OneDrive Error 0x8004de40: Can't Sign In, How to Fix

OneDrive error 0x8004de40 — "There was a problem connecting to OneDrive" means the OneDrive client cannot reach Microsoft's servers, even when the rest of your internet works. This guide follows the order Microsoft documents, which puts TLS configuration ahead of the reinstall most people try first.

The Error

You will see one of these, depending on where sign-in fails:

OneDrive
Can't sign in. Error 0x8004de40

Login was either interrupted or unsuccessful. Please try logging in
again. (Error Code: 0x8004de40)

We can't sign into your account, please try again later 0x8004de88

Microsoft's stated cause is short: error code 0x8004de40 or 0x8004de88 indicates OneDrive is having trouble connecting to the cloud.

Your files are safe. This is a connection failure. Anything already synced remains on disk, and local changes upload once the connection returns. Do not move files out of the OneDrive folder while troubleshooting — that is how this error turns into actual data loss.

Why This Happens

OneDrive needs more than an internet connection. It needs a successful TLS handshake with Microsoft's front end, and that requires both a supported TLS version and a cipher suite both ends accept. A machine can browse the web flawlessly and still fail that specific negotiation.

The usual culprits, in rough order of frequency:

• TLS protocol versions disabled or unavailable on the client
• Cipher suite mismatch — TLS 1.2 is enabled but the suites Azure Front Door accepts are not prioritized
• A VPN, proxy, or TLS-inspecting appliance breaking the handshake in the middle
• Stale Entra ID device registration on a work or school machine
• Genuine network loss, which is worth ruling out first precisely because it is trivial

Fix 1: Confirm You're Actually Online

Microsoft's first step, and worth thirty seconds. Open a browser and load a site you have not visited recently, to avoid a cached page fooling you.

Then disconnect any VPN and retry. VPNs and proxies are a frequent cause here, and disconnecting is both a fix and a diagnostic: if OneDrive signs in with the VPN off, you have found your answer and the conversation moves to whoever manages that VPN.

Fix 2: Enable the TLS Protocols

This resolves a large share of cases and takes a minute.

1. Press Win + R to open Run.
2. Type inetcpl.cpl and press Enter.
3. Go to the Advanced tab.
4. Scroll to the security section and tick the boxes for TLS 1.0, TLS 1.1, and TLS 1.2.
5. Select Apply, then OK.
6. Restart the computer and try OneDrive again.

Despite the name, these Internet Options settings are system-wide WinINET settings, not Internet Explorer ones, and OneDrive honours them.

Worth knowing: Microsoft has deprecated TLS 1.0 and 1.1 for Microsoft 365, so the setting that actually matters is TLS 1.2. If TLS 1.2 is unticked, that alone explains the error.

Fix 3: Check the Cipher Suites

If TLS 1.2 is enabled and you still get 0x8004de40, the handshake is failing on cipher suites. Microsoft 365 and Azure Front Door support slightly different sets, so having TLS 1.2 on is not sufficient by itself.

For TLS 1.2, Azure Front Door supports:

• TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
• TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
• TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
• TLS_DHE_RSA_WITH_AES_128_GCM_SHA256

These four must be present and at the top of the priority list. From an elevated PowerShell prompt:

# See the current order
Get-TlsCipherSuite | Select-Object -ExpandProperty Name

# Move a required suite to the highest priority
Enable-TlsCipherSuite -Name "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384" -Position 0

Repeat for each suite you need to promote, then re-run Get-TlsCipherSuite to confirm the order changed.

If the order does not change, a Group Policy setting is overriding it. Check SSL Cipher Suite Order under Computer Configuration → Administrative Templates → Network → SSL Configuration Settings. On a managed device this is an IT change, not a local one.

Fix 4: Rejoin the Device to Entra ID (Work and School Accounts)

For a work or school account whose device registration has gone stale.

First, simply restart the device while it is connected to your organization's network. That resolves many registration issues on its own.

If it does not, check the current state:

dsregcmd /status

Look at AzureAdJoined and DomainJoined in the output. Then, only while connected to your organization's network:

1. Open an elevated Command Prompt — Start, right-click Command Prompt, Run as administrator.
2. Run dsregcmd /leave
3. Run dsregcmd /join
4. Close the window, restart the computer, and sign in to OneDrive.

Do not run these while traveling or off the corporate network. Microsoft is explicit about this. If the rejoin cannot complete, you may lose access to every resource that requires a registered device, and recovering that is considerably more work than the error you started with.

Fix 5: Reset OneDrive

Reset disconnects and rebuilds the sync relationship without deleting your local files.

1. Press Win + R.

2. Paste this and press OK:

   %localappdata%\Microsoft\OneDrive\onedrive.exe /reset
   

   Copy

3. The OneDrive icon vanishes from the notification area and should reappear within a couple of minutes. If it does not, start OneDrive from the Start menu manually.

Files stay on disk. What happens next is a re-sync, which on a large library takes a while and generates heavy disk and network activity — expect that rather than assuming it failed again.

Verify the Fix

1. Check the OneDrive icon in the notification area — a plain cloud or a tick means connected; a red X or crossed-out cloud means still failing.
2. Open OneDrive settings → Account and confirm your account is listed and the folder path looks right.
3. Test a real sync: create a small text file in the OneDrive folder, wait, and confirm it appears at onedrive.com or in the Microsoft 365 web portal.
4. Watch for the sync-complete state rather than assuming — a client can sign in successfully and still be stuck on a separate sync error.

Prevent It Coming Back

• Keep Windows patched. TLS support and cipher suite defaults arrive through updates, and this error concentrates on machines that are behind.
• Do not disable TLS 1.2 in any hardening baseline. Hardening scripts that disable protocols wholesale are a recurring cause of this error on otherwise healthy machines.
• Exclude Microsoft 365 endpoints from TLS inspection. Inspecting them is a documented source of connection failures across several Microsoft clients, not just OneDrive.
• Keep the OneDrive client current — it updates itself unless something is blocking it.
• On managed fleets, check cipher suite Group Policy before deploying it widely. A restrictive suite order that omits the four suites above breaks OneDrive across every machine that receives it.

When to Escalate

Work out the scope before spending more time:

For a broad outage, check the Microsoft 365 service health dashboard in the admin center before troubleshooting individual PCs. For the sign-in side of a single account, an administrator can read the failure directly in the Entra ID sign-in logs — and if the block turns out to be policy rather than TLS, see AADSTS53003: access blocked by Conditional Access.

Related Articles

• Configuring Conditional Access Policies in Office 365
• How to Install and Connect to Exchange Online PowerShell