Error 80090016: Trusted Platform Module Has Malfunctioned

A user opens Outlook or another Microsoft 365 app and gets this prompt, as Dell’s support article quotes it:

Your computer’s Trusted Platform Module has malfunctioned. If this error persists, contact your system administrator with the error code 80090016.

Some users don’t get the prompt at all. Outlook, SharePoint and OneDrive just keep asking them for credentials. On a domain-joined PC you might find it from the other side: Microsoft Entra hybrid join fails, and the join-phase error is NTE_BAD_KEYSET (0x80090016).

The wording points at hardware, but the documented causes are about keys. Microsoft’s hybrid join troubleshooting table says this error “indicates that the keyset doesn’t exist” and names two causes: the TPM was cleared, or the device came from a bad sysprep image. Dell adds the third common one: a system board replacement, which gives the device a new TPM that never held the old keys.

Re-register the device so Windows creates new keys. Don’t clear the TPM to fix it: a cleared TPM is one of the documented causes.

Quick Fix checklist

1. Open an elevated Command Prompt and run dsregcmd /status. Record AzureAdJoined, DomainJoined and WorkplaceJoined so you know the join type.
2. In the same output, record TpmProtected, DeviceAuthStatus, AadRecoveryEnabled and KeySignTest. KeySignTest needs elevation.
3. Find out what happened to the TPM: cleared in firmware or Windows, board replaced, or device built from a sysprep image.
4. Don’t clear the TPM. Microsoft’s hybrid join guidance says to avoid it.
5. Re-register for the join type: dsregcmd /leave and a restart for hybrid joined devices, dsregcmd /forcerecovery for Microsoft Entra joined devices, and remove and re-add the work account for registered devices.
6. Sign out and back in, run dsregcmd /status again and check that KeySignTest shows PASSED and AzureAdPrt shows YES.
7. If a batch of newly imaged devices all show 80090016, stop fixing devices one by one and check the image.

What the error means in Microsoft’s words

The code is NTE_BAD_KEYSET, 0x80090016, or -2146893802 in signed decimal. The user prompt drops the 0x, so Outlook and other Microsoft 365 apps show 80090016.

The Microsoft Entra hybrid join troubleshooting guide lists it under TPM errors in the join phase:

The Trusted Platform Module (TPM) operation failed or was invalid.

And in the resolution column:

This error indicates that the keyset doesn’t exist. This error happens when the TPM is cleared on the systems, or when there’s a bad sysprep image. Avoid clearing the TPM in BIOS or Windows settings.

The Web Account Manager (WAM) error reference lists 80090016 as NTE_BAD_KEYSET, an “Issue with the device Trusted Platform Module (TPM)”, and points to Microsoft’s device recovery instructions.

The Primary Refresh Token (PRT) article explains that the device key is created during device registration and, on a device with a working TPM, the private key is bound to the TPM. Microsoft says “A PRT isn’t issued if the corresponding device key signature can’t be validated.” Without the key the device can’t get a PRT, and single sign-on breaks.

Why the obvious diagnosis can be wrong

The prompt says the TPM malfunctioned, so the first instinct is to clear the TPM or replace the board. Each of those throws away the registered keys.

• Clearing the TPM is a documented cause of this error. Microsoft’s TPM troubleshooting page says clearing “causes you to lose all created keys associated with the TPM, and data protected by those keys, such as a virtual smart card or a sign-in PIN.”
• A new board is a new TPM. Dell’s article on this error after a system board replacement says the tokens Windows and Outlook created still look for the original TPM, so verification fails.
• Some older advice says to clear the TPM. Microsoft’s archived Microsoft 365 Apps activation error article still lists Clear TPM as a step. That page sits under previous versions. I’d follow the current Entra guidance and leave the TPM alone.
• Reinstalling Office doesn’t help. Dell says the error is tied to TPM keys and broker tokens, not the Office installation files.

Check the exact code first. The other TPM errors in the same Microsoft table have different fixes:

Code	Microsoft’s reason	Microsoft’s resolution
NTE_BAD_KEYSET (0x80090016)	TPM operation failed or was invalid; the keyset doesn’t exist	Avoid clearing the TPM; if it was cleared, users might need to remove and re-add accounts
NTE_AUTHENTICATION_IGNORED (0x80090031)	TPM is locked out	Transient. Wait for the cool-down period
TPM_E_PCP_INTERNAL_ERROR (0x80290407)	Generic TPM error	Disable TPM; Windows 10 1809 and later complete hybrid join without it
TPM_E_NOTFIPS (0x80280036)	TPM in FIPS mode isn’t supported	Disable TPM; Windows 10 1809 completes hybrid join without it

Microsoft documents disabling the TPM for the last two rows only.

Evidence to inspect

dsregcmd /status

Run it from an elevated Command Prompt. The dsregcmd troubleshooting article documents each field.

In the Device Details section, shown only on Microsoft Entra joined and hybrid joined devices:

• TpmProtected is YES when the device private key is stored in a hardware TPM.
• KeyProvider shows which provider stores the device private key.
• DeviceAuthStatus checks the device’s health in Microsoft Entra ID. SUCCESS means the device is present and enabled. Microsoft added this field in Windows 10 version 21H1.

In the post-join diagnostics, under Diagnostic Data:

• AadRecoveryEnabled set to YES means “the keys stored in the device aren’t usable, and the device is marked for recovery.”
• KeySignTest set to PASSED means the device keys are healthy. Microsoft says a failed KeySignTest usually marks the device for recovery, and the next sign-in triggers recovery and re-registration. This test needs elevated privileges.

For a hybrid join that never completed, look for the Previous Registration block in Diagnostic Data on Windows 10 version 1803 or later. Error Phase and Client ErrorCode tell you where it failed. On earlier versions, Microsoft points to event ID 204 in the User Device Registration log for join-phase errors.

AAD Operational log

Microsoft’s Office sign-in troubleshooting article ties repeated credential prompts to a malfunctioning or reset TPM and tells you where to look:

1. Open Event Viewer.
2. Go to Applications and Services Logs > Microsoft > Windows > AAD > Operational.
3. Look for errors matching 0x?028????, 0x?029????, 0x?009????.

0x80090016 matches the last pattern. The same section lists other causes of repeated prompts, a disabled device (AADSTS135011) and a deleted device (AADSTS50155), so read the whole event before you blame the TPM.

TPM status

Run tpm.msc and check the status. Dell’s guidance is to confirm it reads “The TPM is ready for use.” A ready TPM plus 80090016 fits the missing-keys explanation.

The fix

Back up anything local before you start. Microsoft’s manual recovery steps include a data backup for Microsoft Entra joined devices.

Microsoft Entra hybrid joined devices

Microsoft’s Office troubleshooting article says Windows 10 version 1709 and later detect TPM failures and start a user recovery process automatically. The PRT article adds that hybrid join recovery happens silently. If it didn’t happen:

1. Run dsregcmd /status and confirm AzureAdJoined : YES and DomainJoined : YES.
2. In an elevated Command Prompt, run dsregcmd /leave.
3. Restart the device.

Microsoft’s device management FAQ gives the same re-registration path as dsregcmd.exe /debug /leave, then sign out and sign in to trigger the scheduled task that registers the device again.

Microsoft Entra joined devices

Recovery needs a user with administrator rights on the device. The FAQ documents this sequence for re-registering a Microsoft Entra joined device:

1. Open an elevated Command Prompt.
2. Run dsregcmd /forcerecovery.
3. Select Sign in in the dialog and finish the sign-in.
4. Sign out and back in to complete the recovery.

If that doesn’t work, Microsoft’s manual recovery is heavier: back up data, create a new local administrator, disconnect the account under Settings > Accounts > Access work or school, sign in with the local administrator and reconnect to Microsoft Entra ID. I’d try dsregcmd /forcerecovery first. A disconnect is a full re-join, so I keep it as the fallback.

Registered devices (Add a work account)

Remove the work account under Settings > Accounts > Access work or school, then add it back. Microsoft documents this in both the Office troubleshooting article and the FAQ.

If prompts continue after that, the archived Microsoft 365 activation article lists two cleanup steps: remove MicrosoftOffice16 entries from Windows credentials in Credential Manager, and delete the files in these two folders, then restart:

%LOCALAPPDATA%\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\AC\TokenBroker\Accounts
%LOCALAPPDATA%\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AC\TokenBroker\Accounts

Dell’s version renames the whole Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy folder instead. I’d start with Microsoft’s narrower delete.

When the cause is a sysprep image

Microsoft says to build sysprep images on a computer that isn’t Microsoft Entra joined, hybrid joined or registered. Fix the image first. I’d expect devices already built from it to need the per-device recovery above for their join type, since each one is missing its own keyset.

I haven’t run these steps for this article. They come from the Microsoft and Dell pages listed under Sources.

Verify the fix

1. Sign out and sign back in.
2. Run dsregcmd /status elevated.
3. Check KeySignTest : PASSED and AadRecoveryEnabled : NO.
4. Check DeviceAuthStatus : SUCCESS on joined and hybrid joined devices.
5. Check AzureAdPrt : YES under User State or SSO State.
6. Open the app that showed the prompt and confirm the 80090016 error is gone.

What not to waste time on

• Clearing the TPM a second time. Microsoft lists a cleared TPM as a cause of this error.
• Reinstalling Microsoft 365 Apps.
• Disabling the TPM. Microsoft documents that for 0x80290407 and 0x80280036, not for NTE_BAD_KEYSET.
• Treating 0x80090031 the same way. Microsoft calls a locked-out TPM transient: wait for the cool-down and retry.

Prevention checklist

• Capture sysprep images only from a machine that has never been Microsoft Entra joined, hybrid joined or registered.
• Don’t clear the TPM on enrolled devices. If you must, use the operating system (for example tpm.msc), not UEFI, and back up TPM-protected data first, as Microsoft’s TPM guidance says.
• Add device re-registration to the board replacement runbook, with a local administrator account the technician can use.
• Keep TPM firmware current. Microsoft’s Office troubleshooting article recommends a TPM firmware update to avoid this class of issue.
• Add dsregcmd /status with KeySignTest to your post-repair checks.

Takeaway

If I see 80090016, my first question is what happened to that TPM: cleared, swapped with the board, or inherited from a bad image. Then I re-register the device for its join type and check KeySignTest. I don’t clear the TPM to fix it, because the current Entra docs list a cleared TPM as a cause.

Related ZakitPro guides:

• Hybrid join error 0x801c001d covers the SCP read failure in the same hybrid join troubleshooting table.
• OneDrive error 0x8004de40 for work or school accounts covers another sign-in failure users report from OneDrive.
• BitLocker recovery keys guide is worth reading before anyone touches the TPM on an encrypted device.
• Autopilot TPM attestation error 0x81039001 covers a TPM failure during pre-provisioning, a different stage and a different fix.

Sources

• Troubleshoot Microsoft Entra hybrid joined devices: NTE_BAD_KEYSET meaning, causes and “avoid clearing the TPM”; neighboring TPM codes; Previous Registration block; event ID 204.
• BitLocker and TPM: other known issues: NTE_BAD_KEYSET and the sysprep image guidance.
• Errors associated with Web Account Manager (WAM): 80090016 as a device TPM issue.
• Understanding Primary Refresh Token (PRT): TPM-bound device keys, PRT issuance and TPM-failure recovery by join type.
• Troubleshoot devices by using the dsregcmd command: TpmProtected, KeyProvider, DeviceAuthStatus, AadRecoveryEnabled and KeySignTest.
• Connection issues when signing in after updating to Office 2016 build 16.0.7967: repeated prompts, AAD Operational log patterns, automatic recovery and manual recovery by join type.
• Microsoft Entra device management FAQ: dsregcmd.exe /debug /leave, dsregcmd /forcerecovery and work account re-registration.
• Troubleshoot the TPM: precautions before clearing the TPM.
• Microsoft 365 Apps activation error Trusted Platform Module malfunctioned (archived): Credential Manager and TokenBroker cleanup, and the older Clear TPM step.
• Dell: Microsoft Office Outlook Exchange error 80090016 after a system board replacement: prompt text, board replacement cause, tpm.msc check, Office reinstall note.