How to Fix Outlook Password Prompts When Connecting to Exchange Server
Stop Outlook's endless credential loop when connecting to Exchange. Clear cached credentials, fix the Microsoft 365 Autodiscover hijack, reset the token cache, and check the server.
- Difficulty
- Intermediate
- Time required
- 20-30 minutes
- Steps
- 8
- Platform
- Outlook
Table of contents
Quick Answer
Go to the stepsMost Outlook credential loops come from stale cached credentials or an Autodiscover redirect to Microsoft 365. Close Outlook, remove the MicrosoftOffice16 / Outlook / ADAL entries in Windows Credential Manager, and - for on-premises or hybrid mailboxes whose domain also exists in a Microsoft 365 tenant - set the ExcludeExplicitO365Endpoint registry value so Outlook stops trying the cloud endpoint first. Reopen Outlook, enter the password once, and tick Remember my credentials.
- Close Outlook fully (check Task Manager for outlook.exe).
- Credential Manager > Windows Credentials: remove MicrosoftOffice16, Outlook, and ADAL entries.
- On-prem/hybrid: set ExcludeExplicitO365Endpoint = 1 under the Outlook\AutoDiscover key.
- Reopen Outlook, sign in once, and tick Remember my credentials.
- Still looping? Reset the token cache (Access work or school) or run SaRA.
reg add "HKCU\Software\Microsoft\Office\16.0\Outlook\AutoDiscover" /v ExcludeExplicitO365Endpoint /t REG_DWORD /d 1 /fExpected result: Outlook prompts once, accepts the password, and stays connected without looping.
Key takeaways
- You'll learn how to diagnose and stop the Outlook credential-prompt loop against both on-premises Exchange Server and Exchange Online - from clearing cached credentials to fixing the Microsoft 365 Autodiscover hijack, resetting the token cache, and checking the Exchange server.
- The repeated password prompt blocks mailbox access, locks accounts, and floods the help desk. Because typing the correct password doesn't stop it, admins waste time on the wrong fix unless they target the real cause.
- Fix the routing, not the password: clear cached credentials and stop Outlook checking the Microsoft 365 endpoint first with ExcludeExplicitO365Endpoint.
Introduction
When Outlook keeps popping the credential box every few minutes - you type the right password, it comes back - the cause is almost never a wrong password. It's usually cached credentials that have gone stale, an Autodiscover lookup being hijacked to the Microsoft 365 cloud endpoint, a legacy 'Logon network security' setting, or a broken modern-authentication token cache. This guide fixes the loop for classic Outlook against both on-premises Exchange Server and Exchange Online, working from the fastest client-side fixes through Autodiscover and the token cache to the Exchange server itself. Note that the new Outlook for Windows doesn't support on-premises Exchange, so on-premises mailboxes must stay on classic Outlook.
Who this is for: IT admins, MSPs, and help-desk staff supporting classic Outlook against Exchange Server or Exchange Online, especially in hybrid Microsoft 365 environments.
Before you start
- Access
- Sign-in access to the affected Windows machine. Client-side fixes (Credential Manager, HKCU registry, Outlook profile) need only the user's own rights; the server-side step needs Exchange administrator access.
- Required roles
- Standard user rights for the client-side fixes
- Exchange administrator (Organization Management) for the server-side checks
- Standard user rights for the client-side fixes (Credential Manager, HKCU registry, Outlook profile)
- Environment
- Classic Outlook for Windows (Microsoft 365, 2016, 2019, 2021, or LTSC) connecting to on-premises Exchange Server or Exchange Online. The new Outlook for Windows doesn't support on-premises Exchange.
- Vendor
- Microsoft
- Administrator permissions required
- Backup required
Settings, registry values, and cmdlets verified against Microsoft Learn documentation; not run in a lab for this article.
About 20-30 minutes for the client-side fixes; server-side checks depend on your Exchange access.
Warning: Back up the registry first
Several steps modify the registry. A registry backup via regedit > File > Export takes seconds and lets you restore if something breaks. The keys here are under HKEY_CURRENT_USER, so no admin rights are needed, but a backup still protects you from a bad edit.
Warning: Server changes affect everyone
The Exchange authentication and Autodiscover settings in the final step apply to all users. Review them in a maintenance window and change them only if they're actually misconfigured.
1Identify Your Outlook and Exchange Setup
Pick the right fixes by knowing which client and which mailbox you're dealing with.
Two things decide which fixes apply. First, the client: classic Outlook (File > Office Account, look for the Microsoft 365 / 2021 / 2019 / 2016 build) versus the new Outlook for Windows, which doesn't support on-premises Exchange at all. Second, the mailbox: on-premises Exchange Server or Exchange Online. In classic Outlook, hold Ctrl and right-click the Outlook icon in the system tray, choose Connection Status, and check the server names - outlook.office365.com means Exchange Online, while an internal FQDN means on-premises.
Expected result: You know whether you're on classic or new Outlook, and whether the mailbox is on-premises Exchange or Exchange Online.
Note
Exchange Online no longer accepts Basic Authentication, so an Exchange Online profile must use Modern Auth - a profile stuck on Basic Auth will loop. On-premises Exchange still supports both.
2Clear Cached Credentials in Windows Credential Manager
Remove stale saved credentials that trigger the loop.
Control Panel > Credential Manager > Windows Credentials > Generic CredentialsClose Outlook completely (check Task Manager for outlook.exe). Open Control Panel > Credential Manager > Windows Credentials. Under Generic Credentials, remove every entry tied to Office/Outlook - the names usually start with MicrosoftOffice16_Data:, plus MS.Outlook, Microsoft Office Identities Cache 2, Microsoft Office Identities Settings 2, and any ...ADAL: entries. Reopen Outlook, enter the password once, and tick Remember my credentials.
cmdkey /list | findstr /i "MicrosoftOffice Outlook ADAL Identities"Expected result: The Office/Outlook generic credentials are gone, and Outlook prompts once then connects without looping.
Note
Removing these only clears saved passwords/tokens; it doesn't delete mail. Outlook re-creates the entries on next sign-in.
3Turn Off 'Always Prompt for Logon Credentials'
Stop a legacy setting from forcing a prompt every session.
File > Account Settings > Account Settings > (account) > More Settings > SecurityIn classic Outlook, go to File > Account Settings > Account Settings, double-click the Exchange account, and click More Settings > Security tab. In the User identification section, clear Always prompt for logon credentials. On older Outlook builds that still show a Logon network security dropdown, set it to Anonymous Authentication - Microsoft documents this as the fix for the loop. Outlook 2016 and later removed this dropdown, so if you don't see it, this particular cause doesn't apply to you.
Expected result: The 'Always prompt' box is unchecked (and, on older builds, Logon network security reads Anonymous Authentication).
Note
If Always prompt for logon credentials is greyed out, a policy is setting it - check HKCU\Software\Policies\Microsoft\Office\16.0\Outlook\Security for PromptForCredentials. If the Logon network security dropdown is greyed to a non-Anonymous value, an AuthenticationService policy value at the same Security path is forcing it; remove it.
4Stop the Microsoft 365 Autodiscover Hijack (On-Premises / Hybrid)
Force Outlook to use on-premises Autodiscover instead of looping against the cloud.
This is the classic cause for on-premises or hosted Exchange users: once your domain exists in any Microsoft 365 tenant, modern Outlook checks the Microsoft 365 endpoint first, hits a cloud sign-in prompt, and loops before it ever reaches your on-premises Autodiscover. Microsoft's documented control is the ExcludeExplicitO365Endpoint value (Outlook 2016 build 16.0.6741.2017 and later). Set it, then restart Outlook.
$base = 'HKCU:\Software\Microsoft\Office\16.0\Outlook\AutoDiscover'
New-Item -Path $base -Force | Out-Null
New-ItemProperty -Path $base -Name ExcludeExplicitO365Endpoint -PropertyType DWord -Value 1 -Force | Out-Null
# If the domain is still hijacked, Microsoft documents these under the same key too:
# ExcludeHttpsRootDomain, ExcludeHttpsAutoDiscoverDomainExpected result: Outlook stops showing the Microsoft 365 sign-in box on startup and resolves Autodiscover against your on-premises Exchange.
Note
16.0 covers Outlook 2016/2019/2021/365. Microsoft documents the same value under the Policies path - HKCU\Software\Policies\Microsoft\Office\16.0\Outlook\AutoDiscover - for GPO deployment. Don't apply this if the mailbox actually lives in Exchange Online.
5Reset the Modern Authentication Token Cache
Clear a corrupted OAuth/WAM token that survives a credential wipe.
Settings > Accounts > Access work or schoolWhen the loop happens after a successful modern-auth sign-in (you complete MFA, then it prompts again), the Windows Web Account Manager (WAM) token is usually stale. Go to Settings > Accounts > Access work or school, select the affected Microsoft 365 account, click Disconnect, then add it back. Reopen Outlook and sign in once. This forces Windows to mint a fresh token instead of replaying a broken one.
Expected result: After reconnecting the work account, Outlook signs in once and holds the connection without re-prompting.
Note
Only disconnect a work or school account you can re-add; don't remove the primary account a domain-joined device relies on. dsregcmd /status shows the device's join and SSO state if you need to dig deeper.
6Run the Microsoft Support and Recovery Assistant (SaRA)
Let Microsoft's tool auto-detect and fix the common causes.
Microsoft's Support and Recovery Assistant (SaRA) has a dedicated scenario for this. Either download SaRA from Microsoft's site and choose Outlook > 'Outlook keeps asking for my password', or launch it from inside classic Outlook via File > (Office Account / Help) > Support, then pick Diag: Outlook keeps asking for my password. Let it check cached credentials, the identity cache, and modern-auth settings, and apply what it recommends.
Expected result: SaRA finishes with a report of what it checked and fixed, and Outlook connects without prompting.
Note
SaRA is Microsoft's official Office troubleshooter and is safe to run on production machines. It's the fastest first move on Microsoft 365 / Exchange Online mailboxes.
7Rebuild the Outlook Profile
Replace a corrupted profile when the fixes above don't hold.
Control Panel > Mail (Microsoft Outlook) > Show Profiles > AddA damaged profile can loop no matter how many times you clear credentials. Close Outlook, open Control Panel > Mail (Microsoft Outlook) > Show Profiles, click Add, name the new profile, and add the mailbox via Auto Account Setup (type the email address and let Autodiscover configure it). Set Always use this profile to the new one, keeping the old profile as a fallback.
Expected result: Outlook opens on the new profile, downloads the mailbox, and connects without repeated prompts.
Note
Modern Exchange accounts must be added via Auto Account Setup - the old 'Manual setup > Microsoft Exchange' path is gone. Rebuilding the profile re-downloads the OST, which can take a while on large mailboxes.
8Check Exchange Server Authentication (Admin)
Rule out a server-side Autodiscover or Outlook Anywhere / MAPI authentication mismatch.
If several users prompt at once, check the server. In the Exchange Management Shell, confirm the Autodiscover SCP URI is correct and that Outlook Anywhere and MAPI/HTTP advertise a working authentication method (typically Negotiate and/or NTLM). A mismatch between the client's expected auth and the virtual directory's IISAuthenticationMethods, or an Autodiscover URI pointing at the wrong host, produces org-wide prompts.
Get-ClientAccessService | Format-List Name, AutoDiscoverServiceInternalUri
Get-OutlookAnywhere | Format-List Server, InternalClientAuthenticationMethod, ExternalClientAuthenticationMethod, IISAuthenticationMethods
Get-MapiVirtualDirectory | Format-List Server, InternalUrl, ExternalUrl, IISAuthenticationMethodsExpected result: The Autodiscover URI points at the right internal host, and Outlook Anywhere / MAPI list Negotiate or NTLM among their authentication methods.
Note
Also confirm the Exchange SSL certificate is valid and includes the Autodiscover and mail host names as SANs - an untrusted certificate triggers prompts. Test externally with the Microsoft Remote Connectivity Analyzer (testconnectivity.microsoft.com).
How to Confirm the Password Prompt Loop Is Fixed
Verify fix
The fix is confirmed when Outlook prompts at most once, accepts the password, and then stays connected through normal use. Open Outlook, sign in if asked, tick Remember my credentials, and watch the connection indicator at the bottom-right - it should read 'Connected' to Exchange or Microsoft 365 rather than 'Need Password' or 'Disconnected'. Send yourself a test message to confirm two-way flow. Because the loop is often intermittent, leave Outlook running for a few hours: a genuine fix survives idle time and a restart, whereas a stale token or Autodiscover redirect usually re-prompts within minutes. If prompts return only for some users, the cause is more likely server-side than on any one PC.
Normal result: Outlook shows 'Connected', prompts at most once per sign-in, and keeps the connection through idle time and a restart.
Abnormal result: If prompts return within minutes, a token or Autodiscover redirect is still wrong; if they hit many users at once, suspect the Exchange server's Autodiscover URI, virtual-directory authentication, or certificate.
Connection status
Connected to Microsoft Exchange
The target state - no 'Need Password' flag on the status bar.
Troubleshooting
Outlook prompts again within minutes of entering the password
Warning
Cause: A stale modern-auth (WAM) token or cached credential is being replayed.
Clear the Office/Outlook entries in Credential Manager (Step 2) and disconnect/reconnect the account under Access work or school (Step 5), then sign in once.
A Microsoft 365 sign-in box appears even though the mailbox is on-premises
Warning
Cause: The domain exists in a Microsoft 365 tenant, so Outlook tries the cloud Autodiscover endpoint first.
Set ExcludeExplicitO365Endpoint = 1 under the Outlook\AutoDiscover key (Step 4) and restart Outlook; add it under the Policies path too for GPO deployment.
'Always prompt for logon credentials' is greyed out
Note
Cause: A policy value is forcing the setting.
Check HKCU\Software\Policies\Microsoft\Office\16.0\Outlook\Security for PromptForCredentials, and remove any AuthenticationService value forcing the Logon network security dropdown.
New Outlook won't connect to the on-premises Exchange mailbox at all
Note
Cause: The new Outlook for Windows doesn't support on-premises Exchange.
Switch the user back to classic Outlook for on-premises mailboxes; new Outlook only supports Exchange Online, Outlook.com, and IMAP/POP.
Only some users prompt, and clearing credentials doesn't help
Warning
Cause: A server-side Autodiscover URI, virtual-directory authentication, or certificate problem.
Check Get-ClientAccessService, Get-OutlookAnywhere, and Get-MapiVirtualDirectory authentication methods (Step 8), and validate the SSL certificate SANs with the Remote Connectivity Analyzer.
Frequently asked questions
Why does Outlook keep asking for my Exchange password even when it's correct?
Because the loop is an authentication-routing problem, not a bad password. The usual causes are stale cached credentials or tokens, an Autodiscover redirect to the Microsoft 365 cloud endpoint, or a legacy Logon network security setting - none of which the correct password fixes.
Where are Outlook's cached credentials stored?
In Windows Credential Manager, under Windows Credentials. Look for generic entries starting with MicrosoftOffice16_Data, MS.Outlook, or ...ADAL, plus the Microsoft Office Identities Cache 2 and Settings 2 entries. Removing them clears saved passwords and tokens, not mail.
Should I set Logon network security to Anonymous Authentication?
On older Outlook builds that still show that dropdown, yes - Microsoft documents Anonymous Authentication as the fix for this loop. Outlook 2016 and later removed the setting, so if you don't see it, it isn't your cause.
What does the ExcludeExplicitO365Endpoint registry value do?
It stops modern Outlook from checking the Microsoft 365 endpoint first, so on-premises or hosted Exchange users don't get a cloud sign-in loop before on-premises Autodiscover runs. It applies to Outlook 2016 build 16.0.6741.2017 and later.
Does the new Outlook for Windows work with on-premises Exchange?
No. The new Outlook supports Exchange Online, Outlook.com, and IMAP/POP accounts, but not on-premises Exchange mailboxes. Keep on-premises users on classic Outlook.
Why did the prompts start after we set up Microsoft 365 or hybrid?
Adding your domain to a Microsoft 365 tenant makes Outlook try the cloud endpoint first, causing the loop. Basic Authentication is also retired in Exchange Online, so a profile still using Basic Auth will keep prompting until it's switched to Modern Authentication.
Conclusion
Outlook's password-prompt loop is an authentication-routing problem, not a wrong password. Clear the stale Office and Outlook credentials in Credential Manager, uncheck 'Always prompt for logon credentials', and - for on-premises or hybrid mailboxes - set ExcludeExplicitO365Endpoint so Outlook stops looping against the Microsoft 365 endpoint. If the loop follows a modern-auth sign-in, reset the WAM token via Access work or school or run SaRA; if it hits many users, check the Exchange server's Autodiscover and Outlook Anywhere authentication. Remember that new Outlook can't use on-premises Exchange at all.
Fix the routing, not the password: clear cached credentials and stop Outlook checking the Microsoft 365 endpoint first with ExcludeExplicitO365Endpoint.
reg add "HKCU\Software\Microsoft\Office\16.0\Outlook\AutoDiscover" /v ExcludeExplicitO365Endpoint /t REG_DWORD /d 1 /fSources3
