Office 0xCAA70007: Microsoft 365 Apps cannot reach the activation service

Fix it now

Microsoft publishes 0xCAA70007 and 0xCAA80000 together, as the “We are unable to connect right now” failure when activating Microsoft 365 Apps. It is a connectivity problem, not an entitlement one: check that Windows and Office are current, that the proxy and firewall allow the required endpoints, and that the network connectivity probe has not been switched off.

netsh winhttp show proxy
reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration /v SharedComputerLicensing

1. Update Windows and Office fully and restart. Microsoft lists an outdated Windows or Microsoft 365 build among the things to fix for this code.
2. If the machine goes through a proxy, set the machine-level one rather than relying on the browser’s: netsh winhttp set proxy <address of proxy server>.
3. Have the firewall checked against Microsoft’s published endpoint list, so the sign-in, licensing and configuration URLs are permitted from this subnet.
4. Confirm the network connectivity probe has not been disabled: EnableActiveProbing should be 1 under HKLM\SYSTEM\CurrentControlSet\Services\NlaSvc\Parameters\Internet, and NoActiveProbe should be 0 under HKLM\Software\Policies\Microsoft\Windows\NetworkConnectivityStatusIndicator. Both are DWORD values.
5. If the network configuration is in an unknown state, Microsoft also documents netsh int ip reset, netsh winsock reset and sfc /scannow, followed by a reboot. Those clear any custom Winsock and IP configuration on the machine, so check what depends on it before running them on a server.
6. If the on-screen message says your products cannot be used to activate Office in shared computer scenarios, stop – that is a licence problem, not this one, and the reference section explains it.

On Windows 7 SP1, Windows Server 2008 R2 and Windows Server 2012, TLS 1.2 must be enabled for this to work at all. Microsoft also states that running Microsoft 365 Apps on those operating systems is not supported.

If Office activates you can stop here. If it does not, the next section separates the connection failure from the shared computer entitlement check people confuse it with.

Why it happens

The first thing to fix about this error is what people believe it means. Microsoft publishes a dedicated page for 0xCAA70007 and 0xCAA80000, and it describes them as the error “We are unable to connect right now” during Microsoft 365 Apps activation. The things it tells you to fix are all connectivity: TLS 1.2 on older operating systems, an outdated Windows or Office build, proxy configuration, firewall rules for the required URLs, general network problems, and the network connectivity probe being disabled. There is nothing in it about plans, seats or entitlements.

The reason the entitlement reading took hold is that shared computer activation does have a documented licensing refusal – it just is not this code. On a session host, a user whose plan does not carry shared computer activation gets the message “The products we found in your account cannot be used to activate Office in shared computer scenarios”, and Microsoft’s documented remedy is to be assigned a licence for Microsoft 365 Apps for enterprise. That is a real, separate condition with a real, separate fix, and both are covered below.

The third code in this set is the one that does come from the licensing service. 0xC004F016 is published as the Software Licensing Service determining that the request is not supported. It is a general refusal rather than a shared-activation-specific one, and it belongs to the local licensing service rather than to the identity layer that produces the 0xCAA codes – which is why seeing a 0xCAA code and a 0xC004F code together is normal rather than evidence of two separate faults.

Full reference

Which plans carry shared computer activation

That table is the correction most worth carrying away, because the widely repeated claim that only enterprise-class plans can do this is wrong: Business Premium carries the right. Check the current service description for your exact plan before you buy anything, and check what your existing suite already contains – organisations quite often own the entitlement without knowing it.

The registry values this article touches

Office reads SharedComputerLicensing at start-up rather than continuously. After setting it, close every Office application and have users sign out and back in before deciding whether it worked. The supported way to set it is with the Office Deployment Tool at deployment time; the registry value is the way to correct a host that is already built.

The documented shared computer messages, and what each one means

Where the token lives and how long it lasts

Shared computer activation does not license the machine. It fetches a token for the signed-in user and stores it in that user’s profile at %localappdata%\Microsoft\Office\16.0\Licensing. Microsoft states that token is valid for 30 days and that Microsoft 365 Apps attempts to renew it automatically as the expiry approaches, while the user is logged on and using the applications. That design is why connectivity matters more here than on an ordinary desktop: a host that cannot reach the licensing service does not fail immediately, it fails a month later, all at once, for everybody.

Checks worth making on a session host before you blame the plan

• Confirm the value is set and Office has been restarted since. A host that was never put into shared mode behaves quite differently from one that cannot connect.
• Confirm a token file actually appears under the licensing folder for a user who signs in successfully. If it never appears for anyone, look at connectivity and the profile, not at entitlement.
• Confirm the profile container is not excluding or discarding the licensing folder between sessions.
• Test with two users on different plans on the same host. That single comparison settles plan-versus-host faster than anything else.
• Check the host’s clock. Token validation is time-sensitive and a badly wrong clock produces failures that look like everything else.

Every code this article covers

Confirm the fix worked

1. Open Word on the affected machine and confirm File, then Account shows the subscription with no activation prompt.
2. netsh winhttp show proxy shows the machine-level configuration you intended.
3. On a shared host, reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration /v SharedComputerLicensing returns 1.
4. A token file exists under %localappdata%\Microsoft\Office\16.0\Licensing for the affected user.
5. Sign out and back in, then open Excel, so you know the token survives a new session rather than one launch.

Questions people ask about this