When Outlook keeps asking for your password every time you open it, it looks like a single problem — but it is actually three different problems wearing the same disguise. Each has a different cause. Each has a different fix. And the reason so many people spend hours trying to solve it without getting anywhere is that the fix for one cause does nothing for the other two. Identifying which of the three is happening is almost the entire task — the resolution follows quickly once the cause is named.
There is a particular kind of email frustration where the credentials are correct, the internet works, the account exists, and yet Outlook keeps asking for your password every single time you open it. Sometimes the prompt disappears when you enter the password. Sometimes it accepts the credentials and asks again ten minutes later. Sometimes it flatly refuses the correct password without any explanation. The user has done nothing wrong. The password has not changed. And the standard troubleshooting sequence — restart Outlook, restart the machine, confirm the account is active in the browser — produces no useful result.
The reason this is so persistent, and so hard to fix by guessing, is that recurring password prompts in Outlook are not one problem. They are three completely distinct problems that produce the same symptom. Understanding the three separately is what turns a confusing recurring issue into a specific, addressable one.
The three causes and why they matter
Before going into any fix, it helps to see all three causes side by side. Each is real. Each is common. Each requires a different response. And each is completely invisible from the prompt itself — Outlook does not tell you which cause is producing the request, so the diagnostic work starts with figuring out which category applies.
-
Cause 1 — Protocol
The authentication method Outlook is using is no longer supported by the server
Microsoft has spent years deprecating Basic Authentication — the older method where Outlook sends a username and password with every request. Newer Modern Authentication uses short-lived OAuth tokens instead. When Outlook is configured for Basic Auth against a server that no longer accepts it, the authentication fails silently and Outlook prompts for the password again. The password is not wrong. The protocol has been rejected. This affects older Outlook versions and misconfigured account profiles particularly.
-
Cause 2 — Storage
Windows can’t store or retrieve the credentials Outlook gives it
When Outlook receives valid credentials — whether a password or a Modern Authentication token — it hands them to Windows Credential Manager for storage. If that storage layer fails to save, gets corrupted, or contains stale entries from before a recent password change, Outlook has no cached credential to send on the next request. The prompt returns because Windows quietly forgot what it was supposed to remember.
-
Cause 3 — Policy
Your organisation requires periodic re-authentication by design
On business accounts managed through Microsoft 365 or Azure Active Directory, administrators can configure Conditional Access and sign-in frequency policies that require users to re-authenticate at defined intervals — daily, weekly, after location changes, or after specific risk events. This is a security feature working as intended. From the user’s perspective, it looks identical to a bug. From the policy’s perspective, it is doing exactly what it was configured to do.
Three completely different causes, three completely different signals, three completely different fixes. The prompt looks the same in all three cases.
The password prompt is identical in all three cases. What produces it, and what resolves it, could not be more different.
Cause 1 — The authentication protocol Outlook is using no longer works
Beginning October 1, 2022, Microsoft started disabling Basic Authentication in Exchange Online — the standard method where a username and password are sent with every email request. The transition has continued in phases through 2024, 2025, and 2026 across the various protocols involved (EWS, ActiveSync, IMAP, POP3, Remote PowerShell), with SMTP AUTH scheduled to follow. The replacement is Modern Authentication, which uses short-lived OAuth 2.0 tokens rather than transmitting passwords repeatedly.
When Outlook is configured for an account that has moved beyond Basic Auth but the local profile is still trying to use it, the server rejects the connection. Outlook cannot distinguish “the password is wrong” from “the protocol is wrong,” so it does the only thing it knows how to do: prompt for the password again. The user enters correct credentials. The server rejects them again — not because they are wrong, but because it will not accept them through the method being used. The loop continues.
This cause is particularly common on older Outlook versions. Outlook 2007, 2010, 2013, and MSI-installed Outlook 2016 do not support Modern Authentication for Outlook.com and Exchange Online accounts. Outlook 2019 LTSC, Outlook 2021 LTSC (below certain builds), and any Click-to-Run version below the required threshold also produce this behaviour. It also affects accounts that were originally set up as POP or IMAP — Outlook for Windows does not currently support OAuth 2.0 authentication for POP or IMAP connections to Microsoft accounts, and Microsoft has explicitly stated there are no plans to add it.
How to identify this cause specifically
Cause 1 has a distinctive signature: the prompt loops immediately after entering the correct password, sometimes several times in a row, and the same account works fine in a web browser. The pattern is “correct credentials accepted then immediately rejected” rather than “credentials work then need re-entry later.” If this describes the situation, the issue is almost certainly at the protocol layer, not the credential layer.
Cause 2 — Windows can’t remember the credentials it has been given
Windows stores credentials for applications like Outlook in a system component called Credential Manager, accessible through Control Panel. When Outlook successfully authenticates, it hands the resulting credential or token to Credential Manager for future use. On the next request, Outlook asks Credential Manager for the credential and uses it silently. When this system works, users never see a password prompt after the initial setup.
When it stops working, the causes are specific. A Windows update may invalidate cached credentials. A password change made on the server or through Azure AD may not propagate to the locally cached version. Credential Manager itself can develop corrupt entries, particularly after Office repair operations or profile migrations. In business environments with roaming profiles, the Credential Manager store can fail to sync across devices, leaving Outlook without access to the credentials it saved elsewhere.
The result is that Outlook goes through the motions of authenticating, receives a valid credential, hands it to Credential Manager, and finds nothing there when it looks for it later. The prompt appears again because from Outlook’s perspective, no stored credential exists — even though it just stored one.
How to identify this cause specifically
Cause 2 typically appears after something changed: a password update, a Windows Update installation, a profile migration, or an Office repair operation. The distinguishing feature is that “Remember my credentials” checkboxes do not seem to persist, and the prompt returns at seemingly random intervals rather than on a fixed schedule. Sometimes Outlook works for hours and then prompts; sometimes it prompts on every launch. The unpredictability is the signal.
Cause 3 — Your organisation requires re-authentication by design
On work or school accounts managed through Microsoft 365 or Azure Active Directory, administrators can configure security policies that require users to re-authenticate at defined intervals or in response to specific triggers. Conditional Access policies enforce these rules. Sign-in frequency policies set the cadence. Neither of these is a malfunction — they are intentional security measures, and they are working as designed even though the user experience looks identical to the other two causes.
Common configurations include: re-authentication required daily, or every certain number of hours, particularly for accounts with elevated privileges; re-authentication triggered by location changes, so travellers may face prompts they don’t see at their usual desk; re-authentication triggered by device compliance status, so a Windows update that briefly changes compliance posture can force fresh sign-in; and re-authentication after risk-based triggers, where Microsoft’s identity risk assessment flags the sign-in as unusual.
Microsoft’s own statistics illustrate why organisations enforce these policies. Ninety-nine percent of password spray attacks use legacy authentication protocols. Ninety-seven percent of credential-stuffing attacks do the same. Accounts in organisations that have disabled legacy authentication experience sixty-seven percent fewer compromises than those where it remains enabled. The re-authentication prompts users see are the visible symptom of a security model designed around those numbers.
How to identify this cause specifically
Cause 3 has a clear pattern: the prompts appear on a schedule, or in response to specific events like travelling or changing networks, rather than randomly. They typically involve MFA (a phone approval or authenticator code) rather than just a password. And the account is a work or school account, not a personal one. If these three characteristics are present, the “problem” is almost certainly a policy — and the fix is not to bypass it but to understand it.
A password prompt that appears on a schedule is not a bug. It is a decision someone made about how often the identity behind that account should be re-verified.
What most people get wrong when troubleshooting
The most common mistake is applying the wrong fix to the right problem — or more precisely, applying the fix for one of the three causes when a different cause is producing the symptom. Users spend hours clearing Credential Manager when the actual problem is Basic Authentication deprecation, or clear their profile and reinstall Outlook when the actual problem is a Conditional Access policy that will just re-fire the next day.
The second common mistake is treating cause 3 as if it were a technical fault to be resolved. Many recurring password prompts on work accounts are intentional — the IT department has configured sign-in frequency for security reasons, and no client-side troubleshooting will change that. The prompt is the system working. Complaints from users sometimes lead organisations to loosen the policy, but that is an organisational decision, not a technical fix.
A subtle further complication: two of the three causes can compound. An older Outlook using Basic Authentication that hits Exchange Online can produce a loop that clears Credential Manager cache each cycle, creating what looks like both a protocol failure and a credential storage failure. In these cases, fixing the protocol issue (upgrading Outlook or re-adding the account as Exchange rather than POP/IMAP) automatically resolves the credential symptoms — because the underlying cause was never at the credential layer in the first place.
Working through it — one action per cause
When Outlook keeps asking for your password, the useful path forward depends entirely on which of the three causes above actually applies. The steps below map to the three causes. Do not run through all of them in sequence. Identify which cause matches your situation first, then apply the corresponding fix. Running the wrong fix wastes time and can create new problems.
Confirm you are running a supported Outlook version — for Outlook.com and
Exchange Online, that means Microsoft 365 Apps for Outlook, or Outlook LTSC
2021 (build 11601.10000 or higher), or later. Remove the affected account
from Outlook, then re-add it using auto account setup — which will
configure it as an Exchange or Microsoft 365 account with Modern
Authentication rather than as POP or IMAP. For administrators, the
registry key HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Identity
with EnableADAL set to 1 forces Modern Auth on
supported versions.
Open Control Panel and navigate to User Accounts → Credential Manager → Windows Credentials. Look for entries relating to Outlook, Microsoft Office, MicrosoftOffice16, or your specific email address. Delete each of them. Close Outlook completely. Reopen Outlook and enter credentials fresh when prompted. This forces a clean save into the Credential Manager rather than relying on whatever stale or corrupt entries were there before. Combined with running the Microsoft Support and Recovery Assistant if the problem persists, this resolves the majority of storage-side issues.
On managed accounts, your IT administrator controls Conditional Access and sign-in frequency settings through the Microsoft Entra admin centre. Complaining to the vendor or clearing local caches will not affect these settings — they are enforced server-side by policy. If the current cadence is disruptive, the conversation to have is with IT about whether the policy could be adjusted while still meeting security requirements. Some organisations set sign-in frequency to seven days for standard users and twenty-four hours for privileged accounts — both are configurable, both are security decisions, both are appropriate for their contexts.
Outlook occasionally develops profile-level corruption that produces password prompts for reasons that don’t map cleanly to any of the three causes above. In these situations, creating a new Outlook profile — Control Panel → Mail → Show Profiles → Add — and setting up the account from scratch in the new profile often resolves the issue where every other fix has failed. This is different from clearing credentials or re-adding the account; it creates an entirely separate profile without any inherited state from the old one. If the same account works cleanly in a fresh profile but breaks in the old one, the profile itself was the fault. This pattern is also connected to why Outlook sometimes re-downloads the same emails after profile changes — a different symptom of the same underlying profile sensitivity.
The pattern worth carrying forward
Recurring password prompts in Outlook are one of the clearest examples of a recurring theme in modern software: the visible symptom rarely corresponds one-to-one with the underlying cause. A single behaviour can be produced by three completely separate systems failing in three completely separate ways — and no amount of trying different fixes for the wrong cause will resolve the issue. The diagnostic work is not in fixing the problem. It is in identifying which problem is happening.
For Outlook specifically, that identification comes down to three questions: is the protocol Outlook is trying to use still accepted by the server, can Windows actually store what Outlook gives it, and does the organisation require re-authentication by policy. Microsoft has published detailed technical guidance for each — including its own dedicated troubleshooting article on Outlook prompting for password when Modern Authentication is enabled, which is the canonical reference for the specific technical fix paths on the protocol side.
“The prompt looks the same in all three cases. What produces it, and what makes it stop, do not overlap in the slightest.”
There is no universal fix for Outlook password prompts because there is no universal cause. Naming which of the three is happening resolves the issue faster than trying every fix in sequence — because two of every three fixes would have been irrelevant regardless of how carefully they were applied.
XpertechSolution — Technology, Understood