VictorK.52186 (Customer) asked a question.
Unable to bypass Okta on Microsoft desktop apps after password change
A user had to use her previous laptop after a long time. The Windows password saved on it had expired - the AD server and M365 had a new password. She unlocked the laptop with the old password. The Microsoft apps started asking for the new password. But Okta would loop back and ask for credentials again.
Since then, I changed her password on the server, synced with 365 and Okta. Now the password that unlocks the laptop is the current one. The installed apps continue to not work, Okta doesn't let her go through. I removed the password from the Windows Credentials Manager, reset her authenticator in Okta and made her enroll again, removed the account from One Drive, Teams and Outlook, and had her try to log in again. Nothing works. But she can access 365 online. The issue is getting Okta to authenticate her and let user Microsoft desktop apps.
Most of her attempts on Okta logs show SUCCESS, although a few say Authentication of user via MFA
ABANDONED. Similarly, most of the entries on Entra ID logs say Success with a few saying Failure - Sign-in error code 50173 - The user might have changed or reset their password. The grant was issued on '{authTime}' and the TokensValidFrom date (before which tokens are not valid) for this user is '{validDate}'.
I renamed HKCU\Software\Microsoft\Office\16.0\Common\Identity following Claude's expert advice. There are no more MicrosoftOffice16_Data and SSO_POP_Device entries left.
How do I reset tokens??
Hi @VictorK.52186 (Customer) , Thank you for reaching out to the Okta Community!
You mentioned that "... she can access 365 online." indicating that the issue is on the Microsoft side. Further corroborated by the fact that the Okta System Logs show successful events - to note, though, the Okta System Logs don't track downstream application login success, only that the authentication request was successfully passed.
My recommendation is to open a support ticket with Microsoft Support for assistance with token reset.
Preliminary research into the issue has yielded some suggestions as to possible causes, but due to the fact that they are all on the Microsoft side, I cannot share them as I cannot validate them being outside of Okta purview.
When opening the ticket with Microsoft, be sure to provide them with these details so they don't try to route you back to Okta:
In the meantime, since you mentioned that the laptop was not in use for a period, I would recommend forcing a time sync. Checking for a time drift has been a lesson learned the hard way in my time troubleshooting weird issues 🙂 .
(Quick guide for your end-user)
Here is how to force the laptop to resynchronize its clock with the time servers:
1.Open Time Settings:
On the affected laptop, right-click the clock in the bottom right corner (usually) of the Windows taskbar and select Adjust date/time.
2.Force a Time Sync:
Ensure the Set time automatically switch is toggled ON. Scroll down to the "Synchronize your clock" section and click the Sync now button.
Verification: A checkmark will appear next to the button along with the current date and time, indicating a successful connection to the time server.
3.Test the Desktop Apps:
Close all Microsoft Office applications completely, then reopen one (like Word or Teams) and have the user attempt to log in again.
Verification: The application should successfully accept the authentication token and log the user in without looping.
If my answer helped, remember to mark it as best to increase its visibility for other members of the Okta Community who might have the same questions as you.
Hope my answer helps!
--
Help others in the community by liking or hitting Select as Best if this response helped you.
Collect them all. Learn a new skill and earn a new Okta Learning badge.
Just released: More Okta Community badges just added