New outlook keeps saying access denied

New Outlook access denied usually means the app is blocked by policy, the account lacks a required license or mailbox entitlement, or the client is misconfigured. Check policy first. If you skip that step, users lose mail access and admins can waste hours on the wrong layer. This guide shows how to separate blocked, mislicensed, and misconfigured cases, then what each group should check.

Diagnose whether the block comes from a policy or setting

This message usually points to a policy block, a licensing problem on a work or school mailbox, or a mailbox setting that blocks Outlook for Windows. Start by checking whether the signed-in account is personal or work/school, because the fix path changes.

What the message usually points

Outlook for Windows was formerly known as the new Outlook for Windows. Admins can control access to work or school mailboxes in Outlook for Windows, and that access can be turned on or off for individual mailboxes or by policy. Personal Outlook.com accounts usually need a different check path.

Say your user signs into a Microsoft 365 work account and sees access denied right after adding the mailbox. That usually points to a mailbox or policy control, not a broken sign-in screen. Suppose a personal account opens normally but the work mailbox fails; inspect the work mailbox first.

What personal accounts should check first

If the account is personal, confirm the user is signed in with the correct Microsoft account and not a work or school identity. If the problem appears only after switching profiles or after a Windows update, check whether classic Outlook still shows the toggle that launches the new app.

1. Open Outlook for Windows and confirm the profile name in the top-right corner.
2. Check whether the account is a personal Outlook.com account or a work or school account.
3. In classic Outlook, look for the Try the new Outlook toggle.
4. If the toggle is missing, check the registry keys that hide or show it.

📊 The article says the estimated time to complete the procedure is 5 minutes. Source: Microsoft.

Likely causes

The most common causes are policy control, a missing or wrong license, and a mailbox setting that blocks access. Less commonly, the app appears blocked because only some users are in scope, or because a rollout left one client state different from another.

Work or school mailbox access denied?

If the mailbox is for work or school, confirm the signed-in account type, then check licensing before changing any mailbox setting. A correct Microsoft 365 or Office 365 license is required to use Outlook with a work or school mailbox, and an admin policy can still block access afterward.

Check the signed-in account type

1. In New Outlook, open Settings and inspect the account list.
2. Confirm whether the mailbox is tied to a work or school account.
3. If the account is personal, stop treating it like a Microsoft 365 mailbox issue.
4. If the account is work or school, move to license and policy checks.

Confirm the mailbox license assignment

1. In the Microsoft 365 admin center, open the user record for the mailbox owner.
2. Check the assigned Microsoft 365 or Office 365 plan.
3. Confirm the license is active and assigned to the correct user ID.
4. Sign out and sign back in only after the assignment is correct.

Picture a user whose mailbox is licensed for email but the license is assigned to a different user ID. Outlook may still deny access because the entitlement does not match the mailbox owner. A licensed mailbox can still be blocked by policy, so do not stop at the license screen.

Check whether admin policy blocks Outlook for Windows

1. Ask an Exchange admin to open Exchange Online PowerShell.
2. Check whether the mailbox or mailbox group has a policy that disables Outlook for Windows.
3. Review Set-CASMailbox for the individual mailbox.
4. Review Set-OwaMailboxPolicy if the block affects a broader group.

Policy blocked Outlook for Windows?

Use Exchange Online PowerShell when the issue looks like a policy block. Admins need the correct permissions before changing access, and the mailbox can be controlled at the single-user level or by a broader policy that applies to current and future work or school mailboxes.

Use Exchange Online PowerShell

1. Connect to Exchange Online PowerShell with an admin account that has the required permissions.
2. Run the mailbox check for the user or policy scope.
3. Confirm whether the block is coming from the mailbox itself or from a mailbox policy.
4. Only then change access.

Check Set-CASMailbox for a single mailbox

Set-CASMailbox controls existing work or school mailboxes individually. It uses the OneWinNativeOutlookEnabled parameter, which defaults to blank ($null). Blank is equivalent to $true, meaning users are not restricted. Admins can set it to $false to disable access or $true to enable access. (Microsoft Learn)

1. Run the mailbox query in Exchange Online PowerShell.
2. Check the current OneWinNativeOutlookEnabled value.
3. If needed, set it to $true or $false with Set-CASMailbox.
4. Use the mailbox identity that matches the user record.

Check Set-OwaMailboxPolicy for broader control

Set-OwaMailboxPolicy applies a broad, policy-based approach. It affects existing and future work or school mailboxes, so a change here can explain why several users see the same error at once. That makes it the first place to look when the issue is wider than one mailbox.

1. Open the mailbox policy assigned to the affected users.
2. Verify whether Outlook for Windows is allowed in that policy.
3. Compare the policy to a mailbox that still works.
4. Update the policy only after confirming the scope.

Access denied decision table

Use this table to decide whether you are looking at a user-level block, a licensing issue, or a policy change. The next check should match the symptom wording as closely as possible.

Still not working?

If the mailbox, license, and policy all look correct, verify the mailbox identity and the admin permissions before changing anything else. The mailbox identity can be Name, Alias, Email address, or User ID, and a wrong match can make the change miss the intended mailbox.

Verify mailbox identity fields before changing a setting

1. Gather the mailbox Name, Alias, Email address, and User ID.
2. Match those fields against the Exchange Online record.
3. Check whether the mailbox is in a filtered group such as Title or Department.
4. Confirm whether CustomAttribute1 through CustomAttribute15 are being used for filtering.

Check Exchange Online permissions before running commands

1. Confirm the admin account has Exchange Online permissions for mailbox changes.
2. Verify that the account can run Set-CASMailbox and Set-OwaMailboxPolicy.
3. If permissions are missing, assign the correct role before making changes.
4. Re-run the check after permissions are confirmed.

For a mixed client state, one useful check is to compare a mailbox that works in classic Outlook with the same mailbox in New Outlook. If the classic client opens normally but the new client fails, the registry keys that hide or show the Try the new Outlook toggle may also be part of the rollout state. That is a clue, not a fix.

If that did not work, escalate

1. Collect the exact error text from New Outlook.
2. Record whether the mailbox is personal, work, or school.
3. Note the license assigned, the policy name, and any Set-CASMailbox changes.
4. Escalate to IT or Microsoft support with those details.

Frequently asked questions

Why does Microsoft Outlook keep saying access denied?

It usually means a work or school mailbox is blocked by policy, missing the right Microsoft 365 or Office 365 license, or restricted by a mailbox setting. The fastest check is whether the mailbox is tied to a work account and whether an admin has set OneWinNativeOutlookEnabled to $false.

How do I fix access denied in New Outlook?

Start with the account type, then check the license, then check admin policy. If the mailbox is work or school, the admin should review Set-CASMailbox and Set-OwaMailboxPolicy in Exchange Online PowerShell before changing anything else. Users cannot bypass a tenant-wide block locally.

Is my organization blocking Outlook for Windows?

It may be. If the same user can open mail in another client but New Outlook says access denied, ask an Exchange admin to check whether Outlook for Windows is disabled in a mailbox policy or on the mailbox itself. The clearest indicator is a tenant-wide pattern.

Does access denied mean my mailbox is disabled?

Not necessarily. A mailbox can be active and still blocked from Outlook for Windows by license or policy. Check whether the mailbox has the correct Microsoft 365 or Office 365 license, then verify the mailbox’s OneWinNativeOutlookEnabled setting and any assigned policy.

How do I know whether this is a licensing issue or a policy block?

If only one user is affected, licensing is a strong first check. If many users are affected at once, policy is more likely. Confirm the license assigned to the exact user ID first, then have an admin review Set-CASMailbox and Set-OwaMailboxPolicy in Exchange Online PowerShell.

Can a work or school mailbox be blocked in New Outlook only?

Yes. Outlook for Windows can be allowed in one client and blocked in another by mailbox or policy settings. A work or school mailbox may still open in classic Outlook while New Outlook is denied. That is why admins need to check the mailbox setting and the broader policy scope.