Removing the roles will reduce the cookie size and allow successful login to the affected sites. If an admin has the Global Administrator role, for example, they do not also need User Administrator role. The fix for this loop is to reduce the amount of Admin roles by eliminating the extra, redundant roles.

The cookie size is enough to support several Admin roles, but sometimes an Admin is configured to not only be Global Administrator, but also every other Administrator type that can be selected such as User Administrator, Password Administrator, Teams Administrator, and on and on.

In Microsoft 365, this maximum cookie size is set on the servers in stone, and cannot be modified by the end-user or tenant admin.

What is happening here, usually, is that the user is actually an Administrator on the tenant, and they have a lot of Admin roles, most of which are redundant.ĭuring the log-in process, a cookie is set which contains all of the permissions the user is entitled with, and in cases where there are several roles present via Security Groups or directly assigned Admin roles, this cookie is too large. This will occur quite a few times and spit the user out at a Sorry, something went wrong screen or Error 500 sad face screen. The behavior is observed is that a user will visit one of these sites, and their browser will loop between the destination (like or ) and. From time to time, we’ve received reports of users who cannot access Outlook on the web, Microsoft Forms, and some other specific sites within their Microsoft 365 tenants.

Skype login loop