Skip to content
Browse

/errors/exchange-online/aadsts53003-connect-exchangeonline

Connect-ExchangeOnline: AADSTS53003: Access has been blocked by Conditional Access policies

The commands on this page have not been executed by our verification runner yet.updated
tool
Exchange Online PowerShell
versions
ExchangeOnlineManagement 3.x
os
windows, linux, macos

AADSTS53003: Access has been blocked by Conditional Access policies. The access policy does not allow token issuance. is a Microsoft Entra ID sign-in error, not an Exchange error. Connect-ExchangeOnline asked Entra ID for a token, the sign-in matched a Conditional Access policy whose result is "block", and no token was issued. The fix is in the policy or in where you sign in from, not in the PowerShell command.

Microsoft's AADSTS reference lists the code as BlockedByConditionalAccess - Access has been blocked by Conditional Access policies. The access policy does not allow token issuance.

Find the policy that blocked you

  1. Sign in to the Microsoft Entra admin center with a role that can read sign-in logs (for example Reports Reader or Security Reader).
  2. Go to Monitoring and health > Sign-in logs and filter on the account and the time of the failure.
  3. Open the failed sign-in (error code 53003) and select the Conditional Access tab. It lists every policy that was evaluated and which one returned "Failure".

The policy's conditions (users, target resources, device platform, location, client apps) tell you why your sign-in matched.

Typical fixes

Policy requiresWhat to do
Block from untrusted locationsConnect from a named or trusted network, or through the corporate VPN
Compliant or hybrid joined deviceRun PowerShell on a managed device that meets the policy
Block for specific client apps or platformsUse a supported client; the module signs in with modern authentication (MSAL)
Block for the accountUse the admin account the policy is meant for, or ask for an exclusion
  • AADSTS50076: multifactor authentication is required. Interactive Connect-ExchangeOnline prompts for it; -Credential cannot complete MFA.
  • AADSTS53000: the policy requires a compliant device and this one is not.
  • AADSTS700016: the app ID used with -AppId was not found in the tenant.

The AADSTS error codes table explains the codes most often seen from admin modules.

Sources

Related pages

codes · entra-idAADSTS error codes: Microsoft Entra sign-in errors seen in admin PowerShell modulesAADSTS error codes from Microsoft Entra ID explained: 50076 MFA required, 50126 bad password, 53003 Conditional Access, 700016 app not found and more.glossary · entra-idWhat is Conditional Access in Microsoft Entra ID?Conditional Access is the Entra ID if-then policy engine: it checks user, app, location, device and risk, then blocks access or requires MFA or a compliant PC.commands · exchange-onlineConnect-ExchangeOnline -AppId -CertificateThumbprint -Organization (app-only, unattended scripts)Connect to Exchange Online PowerShell without a user: register an app with Exchange.ManageAsApp, add a certificate, assign a role, pass AppId and thumbprint.