If Microsoft keeps signing you out (or you log in successfully, then get bounced back to sign-in), you’re usually not “doing something wrong.” It’s a session problem: the app or browser can’t keep (or refresh) the token that proves you’re still you.
Most fixes are about removing the one thing that’s breaking the session handshake.
Before you start: note where it happens (browser vs app), which Microsoft product (Outlook, Teams, OneDrive, Microsoft 365, Xbox, etc.), and whether it’s only on one network (work Wi‑Fi, VPN, mobile data).
1. Why Microsoft sessions expire (the non-scary explanation)
A “session” is a temporary authorization that lives as a cookie (in browsers) or a token (in apps). Microsoft services also refresh these sessions quietly in the background.
Sign-outs happen when something blocks that storage or refresh. Common causes:
- Cookies or site data are cleared (manually, by “clear on exit,” by privacy tools, or by enterprise policy).
- Third-party cookies or tracking protection breaks the login flow (some Microsoft sign-ins hop across microsoftonline.com / live.com / office.com domains).
- Device time is off, making tokens look “expired” immediately.
- Network interference (VPN, proxy, captive portals, DNS filtering) blocks token refresh endpoints.
- Multiple accounts conflict (work/school + personal) and the wrong one keeps being selected.
- Security rules (Conditional Access, risk-based sign-in, MFA) force frequent re-auth.
2. Quick check: is it only one app, or all Microsoft sign-ins?
This determines whether you should focus on a single app’s cache vs system-wide sign-in storage.
- If it’s only one app (for example Teams only): start with that app’s cache/reset/sign-out steps.
- If it’s all Microsoft apps (Outlook, Teams, OneDrive, browser): focus on device time, account conflicts, network/VPN, and cookie/token storage rules.
- If it’s only in one browser: focus on cookies, tracking protection, extensions, and profiles.
If you can, test once in a private/incognito window. If that works but normal mode doesn’t, it’s almost always cookies/extensions/settings.
3. Fix the most common root cause: cookie/session storage being wiped
In browsers, Microsoft relies heavily on cookies and cross-domain redirects during sign-in.
- Disable “Clear cookies/site data on exit” (or add exceptions) for Microsoft sign-in domains you use.
- Allow cookies for Microsoft sign-in pages. If you block third-party cookies, try allowing them temporarily just to complete sign-in, then tighten again.
- Turn off “strict” tracking protection for the sign-in attempt (you can re-enable afterward).
- Try a clean browser profile (not just a new tab): a corrupted profile store can repeatedly drop cookies.
On managed/work devices, these behaviors may be enforced by policy. If settings keep reverting, that’s a clue you’ll need IT to adjust it.
4. Sync your device time (sessions can fail even if you’re only a few minutes off)
Tokens and certificates are time-sensitive. If your device clock is wrong, you can get instant “session expired” behavior or repeated sign-in prompts.
- Turn on automatic date/time and automatic time zone.
- Restart the device after time sync if the issue has been happening for a while.
- On desktops, force a time sync (the OS usually has a “Sync now” option).
Also check that your network isn’t forcing a weird time zone (some captive portals do odd things).
5. Remove account conflicts: sign out everywhere, then sign in with one account first
Microsoft sign-in can “stick” to the last account used. If you switch between a personal Microsoft account and a work/school account, the wrong context can keep being applied.
- Sign out of Microsoft in the app, then close the app completely and reopen it.
- In browsers, sign out of Microsoft on all open tabs, then close the browser, reopen, and sign in again.
- Use a separate browser profile for work vs personal to keep sessions from mixing.
If the loop only happens on one device, remove the account from that device and add it again (this refreshes local token storage).
6. Check the network layer: VPNs, proxies, DNS filters, and captive portals
Session refresh calls can fail quietly when a network blocks certain endpoints, or when a VPN rotates egress IPs frequently.
- Try a different network (mobile hotspot is a good test).
- Temporarily disable VPN/proxy and retry sign-in.
- Avoid captive portals (hotel/coffee shop Wi‑Fi). Log in to the portal first, then open Microsoft apps.
- If you use “family safety” or DNS filtering, ensure Microsoft login domains aren’t being blocked.
If switching networks immediately fixes it, you’ve confirmed it’s not your password or MFA—it’s connectivity or filtering.
7. Reset the app’s local authentication state (safe cache reset)
If the problem is inside a single Microsoft app, local caches can hold stale tokens that keep failing refresh.
- Sign out inside the app first (don’t just uninstall while signed in).
- Clear the app cache (where your OS provides this option) or use the app’s built-in reset tool if available.
- Update the app and your OS, then restart.
- Reinstall only after the above (reinstalling without clearing related identity storage doesn’t always help).
If you’re in an organization, some apps depend on a device registration/work profile. Removing that can break access—so if this is a work account, follow your IT guidance.
8. When it’s not a bug: security policies that force frequent sign-ins
Sometimes the “fix” is understanding the rule that’s kicking you out.
- Work/school accounts may have Conditional Access requiring re-auth every X hours/days.
- Risk-based sign-in can trigger extra prompts if your IP changes a lot (VPN) or if the system flags unusual activity.
- MFA methods that are out of date (old phone number, old authenticator device) can cause loops where you can’t complete the refresh step.
If only your work account is affected and it happens on multiple devices and networks, ask IT whether there’s a session policy or recent security change.
Final thoughts
Most Microsoft “keeps signing me out” issues come down to one of four things: cookie/storage rules, wrong device time, network/VPN interference, or account-context conflicts.
If you test on another network and in a clean browser profile, you can usually pinpoint which bucket you’re in within 10 minutes.