iCloud for Windows sign-in fails with authentication errors due to VPN

Posting this because I couldn't find this solution anywhere, and the older threads about it are closed without answers.

Setup: iCloud for Windows 15.10.39.0 (Microsoft Store), Windows 11 26H2 (build 26300.9711), iPhone on the same account.

Symptoms: the password is accepted, but sign-in or "Verify your Apple Account" (needed for Passwords and Keychain) always fails with one of these:

• "iCloud for Windows has not fully initialized. Please wait a moment and sign in again."
• "Authentication failed. Retry will be attempted."
• "There was an error connecting to the Apple Account server."

No approval prompt or verification code ever arrives on the iPhone.

In the iCloud logs (%LOCALAPPDATA%\Packages\AppleInc.iCloud_nzyj5cx40ttqa\LocalCache\Local\Logs\iCloudHome.*.log):

• AKValidateAppleIDCredentials returned -9106 (sometimes -7005)
• piggybackErrorCode=-9106, statName "approveDevice"
• Failed to obtain public APS push token / Device registration failed

Cause in my case: Tailscale. I wasn't using an exit node; just having Tailscale "Connected" (with MagicDNS) was enough to break the device-approval step. My iPhone is on the same tailnet, which may be relevant.

Fix: click the Tailscale tray icon and disconnect, then click Verify in iCloud, approve on the iPhone, and reconnect Tailscale afterwards. Everything keeps working with Tailscale back on.

If you use any other VPN (corporate, WireGuard, etc.), try turning it off just for the sign-in.

Things that did NOT help, so you can skip them: rolling back the Windows feature update, resetting and reinstalling iCloud, wiping Apple registry entries and app data, removing third-party smart-card software, and removing the PC from the Apple Account.

Two other things that also caused trouble along the way:

• An outbound-blocking firewall (Windows Firewall Control in my case) silently blocks the iCloud executables. Allow the programs under C:\Program Files\WindowsApps\AppleInc.iCloud_*\iCloud\ plus msedgewebview2.exe (used by the verification window).
• Advanced Data Protection adds an extra device-approval step, which is exactly the step that was failing. Turning it off changed the error but didn't fix it; disconnecting Tailscale did.

Hope this saves someone a few days.