Unable to bypass Okta on Microsoft desktop apps after password change

A user had to use her previous laptop after a long time. The Windows password saved on it had expired - the AD server and M365 had a new password. She unlocked the laptop with the old password. The Microsoft apps started asking for the new password. But Okta would loop back and ask for credentials again.

Since then, I changed her password on the server, synced with 365 and Okta. Now the password that unlocks the laptop is the current one. The installed apps continue to not work, Okta doesn't let her go through. I removed the password from the Windows Credentials Manager, reset her authenticator in Okta and made her enroll again, removed the account from One Drive, Teams and Outlook, and had her try to log in again. Nothing works. But she can access 365 online. The issue is getting Okta to authenticate her and let user Microsoft desktop apps.

Most of her attempts on Okta logs show SUCCESS, although a few say Authentication of user via MFA

ABANDONED. Similarly, most of the entries on Entra ID logs say Success with a few saying Failure - Sign-in error code 50173 - The user might have changed or reset their password. The grant was issued on '{authTime}' and the TokensValidFrom date (before which tokens are not valid) for this user is '{validDate}'.

I renamed HKCU\Software\Microsoft\Office\16.0\Common\Identity following Claude's expert advice. There are no more MicrosoftOffice16_Data and SSO_POP_Device entries left.

How do I reset tokens??