caa70004
Microsoft Teams Software
Severity: MinorWhat Does This Error Mean?
Teams error caa70004 means the sign-in flow could not reach Microsoft's authentication endpoint — login.microsoftonline.com or aadcdn.msftauth.net.
Cause is almost always a network policy blocking those domains: a proxy, a corporate firewall, a captive portal, or strict TLS inspection.
The fix is to either let those endpoints through or sign in from a network that does.
Affected Models
- Microsoft Teams desktop on Windows 10 and 11
- Microsoft Teams desktop on macOS
- Teams 'classic' and the new Teams 2.0
- Teams when your PC is behind a corporate proxy
Common Causes
- Corporate proxy blocking *.microsoftonline.com or *.msftauth.net
- TLS-inspection firewall breaking the certificate pinning Teams uses
- Captive portal at a hotel or coffee shop blocking authentication traffic
- PAC file or proxy auto-detect pointing to the wrong proxy
- Antivirus HTTPS scanning interfering with token requests
How to Fix It
-
Try signing in from a different network.
Tether to your phone or use mobile data.
If sign-in works there, the office or home network is blocking something.
If it fails on every network, the problem is on this PC — skip ahead to the cache and proxy steps. -
Check Windows proxy settings.
Open Settings → Network & Internet → Proxy.
If 'Use a proxy server' is on but you are not on a corporate network, turn it off.
If you are on a corporate network, check with IT — Microsoft documents the exact endpoints Teams needs in their 'Office 365 URLs and IP address ranges' list. -
Sign out of Teams and clear the cache.
Quit Teams from the system tray.
Press Win+R and paste %appdata%\Microsoft\Teams (or %localappdata%\Packages\MSTeams_8wekyb3d8bbwe for the new Teams).
Delete the Cache and Code Cache folders.
Reopen Teams and try signing in. -
Pause antivirus or security software temporarily.
Some endpoint security tools (Trend Micro, Symantec, Bitdefender) inspect HTTPS traffic by replacing the certificate.
Teams rejects the swapped certificate and shows caa70004.
Pause web protection for two minutes, retry sign-in.
If that works, ask the security vendor for the correct exclusion.
Frequently Asked Questions
What domains does Teams sign-in actually need?
At minimum: login.microsoftonline.com, login.live.com, aadcdn.msftauth.net, login.windows.net, and *.teams.microsoft.com.
If your firewall blocks any of these — including by category-based filtering ('Web mail' or 'Cloud storage') — sign-in fails with caa70004.