Why Outlook keeps asking for the old password

The user types the right password. The box comes back. They type it again, more carefully. The box comes back. By the third time they are certain the account is broken, and they are not entirely wrong.

The prompt is not asking what it appears to be asking. It is not saying "this password is incorrect". It is saying "the thing I authenticated against rejected this", and the thing it authenticated against is usually not the thing the user thinks.

The three places the old identity lives

Windows Credential Manager. Stored credentials for the previous server, keyed to a host that may not exist. Outlook presents them, gets rejected, prompts. This is the one everybody clears, and clearing it does help.

The Office identity. Separate from the mail credential and often overlooked. Office holds a signed in identity for licensing and services, and if it is still the old tenant account, the modern authentication flow reaches for the wrong identity before the user gets to choose. The fix is signing that identity out, not clearing a password.

The Autodiscover cache. Not a credential at all, which is why it does not come up in a search for password problems. But if the client is resolving to the old server, then every credential it presents will be rejected by definition, and no amount of clearing the first two caches will change that.

Why the order matters

Clear the credentials alone and it works until the next lookup. Sign out the Office identity alone and the mail credential is still stale. Clear the Autodiscover cache alone and the client goes to the right place carrying the wrong credentials.

All three, in that order, and it holds. This is the sequence the first four steps of my repair toolkit run, and the ordering is not incidental.

The fourth thing, when it is not those three

If the sign in window never appears at all, the problem is not a cache. Modern authentication has been disabled by a policy key, usually one that was set years ago for a reason nobody wrote down. The client cannot show the Microsoft 365 sign in interface, so it falls back to basic authentication, which the tenant refuses.

This one is worth checking early, because it looks identical from the help desk and none of the cache clearing does anything at all.

What to tell the user

Not "your password is fine, it is a cache". That is true and useless.

What has worked for me: "Outlook is still trying to log into the old server. Your password is correct, it is being sent to the wrong place. I am going to point it at the new one." People accept that immediately, because it matches what they are seeing, and they stop retyping the password while you work.