OneDrive 0x8004de40 and 0x8004de88: the sync app cannot reach the cloud

Fix it now

Microsoft documents 0x8004de40 and 0x8004de88 as OneDrive having trouble connecting to the cloud, with the message that login was either interrupted or unsuccessful. The published causes are no internet connectivity, TLS deprecation, an incorrect cipher suite configuration, and missing or disabled TLS protocols.

Enable-TlsCipherSuite -Name "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384" -Position 0
Enable-TlsCipherSuite -Name "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256" -Position 1
Enable-TlsCipherSuite -Name "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384" -Position 2
Enable-TlsCipherSuite -Name "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256" -Position 3

1. Check the machine has working internet access at all before anything else. It is the first cause Microsoft lists and it is skipped more often than it should be.
2. Those four suites are the TLS 1.2 cipher suites Azure Front Door requires, and they must be prioritised at the top of the machine’s list. That ordering is the documented fix, not merely enabling them.
3. Confirm the TLS protocols are enabled: press Windows and R, run inetcpl.cpl, open the Advanced tab and check the TLS boxes, then apply.
4. If the machine is Entra joined and still failing, rejoin it: dsregcmd /leave then dsregcmd /join, and restart the device.
5. As a last step, reset the sync app: %localappdata%\Microsoft\OneDrive\onedrive.exe /reset, falling back to C:\Program Files\Microsoft OneDrive\onedrive.exe /reset and then the Program Files (x86) path.

Two codes in this family are not connection problems at all. 0x8004ded7 means the sync app is out of date, and 0x8004dedc means the account is being used in a different region. Both are covered below and neither is fixed by anything above.

If the client signs in and syncs, stop here. If you have one of the other codes in this family, the next section says which fix belongs to which, because they do not share one.

Why it happens

The sync app makes its own HTTPS connections, separate from your browser, using the Windows secure channel stack and the system proxy configuration. That is why this error confuses people: a browser can be perfectly happy while the client fails, because the two do not share TLS settings, proxy resolution or certificate trust behaviour. Microsoft’s own article on 0x8004de40 lists TLS deprecation and cipher suite configuration ahead of anything to do with the client itself.

The cipher suite detail is the part that gets missed. Four TLS 1.2 suites are required and must be at the top of the machine’s priority list: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 and TLS_DHE_RSA_WITH_AES_128_GCM_SHA256. A machine covered by a hardening baseline that trimmed or reordered the list will fail here while a machine next to it works, and nothing in the error hints at ordering.

The rest of this family are separate problems that happen to arrive as similar-looking hex. Two are documented as a proxy pair: 0x8004de44 and 0x8004de42 mean your proxy settings require authentication, and Microsoft states that authenticated proxies are not supported by the OneDrive sync app. That is a hard limitation, not a preference. One is a client version problem, and one is a geography problem. Reading which code you actually have is worth more than any amount of Schannel work.

Full reference

Which code is which

Read the pattern before you change anything

Down-level Windows

On Windows 7 and 8 and on Windows Server 2008 R2 and 2012, TLS 1.1 and 1.2 are not enabled by default and Microsoft’s article points at the Easy Fix tool to enable them, with KB 3140245 for Windows 8. It also notes that disabling the DHE cipher suites can help where those platforms still fail after the protocols are enabled. On current Windows 10 and 11 builds the protocols are on by default, so if you find them disabled, something disabled them and will do so again at the next policy refresh.

What the network team needs to hear

• Microsoft recommends bypassing Microsoft 365 domains from TLS decryption, interception, deep packet inspection and content filtering.
• Selective allow-listing is explicitly unsupported: apply the guidance to the full published set of required endpoints, not to the handful you found in a capture.
• Traffic intermediation devices such as proxies and VPN services should be bypassed for that traffic, with browsers configured to send Microsoft 365 requests directly to egress.
• Authenticated proxies are not supported by the OneDrive sync app at all, so ‘we will just add credentials’ is not an option.
• That traffic is already encrypted and authenticated end to end, which is the argument to make rather than asking the security team to trust you.

When the client genuinely is the problem

The instinct to reinstall OneDrive is usually wrong for 0x8004de40, because the client is stopped at the network layer and a fresh copy will be stopped in the same place. It is right for 0x8004ded7, where the documented cause is an old version. It is worth one attempt for 0x8004de44 after the proxy has stopped authenticating, because Microsoft’s own resolution for that code is to reset the Windows Settings app and reinstall the app. Knowing which of those you have is the difference between a five-minute fix and an afternoon in the registry.

Every code this article covers

Confirm the fix worked

1. Get-TlsCipherSuite lists the four required suites, and they are at the top of the order.
2. The OneDrive icon returns to a normal synced state and a file uploads and downloads end to end.
3. The certificate served for a Microsoft 365 host is issued by a public authority, proving inspection is bypassed.
4. The machine keeps syncing after a reboot without anyone signing in again.
5. If the code was 0x8004ded7, the installed OneDrive version number has actually changed.

Questions people ask about this