“Your Organization Has Disabled This Device” (Error Code 135011)

Error 135011 occurs during Microsoft 365 sign-in when Microsoft Entra ID (formerly Azure AD) flags your computer or mobile device as disabled in the tenant directory. When this happens, modern authentication blocks your Primary Refresh Token (PRT), revoking access to Outlook, Teams, OneDrive, and desktop Office applications. This lockout usually stems from automated stale device cleanup policies or an administrator manually toggling the device state off in the management portal. Resolving it requires an administrator to re-enable the device state or unlinking and re-registering the account locally.

Fast-Fix: The 45-Second Solution

Error 135011 is a moderate-risk issue triggered when Microsoft Entra ID disables or retires a device. An IT administrator must re-enable it via Devices → All devices in the admin center. If the device was deleted, disconnect the work account under Settings → Accounts → Access work or school, then re-register it.

Diagnostic Snapshot

• Severity Tier: Moderate (Blocks M365 desktop sign-ins and cloud sync; web apps may remain accessible temporarily)
• Data Safety Risk: Zero (Local files and cloud mailboxes remain intact, but desktop access is locked)
• Common Cause: Automated stale device cleanup rules, manual admin disabling, or an orphaned Workplace Join registration
• Admin Requirement: Microsoft Entra ID Admin (Cloud Device Administrator or Global Admin) required to re-enable disabled devices in the cloud portal

Condition: Low Risk vs. High Risk

• Low Risk: The device is set to “Disabled” in Entra ID but still exists in the tenant directory. An administrator can flip the toggle back to “Enabled” in under two minutes without reinstalling software or clearing local user profiles.
• High Risk: The device object was permanently “Deleted” rather than disabled during an automated cleanup run. Re-enabling is impossible in the portal; the local Workplace Join trust relationship must be forcibly cleared using command-line tools and re-registered from scratch.

The System Break (What This Means)

When you join a PC to an organization or sign into Office apps, Microsoft Entra ID issues a device registration record and a Primary Refresh Token (PRT). Think of this like an electronic keycard badge given to your specific laptop at the security gate. Every time an Office application opens, it presents both your user login keycard and your laptop’s device badge to Microsoft’s authentication servers.

If an automated policy or security administrator disables that device badge in the central cloud directory, the authentication server turns your device away at the gate. Even if your user password and multi-factor authentication (MFA) are 100% correct, the server rejects the PRT because the physical machine carrying the token is flagged as untrusted. The system throws Error 135011 and locks down local app synchronization.

Root Cause Probability

• Likely (60%): Stale Device Cleanup rule in Microsoft Entra ID automatically disabled the device after 30 to 90 days of inactivity or non-sync.
• Possible (30%): An IT administrator manually disabled or retired the device during account offboarding, asset auditing, or an administrative mistake.
• Rare (10%): Corrupted local Workplace Join (WPJ) tokens or duplicate device records created when a PC was renamed or reimaged without clearing old Entra records.

Conflict Escalators

• Remote and Hybrid Work Patterns: Laptops left powered off in drawers or offline during extended leave hit automated Entra cleanup windows and get marked disabled automatically.
• Device Renaming or Domain Migration: Changing a Windows computer name while keeping an active work account creates a secondary device record, causing Entra ID to reject the old identity token.
• Multiple Tenant Accounts: Signing into apps from guest or partner organizations can trigger conflicting device registration requests on a single PC.

Progression: 1 Hour → 24 Hours → 1 Week

• 1 Hour: Desktop Office applications (Outlook, Teams, Word) display the “Your Organization Has Disabled This Device” banner and stop syncing new emails, chats, or files.
• 24 Hours: Token expiration spreads to background sync engines; OneDrive stops backing up documents, creating version mismatches between local and cloud files.
• 1 Week: Local credential caches become clogged with repeated failed authentication attempts, increasing the likelihood of secondary enrollment errors once the device is eventually re-enabled.

Common Misdiagnoses

• Expired Password or MFA Loop: Error 135011 is not an identity or password failure. Changing your Microsoft 365 user password will not fix a disabled device state.
• Licensing Errors: This is not an unassigned M365 license issue. See “Account Unlicensed” Error despite active M365 Subscription for license allocation problems.
• Conditional Access Blocks: While Conditional Access can block logins based on location or compliance flags, Error 135011 explicitly identifies a disabled directory object. See Troubleshooting “CA20001” Conditional Access Sign-in Errors.

Immediate Action Steps

Step 1: Attempt Web Client Access

Web-based M365 apps bypass local device registration checks in some tenant configurations.

1. Open an InPrivate or Incognito browser window.
2. Go to portal.office.com and sign in with your enterprise credentials.
3. Access Outlook Web or Teams Web to continue working while IT processes the device re-enablement.

Step 2: Disconnect and Re-connect Work or School Account

If the device record was deleted in the cloud or corrupted locally, unlinking the account clears stale identity tokens.

1. Go to Windows Settings > Accounts > Access work or school.
2. Select your organizational account and click Disconnect.
3. Confirm the disconnection and restart your PC.
4. Return to Access work or school, click Connect, and re-enter your business credentials to register a clean device record.

Step 3: Clear Local Office Credential Caches

If the error persists after re-enabling:

1. Close all Office apps and Teams.
2. Open Credential Manager in Windows Control Panel.
3. Under Windows Credentials, remove all cached entries starting with MicrosoftOffice16_Data or ADAL.
4. For detailed steps, see How to Clear Office Credential Cache on Windows 11 (The Modern Way).

Hard-Stop Red Flags

Escalate immediately to your Enterprise IT Administrator under these conditions:

• The Entra ID Admin portal shows the device state as Deleted rather than Disabled.
• Multiple users across the same department receive Error 135011 simultaneously, signaling a broken tenant-level cleanup script.
• Re-connecting the account fails with Workplace Join registration errors. See Resolving Workplace Join (WPJ) Errors during Account Addition.

What the IT Admin Will Check

To resolve Error 135011 in the tenant directory:

1. Re-Enable Device in Entra Admin Center

1. Navigate to entra.microsoft.com > Identity > Devices > All devices.
2. Locate the affected device using the computer name or ObjectID provided in the error details.
3. Check the Enabled column. If set to No, select the device and click Enable at the top bar.
4. Allow 5 to 10 minutes for directory synchronization.

2. Handle Deleted Device Objects (dsregcmd)

If the device was permanently deleted from Entra ID, running dsregcmd /status on the user’s PC will show AzureAdJoined : YES, but the cloud directory has no matching record.

1. Open Command Prompt as Administrator on the user’s PC.
2. Run the command: dsregcmd /leave
3. Re-join the device via Settings > Accounts > Access work or school.

3. Reset Activation State

If tokens remain stuck after enabling, clear lingering activation entries using automated removal utilities. See How to Reset the Microsoft 365 Activation State (Using SaRA Tool).

Resolution Complexity

• Complexity: Moderate (Requires admin portal access or local account re-registration)
• Time to Resolve: 5 minutes if re-enabling via portal; 15 minutes if unjoining and re-registering locally
• User Action: Contact IT to flip the Entra ID device status, or disconnect and re-add the work account under Windows Settings.

Related Error Escalators

If you encounter lingering sign-in issues after re-enabling your device:

• Resolving “Something Went Wrong” Error 1001 in Outlook and Teams
• How to Clear Office Credential Cache on Windows 11 (The Modern Way)
• Resolving Workplace Join (WPJ) Errors during Account Addition

Ticket Closed

Error Code 135011 is a directory-level security lockout, not a local file or application bug. In the vast majority of cases, having an administrator enable the device in the Microsoft Entra admin center restores full M365 connectivity within minutes. If the device was permanently purged by an administrative cleanup rule, unjoining the work account locally with dsregcmd /leave and re-registering it establishes a brand-new trusted device token.