Microsoft Entra ID
Identity, sign-in, Conditional Access and app registrations in Microsoft 365 and Azure.
Official documentation- AADSTS50020: User account from identity provider does not exist in tenantThe account is not a member or guest of the tenant it signed in to. Invite it as a B2B guest, or make the app multitenant and use the organizations endpoint.
- AADSTS65001: The user or administrator has not consented to use the applicationNo one consented to the permissions the app requests and the token request could not prompt. Grant admin consent for the tenant or sign in interactively once.
- AADSTS700016: Application with identifier was not found in the directoryEntra ID found no app with that client ID in the tenant: a wrong -AppId or -ClientId, an object ID instead of the app ID, the wrong tenant, or no consent.
- AADSTS7000215: Invalid client secret providedEntra ID rejected the client secret: often the Secret ID was used instead of the Value, or the secret is from another app. Create a new one, copy its Value.
- Update-MgUser -AccountEnabled:$false: block sign-in for a Microsoft Entra ID userBlock sign-in for an Entra ID user with Update-MgUser -UserId UPN -AccountEnabled:$false. The colon matters: the parameter is a switch, so a space fails.
- Get the last sign-in date of Microsoft Entra ID users with PowerShell (signInActivity)Get-MgUser -All -Property SignInActivity returns each Entra ID user's last sign-in. It needs AuditLog.Read.All, User.Read.All and a P1 or P2 license too.
- List the groups a Microsoft Entra ID user is a member of (Get-MgUserMemberOf)Get-MgUserMemberOfAsGroup -UserId UPN -All lists a user's Entra ID groups by name; the transitive cmdlet adds nested ones. Plain MemberOf hides DisplayName.
- Reset a Microsoft Entra ID user password with PowerShell (Update-MgUser -PasswordProfile)Reset an Entra ID password with Update-MgUser -PasswordProfile @{Password=...; ForceChangePasswordNextSignIn=$true}, using User-PasswordProfile.ReadWrite.All.
- az login --allow-no-subscriptions: sign in to an Entra tenant without Azure subscriptionsaz login --allow-no-subscriptions signs in to an Entra tenant that has no Azure subscription, for tenant-level commands such as az ad. Related az login options.
- dsregcmd /status: check if a device is Entra joined, hybrid joined or registereddsregcmd /status shows whether a Windows device is Microsoft Entra joined, hybrid joined or registered, plus PRT and Windows Hello state. How to read it.
- Update-MgUser -PasswordPolicies DisablePasswordExpiration: password never expiresUpdate-MgUser -PasswordPolicies DisablePasswordExpiration makes an Entra ID password never expire; None restores it. Values, synced users and the 90-day trap.
- Update-MgUser -UsageLocation: set the country code required for licensesUpdate-MgUser -UsageLocation sets the two-letter country code Microsoft 365 needs before a license can be assigned. Find users without it and set it in bulk.
- App registration vs enterprise application in Microsoft Entra ID (application object vs service principal)An app registration is the application object, defined once in its home tenant; an enterprise application is its service principal in each tenant that uses it.
- Microsoft Graph permission vs Microsoft Entra role: delegated scopes, app roles and admin rolesA Graph permission says what an app may call; an Entra role says what a user or service principal may do. Delegated access needs both; app-only needs app roles.