return to Access work or school, select Connect and sign in again, then open Outlook.

Fix 2: Remove cached Office credentials

1. Press Start, type Credential Manager and open it.
2. Select Windows Credentials.
3. Under Generic Credentials, remove entries beginning with MicrosoftOffice16, and any ADAL or msteams_ entries.
4. Restart the PC and sign in to an Office app again.

Fix 3: Reset the token broker folder

1. Close all Office apps and Teams.
2. Press Win + R, enter %localappdata%\Packages and press Enter.
3. Find the folder Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy and rename it by adding .old to the end.
4. If Windows says the folder is in use, restart and try again, or sign in with a different administrator account and rename it in the affected user's profile.
5. Restart and sign in to Office. Windows rebuilds the folder automatically.

Renaming rather than deleting means you can put the folder back if something else breaks.

Fix 4: Check the TPM is ready

1. Press Win + R, type tpm.msc and press Enter.
2. Under Status, confirm it says "The TPM is ready for use".
3. If no compatible TPM is found, the chip is probably switched off in firmware. Our guide on how to enable TPM 2.0 shows where to turn it on.
4. Check your PC maker's support site for a BIOS or firmware update, and install it if one is listed for your model.

Fix 5: Ask IT to check the device registration

On a work-managed PC, an administrator can run dsregcmd /status to check the device's Microsoft Entra ID join state, and re-enable or re-register the device if it was disabled or deleted. Microsoft's TPM malfunctioned troubleshooting article lists further admin-level fixes, including a registry protection-policy setting, for IT teams to apply.

Should I Clear the TPM to Fix the Error?

Only clear the TPM if the gentler fixes have failed, you own the device, and you have your recovery keys. Microsoft warns that clearing the TPM deletes every key created on it and any data protected by those keys, such as a sign-in PIN or virtual smart card.

The biggest risk is BitLocker or device encryption. If your drive is encrypted, Windows may ask for the 48-digit recovery key after the clear. Before you start, find that key in your Microsoft account or save it from Control Panel → BitLocker Drive Encryption. Our explainer on BitLocker on Windows 11 Home vs Pro covers which editions use which kind of encryption.

1. Back up important files and record your BitLocker recovery key.
2. Open Windows Security → Device security.
3. Select Security processor details → Security processor troubleshooting.
4. Select Clear TPM and restart when prompted. You may need to press a key during startup to confirm.
5. After Windows loads, set up your PIN again if asked, then sign in to Office.

Microsoft advises against clearing the TPM on a work or school PC unless your IT administrator tells you to.

A Common Mistake We See

The most common mistake is jumping straight to clearing the TPM because the error message mentions it. On a laptop with device encryption turned on, that can lead to a BitLocker recovery screen and a hunt for a recovery key the user never saved. In most cases the cached sign-in data is the problem, not the chip, so Fixes 1 to 3 resolve it without touching the TPM at all. It is also worth knowing that this is a sign-in error, not a licence or product key error: reinstalling Office or entering a different key won't clear it.

Frequently Asked Questions

Is device TPM problem -2146893802 a hardware failure?

Rarely. The code means "keyset does not exist", so Windows can't find a key the TPM was expected to hold. That usually comes from stale sign-in data, a motherboard swap or a TPM reset rather than a broken chip. If tpm.msc reports the TPM is ready, the hardware is most likely fine.

Why does Outlook say "Trusted Platform Module has malfunctioned"?

Outlook uses your work or school sign-in tokens, which Windows protects with TPM keys. If those keys were reset or the tokens are corrupted, Outlook can't authenticate and shows the malfunction message with code 80090016. Reconnecting the account and resetting the BrokerPlugin folder usually fixes it.

Does the device TPM problem in Office 365 affect personal accounts?

It mostly affects work and school accounts, because those rely on the Windows token broker and Microsoft Entra ID device registration. Personal Microsoft accounts use a different sign-in path. If you see it with a personal account, removing cached Office credentials and signing in again is the first step.

Will clearing the TPM delete my files?

Clearing the TPM doesn't delete files directly, but it removes the keys stored in the chip. If your drive uses BitLocker or device encryption, you'll need the recovery key to unlock it afterwards. Without that key, encrypted data may become unreadable, so save it before you clear anything.

Can I fix the TPM sign-in error without admin rights?

Partly. You can usually remove your own Credential Manager entries and reconnect your work account. Renaming the BrokerPlugin folder from another account, clearing the TPM, updating firmware and checking Entra ID registration need administrator rights, so on a company PC ask your IT team.

Did a BIOS update cause the TPM error?

It can. Some firmware updates reset or reprovision the TPM, which wipes the keys Office relied on. After an update, the old tokens no longer match and Office sign-in fails. Reconnecting your account and resetting the token broker folder normally restores sign-in without clearing the TPM.

Conclusion

The device TPM problem is usually a mismatch between cached sign-in data and the keys in your TPM, so start by reconnecting your account, removing old credentials and resetting the BrokerPlugin folder. Keep clearing the TPM for last, after saving your recovery key. If you are reviewing your Office setup at the same time, see our Office 365 range or read Microsoft Office vs Microsoft 365 to decide between subscribing and buying once.

Useful Links