Outlook Keeps Asking for Your Password? What That Loop Actually Means

It starts as a mild annoyance and turns into a daily tax. Outlook opens, a box appears asking for your password, you type the password you know is correct, and it goes away — until lunchtime, when it comes back. Sometimes it arrives as a proper dialog, sometimes as the words "Need Password" sitting in the status bar at the bottom of the window, sometimes as a sign-in screen that spins and returns you to the same sign-in screen. Meanwhile mail may still be arriving, which makes the whole thing feel less like a fault and more like being nagged.

The good news is that this is one of the most solvable problems in desktop email. The bad news is that the internet's advice on it is a wall of near-identical listicles that tell you to try eleven things in a row, most of which do not apply to you, and several of which end in "or use our recovery tool." You do not need eleven things. You need to work out which of two situations you are in, and then do the two or three steps that match.

The one question that splits this in half

Before you change a single setting, answer this: when you type your password, does Outlook accept it and then ask again later — or does it reject it on the spot and immediately re-prompt?

If it accepts the password and connects, and the prompt returns after a restart, after a sleep, or a few hours later, nothing is wrong with your password. This is a storage problem: your computer is holding an old credential or a stale sign-in token, and Outlook keeps reaching for the wrong one. That is the Credential Manager and keychain territory covered below, and it is by far the most common version.

If it rejects the password — you type it, the box shakes its head and comes straight back, and the same password logs you in fine on the provider's website — then this is not a storage problem at all. Something has changed about what your provider will accept from a desktop mail program, or about the password itself. Skip ahead to the sections on app passwords and on the possibility that somebody else changed it. Clearing cached credentials in this case does nothing except make you type the wrong password one more time.

It is worth being deliberate about this because the two paths share none of their fixes, and people routinely spend an afternoon on the wrong one. If you are genuinely unsure, watch the send/receive status after you type it. Connecting, even briefly, means the credential was accepted.

Which Outlook are you actually running?

This matters more than any guide written before the last couple of years accounts for, because there are now two different Windows programs called Outlook and they authenticate differently. Classic Outlook is the traditional desktop application that installs with Microsoft 365 or Office, keeps mail in a local data file, and supports the old COM add-ins. New Outlook for Windows is the rebuilt app based on the same web technology as Outlook on the web; it is faster to start, cloud-first, and does not support several classic features such as COM add-ins or local PST archives.

The practical consequence: most of the well-known password-loop fixes — Credential Manager entries, the "Always prompt for logon credentials" checkbox, rebuilding a mail profile — are classic-Outlook levers. If you are in new Outlook, the equivalent move is to sign the account out and back in from Settings, then Accounts, rather than hunting for dialogs that no longer exist in that app.

You can tell them apart at a glance by the toggle. New Outlook has a switch in the top-right corner labelled to take you back to the classic version; classic Outlook has a "Try the new Outlook" toggle instead. Work out which one you are in before you start following steps, because half the instructions on the web silently assume the other.

The usual culprit: a saved credential that went stale

Here is the mechanism, and it is worth understanding because it explains why ticking "Remember my credentials" appears to do nothing. Windows keeps saved sign-in details in a vault called Credential Manager. When you change your email password — on your phone, on the web, because your workplace made you — the copy sitting in that vault does not update. Outlook keeps presenting the old one, gets refused, and asks you.

Microsoft describes exactly this in its own troubleshooting documentation: after a password change, the stored credentials "are not overwritten when Outlook triggers the authentication prompt even if you enable the Remember my credentials option." That is the whole problem in one sentence, and it is the reason the checkbox feels broken. It is not broken. It is being outvoted by a stale entry that has to be deleted by hand.

To clear it on Windows: close Outlook completely — check Task Manager for a lingering OUTLOOK.EXE if it has been misbehaving — then open Credential Manager. The quick route is the Windows key plus R, then control.exe /name Microsoft.CredentialManager; the long route is Control Panel, then User Accounts, then Credential Manager. Choose the "Windows Credentials" tab rather than Web Credentials. Look through the Generic Credentials list for anything with Outlook, Office, MicrosoftOffice16_Data, Microsoft 365, or your mail server's name in it. Expand each one and choose "Remove from Vault". Then reopen Outlook and sign in when asked.

Two reassurances, because deleting things labelled "credentials" makes people nervous. It does not delete any email, any mail account, or any settings — only the saved copy of a password, which Outlook will re-save the moment you sign in again. And the entries reappearing afterwards is the expected outcome, not a sign it failed; you want them back, just holding the current password this time.

The setting somebody switched on and forgot

If the loop has been there since the account was first set up, and it is an Exchange or work account in classic Outlook, check one specific checkbox before anything else. Go to File, then Account Settings, then Account Settings again; select the account and choose Change, then More Settings; open the Security tab and look for "Always prompt for logon credentials". If it is ticked, that is your answer — the account has been explicitly configured to demand a password on every connection, and clearing it lets Outlook use the cached credential instead.

A very common follow-up: the option is greyed out and cannot be changed. That is normal on a modern account and is not a fault. The checkbox belongs to the older basic-authentication era; when the account uses modern authentication with OAuth tokens rather than a stored password, the setting no longer applies and the box is simply inert. If it is greyed out, move on — the cause is elsewhere.

And there is a work-account variation that catches out even competent people. Microsoft documents that if an administrator uses the Office Group Policy templates to stop Outlook saving basic authentication credentials, the Remember my credentials option "is still available in the password prompt, but has no effect when you enable it." So on a managed computer you can tick that box honestly and correctly, forever, and it will never stick — because a policy is quietly discarding it. If you are on a work machine and nothing you do makes the credential persist, this is the point to stop troubleshooting and ask your IT contact whether that policy is set.

The obscure one that stumps everybody

This one deserves its own section because it produces a distinctive symptom and almost nothing outside Microsoft's own knowledge base mentions it. If Outlook cannot connect and shows "Need Password" in the status bar, and clicking that message gives you "This feature has been disabled by your administrator" — or if you get a password prompt at every single start and cannot create a new profile at all — the cause may have nothing to do with your password.

Microsoft's KB 3060280 attributes those exact symptoms to the "Allow Office to connect to the Internet" checkbox under Trust Center Privacy Options being unselected. Office has been prevented from reaching the sign-in service, so authentication can never complete, and the visible result is an endless demand for a password that would not help even if you typed it.

The fix in current versions: File, then Options, then Trust Center, then Trust Center Settings, then Privacy Options — and tick "Let Office connect to online services from Microsoft to provide functionality that's relevant to your usage and preferences". Click OK twice. In Outlook 2013 the same checkbox is worded "Allow Office to connect to the Internet". If the box is greyed out and unavailable, that is a registry or Group Policy setting (UseOnlineContent set to 0), which on a managed machine means your administrator has to change it rather than you.

We mention this partly because it is a real fix and partly as a warning against pattern-matching. Someone with this problem can clear Credential Manager fifty times, rebuild their profile, reinstall Office and change their password twice, and none of it will ever work, because the actual cause is a privacy checkbox three menus deep. If the standard fixes are having no effect at all, look for a cause of a different shape.

When the password is genuinely being refused: app passwords

Now the other branch. If Outlook rejects a password that definitely works on the provider's website, and the account is Gmail, Yahoo, AOL or similar, the most likely explanation is that your normal password is no longer an acceptable thing to type into a desktop mail program.

Google removed the old "less secure app access" option, and where an app cannot use "Sign in with Google," the supported route for an account with 2-Step Verification is an app password — a 16-digit code generated on your Google account's security page that you paste into Outlook in place of your usual password. Yahoo works the same way: third-party apps that do not use Yahoo's own sign-in page need a password created under "Create app password" in the External connections section of Yahoo's Account Security page, and generating one requires Two-Step Verification to be switched on first.

Two details about app passwords that cause real trouble later. First, you generally see the code once, at generation — so paste it straight into Outlook rather than planning to look it up again. Second, and this is the security-relevant one: Yahoo states that app passwords remain active even if you change your main account password, and that to invalidate one you must delete it. That is worth sitting with. If you ever hand a device to someone, sell a laptop, or suspect an account has been meddled with, changing your password is not sufficient — you have to go into that list and revoke the app passwords too, or you have left a working key behind. The same reasoning applies to any provider that issues them.

The tell-tale sign you are in this situation rather than the stale-credential one: the rejection is instant and consistent, it happens on a freshly added account on a brand-new computer, and the same credentials work perfectly in the provider's web interface and phone app.

The possibility worth taking seriously for thirty seconds

There is one cause that is far less common than the others and far more urgent, so it is worth a brief, deliberate check rather than an afterthought. If your password is being rejected and you did not change it, consider that somebody else may have.

A sudden password prompt on an account that has worked for years is a recognised symptom of a compromised mailbox, because the intruder's first move after getting in is usually to change the password and lock the real owner out. The distinguishing signs are that it starts abruptly on a day you can name; the password is refused everywhere, not just in Outlook; and there are corroborating oddities — a password-reset email you did not request, sent messages you did not write, missing mail, a new forwarding rule, or friends mentioning strange emails from you.

If any of that matches, stop working on Outlook and go straight to securing the account itself, from a different device, starting with a password reset and a review of the account's recent sign-in activity and forwarding rules. Outlook is the least of your problems in that scenario, and the sooner you deal with the account the less clean-up there is.

On a Mac: the keychain equivalent

Outlook for Mac has exactly the same failure mode with different plumbing. The Mac keychain ends up holding several conflicting authentication tokens for the same account, Outlook cannot tell which one to trust, and it asks you to sign in again regardless of how correct your password is. You may see it as a repeated "Exchange password required" notification rather than a dialog inside Outlook.

The equivalent clean-out: quit Outlook and every other Office application, then open Keychain Access from Applications, then Utilities. Search for Exchange, check the account shown at the top of the window for each result, and delete the entries belonging to the account that keeps prompting. Then delete the Office identity cache items — searching for Office will surface entries named "Microsoft Office Identities Cache 2" and "Microsoft Office Identities Settings 2" — along with any MicrosoftOffice15_2_Data:ADAL: token entries. Close Keychain Access, reopen Outlook, and sign in fresh.

As on Windows, none of this touches your mail. You are deleting saved keys, not messages, and the application rebuilds them on the next successful sign-in.

If none of that worked: the profile

Classic Outlook keeps your accounts and settings in something called a profile, and a damaged profile can hold broken authentication data that survives everything above — you clear the vault, you fix the settings, and the loop comes straight back. The remedy is to create a fresh profile and add the account to it.

It is not a difficult job, but it is the last step rather than an early one, because you are rebuilding your account setup from scratch: signatures, rules, added mailboxes, and any locally stored archive files all need attention afterwards. Do the cheaper fixes first, and if you have a work account with several mailboxes attached, this is the point where it is reasonable to hand it to someone who does it regularly.

One general note before you get that far: keep Outlook updated. A meaningful share of credential-loop reports over the years have been bugs fixed in a later update, and Microsoft's own resolution for at least one classic version of this problem is simply to install the current update rather than to work around it.

What not to do — and what not to buy

Search this problem and you will meet two categories of result that are worth naming. The first is the software pitch: "Outlook password recovery" and PST repair tools sold on the back of an article about password prompts. A repeating password prompt is a credential-storage or authentication problem. It is not a damaged data file, and no product can recover a password your provider is refusing. Nothing in this guide costs anything, and none of it needs a download.

The second is the one we care about more, because it costs people real money. If a password box appears somewhere unexpected — inside a web page, after clicking a link in an email about your mailbox being full or your account being suspended, or alongside a phone number to call for "Outlook support" — treat it as hostile until proven otherwise. A credential prompt is the single most valuable thing a phishing page can put in front of you, and someone already frustrated by a genuine password loop is exactly the target. Real Outlook prompts come from the Outlook window on your own computer, unprompted by any email. Microsoft does not staff a support number that finds you first, and nobody legitimate needs remote access to your machine to fix a stale credential.

A related habit worth forming: if you are ever unsure whether a sign-in screen is genuine, close it and go to the provider's website by typing the address yourself. If the account really needs attention, it will say so there too.

A short checklist

Work out first whether the password is being accepted or rejected. Accepted and asking again means a stale saved credential: clear the Outlook and Office entries from Windows Credential Manager, or the Exchange and Office identity entries from Mac Keychain Access, then sign in once more.

Rejected means the credential itself is the issue: for Gmail, Yahoo or AOL, generate an app password; for anything else, confirm the password still works on the provider's website, and if it does not, treat the account as possibly compromised. Along the way, check the Exchange "Always prompt for logon credentials" box if you have one and it is not greyed out, and if the symptom is "Need Password" with an "disabled by your administrator" message, go and tick the Trust Center option that lets Office connect to online services. Rebuild the profile only when everything else has failed.

How we can help

This is a small, irritating problem with a disproportionate cost: a few seconds each time, several times a day, on the one application most people cannot work without. It is also the kind of job where the difference between ten minutes and a lost afternoon is entirely down to whether you started on the right branch of the diagnosis.

We sort out email for households and small businesses across Southern California and the Coachella Valley — clearing stale credentials properly, getting Gmail and Yahoo accounts working in desktop Outlook with app passwords set up correctly, rebuilding damaged profiles without losing mail, and moving businesses onto Microsoft 365 or Google Workspace when the underlying setup is the real problem. If the prompt is on a work computer and you suspect a policy is behind it, we can tell you that quickly too, rather than leaving you to try the same eleven steps a fourth time. And if it turns out the password was changed by somebody who was not you, we will deal with that first.