The Reinstall That Remembered: Clearing Microsoft's Auth Cache from the macOS Keychain

Some software forgets you the moment you drag it to the Trash. Microsoft's does not.

I learned that the slow way. I had a Mac that needed a genuinely clean slate — the Microsoft 365 apps signed out, forgotten, gone, so the next sign-in would begin from nothing. The obvious move is to uninstall everything and reinstall, so that's what I did: dragged the apps out, swept the leftovers from ~/Library, pulled down fresh installers, started over.

And the old account was still there. Not the apps — those were new. The identity. The first time I opened Word it didn't ask who I was; it already knew, and it knew wrong — the stale account I'd just spent an afternoon trying to erase, greeting me by name out of a clean install. So I uninstalled again. Reinstalled again. Restarted, eventually, the way you do once you've stopped thinking. The ghost came back every time.

What I'd missed is that the part of Microsoft you actually have to delete isn't in the Applications folder, and it isn't in ~/Library either. It's in the Keychain. Microsoft's sign-in libraries cache your account — the tokens, the identity, the tenant it answers to — as Keychain items, and the Keychain is the one thing a reinstall is designed not to touch. That's its whole purpose: it outlives the apps. So you can reinstall Office until the disk gives out, and it will keep finding the same cached account waiting for it, every single time.

The three entries that actually matter

First, quit every Microsoft app — Word, Outlook, Teams, OneDrive, the lot. One that's still running holds these tokens open and writes them straight back out from under you as you delete them, so the deletions won't stick.

Then open Keychain Access (it's in /Applications/Utilities, or just reach for Spotlight). Select the login keychain on the left — your per-user one, not System — and turn on View → Show Invisible Items, because some of these don't show up otherwise. Now type each of these into the search box in turn and delete every match (right-click → Delete):

• OneAuthAccount — OneAuth is Microsoft's modern, shared sign-in broker, the thing every Office app now reads your account from. This is the big one: the cached account itself.
• login.windows.net — the Azure AD / Entra ID token entries for a work or school account. The refresh tokens that let a "fresh" install quietly skip the login screen live behind this name.
• authority_map — the cached map of which authority, which tenant, your account answers to. A stale one keeps pointing the reinstall back at the old place.

Relaunch an app, and this time the sign-in screen is blank. It has nothing left to remember.

None of this is destructive. They're caches: delete them and the next clean sign-in writes fresh ones in their place. The one thing to know is that they're shared — clearing them signs you out of every Microsoft account across all of Office, Teams and OneDrive at once, not just the one you're chasing. For a real fresh start, that's exactly what you want.

If you'd rather not click

The same three from the terminal:

for item in OneAuthAccount login.windows.net authority_map; do
  while security delete-generic-password  -s "$item" >/dev/null 2>&1 \
     || security delete-internet-password -s "$item" >/dev/null 2>&1; do
    echo "deleted $item"
  done
done

security removes one matching item per call — and these turn up as generic and internet passwords — so each inner loop keeps deleting until both kinds come back empty. Quit the Microsoft apps first here too.

The fuller sweep

Those three are what fixed it for me, and they're where I'd start. If a stubborn install still knows you afterwards, there's a wider family of Microsoft cache items sitting in that same login keychain. The quickest way is to search Microsoft, Office, and ADAL and clear whatever turns up, but by name the usual suspects are:

• com.microsoft.oneauth and com.microsoft.identity.universalstorage — the OneAuth / MSAL token stores
• com.microsoft.adalcache — the older ADAL token cache
• Microsoft Office Identities Cache 3 and Microsoft Office Identities Settings 3
• MicrosoftOfficeRMSCredential — the Rights Management credential
• anything beginning with MSOpenTech.ADAL

Same rule throughout: they're caches, deleting them only forces a clean re-auth, and the apps should be closed while you do it. (One exception worth knowing — if the Mac is managed by an employer through MDM, a single-sign-on extension can quietly re-register the account on its own, and the keychain alone won't be enough.)

A clean slate you have to make yourself

What got me wasn't that the fix was hard — it's two minutes, once you know where to look. It's that reinstalling felt like it ought to be enough, and the entire design of the Keychain is to make sure it isn't. The thing I was trying to make the machine forget was being kept safe for me, deliberately, in the one place I'd never have thought to look. The install was never going to be fresh until I went and forgot it myself.