| Previous | Next |
| ONL_CONNECTION_COUNT_LIMIT | ONL_E_USER_AUTHENTICATION_REQUIRED |
ONL_E_CONNECTED_ACCOUNT_CAN_NOT_SIGNOUT
Within Windows Online ID and interactive account authentication ONL_E_CONNECTED_ACCOUNT_CAN_NOT_SIGNOUT (0x8086000E) reports that the application cannot sign out an account that is connected to Windows in the current configuration. Treat it as the Online ID connected account can not sign-out condition and start with CanSignOut value, connected-account state and sign-out caller, not with the final dialog text.
Why this HRESULT is specific
The broker can return this HRESULT before a service ticket is issued. Keep the asynchronous operation, requested scopes or tickets, application identity, UI context and account remediation result together; a wrapper message such as “sign-in failed” discards the distinction.
The decisive question is whether the recorded evidence supports the reported condition that the application cannot sign out an account that is connected to Windows in the current configuration. Keep evidence tied to the failing operation.
Evidence that can change the diagnosis
- Primary record: CanSignOut value, connected-account state and sign-out caller.
- Object correlation: keep the product, account, package, device, key, or API identity associated with CanSignOut value, connected-account state and sign-out caller beside the first timestamped result.
- Neighboring-state control: use a controlled comparison that tests whether application sign-out differs from removing or disconnecting the windows account; this separates the named condition from a nearby status.
- Before/after result: retain the outcome before and after the corrective action “honor cansignout and use the supported windows account-management path”; keep the same identifiers until the broker returns a fresh result.
How to distinguish nearby failures
Do not merge neighboring statuses: Application sign-out differs from removing or disconnecting the windows account. The Online ID connected account can not sign-out diagnosis remains attributable only while the primary record and the affected identity stay fixed.
Controlled troubleshooting sequence
- Locate the exact object: Use the primary record to identify the transaction or licensed object that actually returned this result.
- Preserve the first decision: Record the earliest event stating that the application cannot sign out an account that is connected to Windows in the current configuration, together with the code, UTC time, and the same identity fields.
- Change one prerequisite: Honor cansignout and use the supported windows account-management path; do not combine this with a store reset, key replacement, account removal, package reinstall, or unrelated repair.
- Repeat the user operation: Re-run the original operation and require that the broker returns a fresh result; if another HRESULT appears, diagnose it as a new boundary.
Evidence-preserving cautions
While investigating this result, do not collect passwords or tokens in diagnostic logs, and do not bypass broker UI with embedded credential forms. That shortcut can replace or invalidate that evidence before the original decision is understood.
Verification
The incident is resolved only when the broker returns a fresh result. Confirm the result by repeating the exact operation that produced this result; maintenance success alone is insufficient.
Technical references
- Microsoft Win32 metadata: winerror.h — status definition reference.
- Microsoft: Errors associated with Web Account Manager — owning service/API reference.
- Microsoft: OnlineIdAuthenticator.CanSignOut — diagnostic/remediation API reference.
- Microsoft: OnlineIdAuthenticator class — lifecycle reference.
Looking for a different code? Search another status or error code.