AADSTS5000611 SYMMETRIC KEY DERIVATION FUNCTIONVERSION "1"IS INVALID

Hi Butler, Nancy

Thank you for reaching out via the Q&A forum regarding your Outlook sign-in issue. I understand how inconvenient it is when you can access your emails through the web but experience trouble with the app itself. I’d be happy to assist.

About the Error
The message you're encountering “AADSTS5000611: Symmetric Key Derivation Function version ‘1’ is invalid” is related to a recent change by Microsoft. They’ve deprecated support for an older authentication method used by some devices that haven’t received certain Windows security updates. This update is part of their security improvements based on CVE‑2021‑33781. You can read more here: Security update to remove KDFv1 algorithm support in Microsoft Entra authentication

To help resolve the issue, could you please provide the following details?

• What device are you using (PC, Mac, mobile)?
• The exact OS version/build (on Windows: Settings > System > About)
• Is this device school-issued and managed through Intune/MDM, or is it your personal computer? Also, is it running as a Virtual Machine (VM)?
• Are other users in your organization seeing the same error message?

In the meantime, I suggest trying the following workaround to regain access temporarily:

1> Install the latest Windows updates/security patches.

2> Disconnect and reconnect your school account.

Go to Settings > Accounts > Access work or school > Disconnect your school account, restart, then sign in again.

3> Update Outlook and related Microsoft apps.

• If you're using the "New Outlook" from the Microsoft Store, check for updates in Microsoft Store > Library.
• If you're using classic Outlook, go to Outlook > File > Office Account > Update Options > Update Now.

4> Perform a clean token reset (if the issue persists). Sign out of all Office apps (Outlook, Teams, Word), close them, restart the device, then sign back in.

Even if you're not using a Windows device, the error most often stems from a Windows update gap, so it's worth checking whether any Windows-based device linked to the account has missed recent updates.

Additionally, your IT admin may want to verify Microsoft Entra (Azure AD) device registration and authentication logs following the updates to ensure everything is compliant.

Looking forward to your reply so we can dig deeper and help restore full Outlook access for you.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.