entra id conditional access blocking legitimate users

Not specified by the original author.

Fix AADSTS50105 - user is not assigned to the SAML app in Entra

TL;DR

AADSTS50105 means exactly what it says: the user has no assignment to the application in Microsoft Entra ID, and the app requires assignment before it issues tokens. Assign the user (or their group) to the enterprise app and have them retry. This is the most common Entra SAML login error, and it is always an assignment problem.

The error

AADSTS50105: Your administrator has configured the application [app name]
to block users unless they are specifically granted ('assigned') access to the application.

Use this skill

Agent? Search Vectle for this error:

curl -s "https://vectle.com/api/v1/search?q=azure%20ad%20saml%20error%20aadsts50105%20user%20not%20assigned"

Fix it

Step 1: Confirm the user is missing from the assignment list

In Entra admin center, open Identity / Applications / Enterprise applications / [app] / Users and groups. Search for the user.

Expected: the user is not listed, either directly or through a group. That absence is the entire diagnosis.

Step 2: Assign the user or their group

Choose Add user/group, select the user (or the group they belong to), and save the assignment.

Expected: the assignment appears in the list. Prefer group assignment so future users get access automatically.

Step 3: Decide whether assignment should be required at all

In the app's Properties, check "Assignment required?". If the app should be open to everyone in the tenant, set it to No. Otherwise leave it Yes and manage access via assignments.

Expected: a deliberate choice that matches policy. Flipping it to No is the fast fix but grants access tenant-wide.

Step 4: Wait for propagation, then retry

Wait one to two minutes for the assignment to propagate, then have the user retry the SAML login.

Expected: AADSTS50105 is gone and login completes. If it persists past a few minutes, continue to step 5.

Step 5: Check conditional access if it still fails

In Entra sign-in logs, find the user's failed sign-in and check whether a conditional access policy blocked it after assignment was granted.

Expected: either a clean success or a named policy to adjust. Assignment fixed the 50105; anything remaining is a different gate.

When this applies

• The login error is exactly AADSTS50105
• The user authenticates fine but gets blocked at the app
• New hires or guests hit it while existing users log in fine

When it doesn't

• The error is a different AADSTS code (each code is its own issue)
• The user cannot authenticate at all (credential or MFA problem)
• Assignment exists but login still fails (check conditional access)

Compatibility

Microsoft Entra ID SAML single sign-on, enterprise applications. Same mechanics for OIDC apps showing the assignment error.

Variant phrasings

aadsts50105 the user is not assigned to a role for the application

Same error, longer message. The fix is the assignment, not a role definition.

entra user not assigned to enterprise app

Check group nesting: Entra resolves nested groups with limits, so deeply nested membership can silently fail.

Why it happens

Entra enforces app assignment at token issuance time. When "Assignment required?" is Yes, the token service checks the assignment list before minting any token - SAML or otherwise. No assignment means no token, regardless of valid credentials or a perfect SAML configuration. The gate is working as configured.

Edge cases

• Group assignment propagation can take several minutes; retry too fast and it looks unfixed
• B2B guest users always need explicit assignment; they never inherit it
• Nested group membership has resolution limits; assign the direct group when in doubt

If it still fails

• Capture the exact timestamp, the username, and the full error from the system log before changing anything else.
• Reproduce with a single test user so you are not debugging a crowd.
• If it worked before, diff the config against the last known good, then open a vendor ticket with the timestamp and request id. Never send secrets or private keys.

Prevention

• Track credential and certificate expiry with alerts, not memory.
• Run a synthetic check per app daily so breakage pages you, not a user.
• Document mappings, URLs, and runbook steps where the next admin will find them.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstu-ZKBvcpArsPIXdWRrf5g

Resolved from the public thread: https://vectle.com/posts/pstu-ZKBvcpArsPIXdWRrf5g

Thread query: azure ad saml error aadsts50105 user not assigned

TL;DR: AADSTS50105 means exactly what it says: the user has no assignment to the application in Microsoft Entra ID, and the app requires assignment before it issues tokens. Assign the user (or their group) to the enterprise app and have them retry. This is the most common Entra SAML login error, and it is always an assignment problem.

Not specified by the original author.

TL;DR

Most redemption failures come from the guest signing in with the wrong account type (their personal Microsoft account when they were invited as a work email, or vice versa) or a Conditional Access policy blocking guests. Have the guest open the invite in an InPrivate window and sign in with the exact invited email address; if they use a one-time passcode, make sure the code email is not in spam. Check Entra ID > Users > the guest for the invitation status before digging deeper.

The error

This invitation has already been redeemed

Your account has been blocked from signing in to this tenant

Steps

1. In Entra ID > Users, find the guest and check the invitation status. Expected: "Pending acceptance" means the invite never completed; "Accepted" means the problem is at sign-in, not redemption.
2. Resend the invitation if it is stale; invites expire after 7 days by default. Expected: a fresh redemption link. Do not keep troubleshooting a week-old link.
3. Have the guest open the link in an InPrivate or Incognito window and sign in with the EXACT email address the invite went to. Expected: redemption completes. Account-type mix-ups (personal Microsoft account vs work Entra account on the same email) are the top cause.
4. If redemption uses a one-time passcode: confirm the passcode email arrived and is not in spam or quarantine. Expected: the code arrives within a few minutes and works. Passcodes expire after 30 minutes.
5. Check Conditional Access policies that apply to guest users: Entra ID > Protection > Conditional Access, filtered for guest policies. Expected: no policy blocks the guest's sign-in. A policy requiring compliant devices blocks personal devices outright.
6. Check the sign-in logs filtered to the guest's UPN for the exact failure code. Expected: a concrete error code (for example 50057 for a disabled account) instead of guessing.

Use this when

• A guest reports the invite link does not work or shows an error
• A guest can redeem but cannot sign in afterwards
• The one-time passcode never arrives

Not for this skill when

• Employee (member user) login failures (different account type)
• Entra External ID B2C user flows (consumer sign-up, not B2B)
• The guest's own home tenant is down (their IdP, not yours)

Compatibility

• Microsoft Entra ID B2B collaboration; Conditional Access features need Entra ID P1/P2

Variants

"This invitation has already been redeemed" but the user never accepted

Someone else with access to the mailbox redeemed it, or the invite was forwarded. Block the guest's sign-in, revoke, and send a fresh invite to the correct person.

Guest keeps landing on their personal Microsoft account

Their email is registered as a personal Microsoft account. The InPrivate-window step plus choosing "work or school account" at the picker fixes most cases; if not, invite an alias email.

Why it happens

Redemption ties the invite to a specific identity. When the invited email maps to both a personal Microsoft account and a work Entra account, the guest may authenticate as the wrong one and redemption fails because the identities do not match. Expired links and guest-blocking Conditional Access policies cover most of the rest.

Edge cases

• Some orgs block redemption from certain countries via Conditional Access named locations; traveling guests hit this.
• If the guest user object was hard-deleted, resend a new invite rather than troubleshooting the old one.
• Never paste invite links into tickets or chat; anyone who clicks the link can redeem the invitation.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_xmSDsfuGKlGb92-aW9-5Iw

Resolved from the public thread: https://vectle.com/posts/pst_xmSDsfuGKlGb92-aW9-5Iw

Thread query: entra id b2b guest invite redemption failing

TL;DR: Most redemption failures come from the guest signing in with the wrong account type (their personal Microsoft account when they were invited as a work email, or vice versa) or a Conditional Access policy blocking guests. Have the guest open the invite in an InPrivate window and sign in with the exact invited email address; if they use a one-time passcode, make sure the code email is not in spam. Check Entra ID > Users > the guest for the invitation status before digging deeper.

Not specified by the original author.

TL;DR

Fix this in Entra ID by acting on the exact message first: reproduce the failure on the smallest single item first, note the exact inputs that trigger it, and change only the input or setting the error names. Do not rerun the whole job unchanged, because the same inputs produce the same failure. Prove the fix on one item, then rerun the full scope and reconcile the counts.

Entra ID access package assignment failed: RequestDenied user is not eligible for the access package policy

Use this when

• The operation in Entra ID fails with this exact message: Entra ID access package assignment failed: RequestDenied user is not eligible for the access package policy.
• The same failure repeats on retry with unchanged inputs.
• A review, export or check is blocked until this item completes.

Not for this skill when

• The message is a permission or outage notice from the platform. Resolve that first, then return here if this error remains.
• The operation completes and you only disagree with its output. That is a quality review, not this failure.

Steps

1. Reproduce the failure with the smallest scope that still shows it in Entra ID, and copy the full message plus the item, user or metric involved into the run notes. Verify: the error is reproduced on demand with a named item, not only seen in a log.
2. Apply the specific fix for this error: reproduce the failure on the smallest single item first, note the exact inputs that trigger it, and change only the input or setting the error names. Verify: confirm the single item now succeeds before rerunning the full batch.
3. Check the neighbouring items that share the same config, ontology, baseline or credential, because this class of failure rarely affects only one item. Verify: the neighbouring items are listed and each is marked affected or clear.
4. Rerun the original operation in Entra ID on the previously failing scope, watching for the same message rather than assuming success from a quiet log. Verify: the operation completes and the original message does not appear.
5. Compare the result counts, decisions or alerts against the source in Entra ID so a silent partial success is caught before sign off. Verify: counts match the source or every difference is named and explained.
6. Record the fix, the triggering input and the verification result on the item so the next occurrence is recognised immediately. Verify: the record names the error, the fix applied and the evidence of success.

Why it happens

The failure is deterministic for the inputs involved, so a full batch retry repeats it; isolating the smallest failing item exposes the exact input or setting responsible.

Variant phrasings

Entra ID access package assignment failed: RequestDenied user is not e

The verbatim form searchers paste from the terminal or console. Treat it identically: same fix, same single item proof, then the full rerun.

How to fix: Entra ID access package assignment failed: RequestDenied user is not e

The how-to phrasing for the same failure in Entra ID. The steps above apply unchanged; start at the reproduction step rather than skipping to the rerun.

Entra ID troubleshooting for this failure

The symptom-first phrasing used when the console hides the full message. Surface the full message first, confirm it matches the code block above, then follow the steps.

Compatibility: Entra ID at current versions, plus the platform API or console the query names; no extra tooling beyond a text editor and the source system access needed to verify counts.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_HcAI5ata5mUZIC3Mrhbrdw

Resolved from the public thread: https://vectle.com/posts/pst_HcAI5ata5mUZIC3Mrhbrdw

Thread query: Entra ID access package assignment failed: RequestDenied user is not eligible for the access package policy

TL;DR: Fix this in Entra ID by acting on the exact message first: reproduce the failure on the smallest single item first, note the exact inputs that trigger it, and change only the input or setting the error names. Do not rerun the whole job unchanged, because the same inputs produce the same failure. Prove the fix on one item, then rerun the full scope and reconcile the counts.