/errors/entra-id/aadsts50020-user-account-from-identity-provider-does-not-exist
AADSTS50020: User account from identity provider does not exist in tenant
- tool
- Microsoft Entra ID
- versions
- Microsoft Entra ID
- os
- any
AADSTS50020: User account 'user@domain.com' from identity provider '...' does not exist in tenant '...' and cannot access the application '...' in that tenant. means a user signed in to a tenant that does not know them. Microsoft's reference names the error UserUnauthorized and says the account must first be added as an external user in that tenant. Invite the user as a guest (B2B), or, if the application is meant for users of any organization, make it multitenant and send users to the organizations or common endpoint instead of a tenant-specific one.
The full text names the account, the identity provider (for example live.com for personal Microsoft accounts, or another tenant's issuer URL), the resource tenant and the application. In the home tenant's sign-in logs the same failure appears with code 90072.
Find the cause from the message
| What the message shows | Likely cause | Fix |
|---|---|---|
| An external account that should be a guest | Not invited, or invitation not redeemed | Invite the user; have them accept the invitation |
| The right person, but a different account than the invited one | Existing browser session with another account | Sign out, sign in again in a private window |
| Users of many organizations fail on your app | Single-tenant registration or tenant-specific authority | Multitenant account type and organizations/common endpoint |
| A personal account (live.com) signing in to the Entra admin center | Personal accounts land in a tenant with no directory | Use a work account, or create an Azure account with its own tenant |
| Only some users fail on an enterprise app | Assignment required is Yes | Assign the users or their group |
Sign-in endpoints
| App accepts | Authority to use |
|---|---|
| Users of one tenant (and its guests) | https://login.microsoftonline.com/TENANT_ID |
| Work or school accounts of any organization | https://login.microsoftonline.com/organizations |
| Work or school accounts and personal Microsoft accounts | https://login.microsoftonline.com/common |
| Personal Microsoft accounts only | https://login.microsoftonline.com/consumers |
The endpoint must match the app's supported account types (signInAudience in the manifest: AzureADMyOrg, AzureADMultipleOrgs, AzureADandPersonalMicrosoftAccount, PersonalMicrosoftAccount). Microsoft's troubleshooting article notes that signInAudience cannot be changed in the manifest for this case; re-create the registration with the right account type.
Check a guest from PowerShell
From a Microsoft Graph PowerShell session in the resource tenant (Connect-MgGraph -Scopes "User.Read.All"):
Get-MgUser -Filter "mail eq 'user@domain.com'" -Property Id, UserPrincipalName, UserType, ExternalUserState, CreatedDateTime |
Select-Object UserPrincipalName, UserType, ExternalUserState, CreatedDateTimeNo result means the user was never invited. ExternalUserState set to PendingAcceptance means the invitation was not redeemed yet. A guest whose CreatedDateTime is older than the user's current home account points to the re-created account case; reset the redemption status instead of deleting the guest.
Sources
- learn.microsoft.comlearn.microsoft.com/en-us/troubleshoot/entra/entra-id/app-integration/error-code-aadsts50020-user-account-identity-provider-does-not-exist
- learn.microsoft.comlearn.microsoft.com/en-us/entra/identity-platform/reference-error-codes
- learn.microsoft.comlearn.microsoft.com/en-us/entra/external-id/b2b-quickstart-add-guest-users-portal