Signing into the Copilot app with a personal Microsoft account is usually effortless. With a work account it’s a different story — the login spins, throws a tenant error, loops back to sign-in, or succeeds and immediately signs you out. The failure feels personal, but it’s almost always organizational: your work identity passes through your company’s Entra ID tenant, its conditional access policies, and its app permissions before Copilot ever sees you.

That extra layer is also the map for fixing it. Work-account failures fall into clear buckets: the tenant blocks Copilot, conditional access isn’t satisfied, cached credentials are stale, or the app’s sign-in state is corrupted. Each has a distinct fix, escalating from things you can do yourself to things your IT admin must do.

This guide orders them that way — self-service first, IT escalation last. If your personal account loops too, Copilot login loop on Windows 11 covers the account-agnostic causes. Required companion reads for this batch: check NPU firmware version on Windows and Recall not capturing after lock screen .

Why this happens

  • Tenant-level Copilot block: Your Entra ID admin disabled Copilot or never granted it consent — the most common cause.
  • Conditional access policy failure: The tenant requires compliant devices, specific networks, or MFA states your laptop doesn’t satisfy.
  • Stale cached credentials: Old tokens in Credential Manager keep failing after password or policy changes.
  • Account type confusion: The app mixes the personal-account flow with a work identity, producing invalid tokens.
  • Network and proxy interference: Corporate VPNs or firewalls block the authentication endpoints Copilot needs.
  • Outdated app or WebView2: The sign-in web flow renders in WebView2 — a broken runtime breaks sign-in silently.

How to fix it

Work through these in order — diagnose first, then act.

Fix 1: Read the actual error message

Work-account failures produce specific errors — “admin consent required,” “conditional access failure,” “account doesn’t exist in this tenant” — each pointing at a different owner. Capture the exact message before doing anything else. Misdiagnosing a tenant block as an app bug wastes hours of reinstalling.

  1. Attempt sign-in and write down the exact error message or code.
  2. Note whether it fails at the password stage, the MFA stage, or after redirecting to Copilot.
  3. Try signing in on a phone hotspot to separate network policy from tenant policy.
  4. Ask whether colleagues on the same tenant can sign in — if none can, it’s tenant-wide.
  5. Keep the error text handy for the IT ticket in Fix 6.

Fix 2: Clear cached credentials and app state

If the error started after an IT policy change or a password change, stale tokens are the likely culprit. Windows caches authentication tokens aggressively, and Copilot keeps its own sign-in state on top. Clearing both forces a genuinely fresh authentication.

  1. In Credential Manager > Windows Credentials, remove entries mentioning Copilot, MicrosoftOffice, or your work email.
  2. In Settings > Apps > Installed apps, open Copilot’s Advanced options and click Reset.
  3. Restart the laptop to clear in-memory token caches.
  4. Launch Copilot and sign in fresh — type the full work email, don’t rely on autofill.
  5. Complete any MFA prompt carefully; an interrupted MFA leaves a half-authenticated state.

Fix 3: Untangle work and personal identities

Windows may offer your personal account’s session where the work flow is expected, or Copilot may be signed into a personal account while you attempt work sign-in inside it. Signing out fully, then signing in with only the work account, removes the ambiguity that produces invalid tokens.

  1. In the Copilot app, sign out of any signed-in account completely.
  2. Go to Settings > Accounts > Email & accounts and check the connected work or school account.
  3. If your work account isn’t there, add it under “Add a work or school account.”
  4. Reopen Copilot, sign in with the work account, and choose “Work or school account” explicitly if offered.
  5. Verify the app’s profile area shows your work identity, not a personal one.

Fix 4: Test off the VPN

Corporate VPNs and proxies sit directly in the authentication path and fail in ways that look like credential problems — timeouts during redirects, blocked consent pages, MFA callbacks that never arrive. Testing sign-in on a phone hotspot isolates the network in one shot.

  1. Disconnect from the corporate VPN and switch to a phone hotspot or home network.
  2. Attempt the work-account sign-in again and note the result.
  3. If it works off-VPN, reconnect and retest to confirm the VPN is the trigger.
  4. Ask your network team whether Microsoft 365 and Copilot auth endpoints are allowlisted.
  5. As a workaround, complete the initial sign-in off-VPN; later launches often work fine on-VPN.

Fix 5: Update the app, WebView2, and Windows

The work-account sign-in flow is a web flow rendered by WebView2 and depends on current authentication libraries in Windows. An outdated app, broken WebView2 runtime, or behind-on-updates Windows build can each silently break the handshake — sometimes only for work accounts, whose flow uses newer auth features.

  1. Update Microsoft Copilot from the Microsoft Store.
  2. Repair or update the Microsoft Edge WebView2 Runtime in Settings > Apps > Installed apps.
  3. Run Windows Update, install everything pending, and restart.
  4. Confirm you’re on a current build via the Windows 11 download page .
  5. Retry the work-account sign-in after all updates are in place.

Fix 6: Escalate to IT with evidence

When self-service fails, the block is in the tenant — only your Entra ID admin can lift it. But “Copilot doesn’t work” tickets bounce; “sign-in fails with error AADSTSxxx, tenant-wide, tested off-VPN, app and OS current” tickets get action. Hand your admin the exact error and the two most likely tenant-side causes: app consent and conditional access.

  1. Gather your notes: exact error, when it started, which fixes you tried.
  2. Ask IT to check whether Copilot is enabled and consented in the Entra ID tenant.
  3. Ask them to review conditional access policies targeting Copilot for requirements you don’t meet.
  4. Mention if colleagues are affected too — tenant-wide issues get priority.
  5. Meanwhile, use a personal account for non-work questions so you’re not blocked.

Closing

Work-account sign-in failures feel like the app is broken, but the app is usually the messenger — the verdict comes from tenant policies, a stale token, or the network in between. Work the order: read the error, clear cached credentials, untangle identities, test off the VPN, update everything, then escalate with evidence. When the tenant says yes and the tokens are fresh, the sign-in that failed ten times succeeds on the first try.

Frequently asked questions

Why does Copilot accept my personal account but not my work account?
Work accounts go through your organization’s Entra ID tenant, which may block Copilot or require admin consent. Personal accounts skip that layer entirely. The fix usually involves your IT admin enabling Copilot in the tenant or adjusting conditional access policies.
My IT admin says Copilot is allowed, but sign-in still fails. What next?
Cached credentials or a stale token in Windows Credential Manager is the next suspect. Clear the Copilot and MicrosoftOffice tokens, then sign in fresh — old tokens from before the policy change keep failing silently.
Does Copilot work with on-premises Active Directory accounts?
Copilot requires a cloud identity — Entra ID (formerly Azure AD) or a Microsoft account. Pure on-premises AD accounts without hybrid sync or cloud federation cannot authenticate to Copilot.
Can my employer see my Copilot chats when I use a work account?
Yes — with a work account, your Copilot activity falls under your organization’s data policies and may be visible to admins through audit logs. Keep personal questions in a personal-account session.