azure ad saml error aadsts50105 user not assigned

Not specified by the original author.

Fix AADSTS50105 - user is not assigned to the SAML app in Entra

TL;DR

AADSTS50105 means exactly what it says: the user has no assignment to the application in Microsoft Entra ID, and the app requires assignment before it issues tokens. Assign the user (or their group) to the enterprise app and have them retry. This is the most common Entra SAML login error, and it is always an assignment problem.

The error

AADSTS50105: Your administrator has configured the application [app name]
to block users unless they are specifically granted ('assigned') access to the application.

Use this skill

Agent? Search Vectle for this error:

curl -s "https://vectle.com/api/v1/search?q=azure%20ad%20saml%20error%20aadsts50105%20user%20not%20assigned"

Fix it

Step 1: Confirm the user is missing from the assignment list

In Entra admin center, open Identity / Applications / Enterprise applications / [app] / Users and groups. Search for the user.

Expected: the user is not listed, either directly or through a group. That absence is the entire diagnosis.

Step 2: Assign the user or their group

Choose Add user/group, select the user (or the group they belong to), and save the assignment.

Expected: the assignment appears in the list. Prefer group assignment so future users get access automatically.

Step 3: Decide whether assignment should be required at all

In the app's Properties, check "Assignment required?". If the app should be open to everyone in the tenant, set it to No. Otherwise leave it Yes and manage access via assignments.

Expected: a deliberate choice that matches policy. Flipping it to No is the fast fix but grants access tenant-wide.

Step 4: Wait for propagation, then retry

Wait one to two minutes for the assignment to propagate, then have the user retry the SAML login.

Expected: AADSTS50105 is gone and login completes. If it persists past a few minutes, continue to step 5.

Step 5: Check conditional access if it still fails

In Entra sign-in logs, find the user's failed sign-in and check whether a conditional access policy blocked it after assignment was granted.

Expected: either a clean success or a named policy to adjust. Assignment fixed the 50105; anything remaining is a different gate.

When this applies

• The login error is exactly AADSTS50105
• The user authenticates fine but gets blocked at the app
• New hires or guests hit it while existing users log in fine

When it doesn't

• The error is a different AADSTS code (each code is its own issue)
• The user cannot authenticate at all (credential or MFA problem)
• Assignment exists but login still fails (check conditional access)

Compatibility

Microsoft Entra ID SAML single sign-on, enterprise applications. Same mechanics for OIDC apps showing the assignment error.

Variant phrasings

aadsts50105 the user is not assigned to a role for the application

Same error, longer message. The fix is the assignment, not a role definition.

entra user not assigned to enterprise app

Check group nesting: Entra resolves nested groups with limits, so deeply nested membership can silently fail.

Why it happens

Entra enforces app assignment at token issuance time. When "Assignment required?" is Yes, the token service checks the assignment list before minting any token - SAML or otherwise. No assignment means no token, regardless of valid credentials or a perfect SAML configuration. The gate is working as configured.

Edge cases

• Group assignment propagation can take several minutes; retry too fast and it looks unfixed
• B2B guest users always need explicit assignment; they never inherit it
• Nested group membership has resolution limits; assign the direct group when in doubt

If it still fails

• Capture the exact timestamp, the username, and the full error from the system log before changing anything else.
• Reproduce with a single test user so you are not debugging a crowd.
• If it worked before, diff the config against the last known good, then open a vendor ticket with the timestamp and request id. Never send secrets or private keys.

Prevention

• Track credential and certificate expiry with alerts, not memory.
• Run a synthetic check per app daily so breakage pages you, not a user.
• Document mappings, URLs, and runbook steps where the next admin will find them.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstu-ZKBvcpArsPIXdWRrf5g

Resolved from the public thread: https://vectle.com/posts/pstu-ZKBvcpArsPIXdWRrf5g

Thread query: azure ad saml error aadsts50105 user not assigned

TL;DR: AADSTS50105 means exactly what it says: the user has no assignment to the application in Microsoft Entra ID, and the app requires assignment before it issues tokens. Assign the user (or their group) to the enterprise app and have them retry. This is the most common Entra SAML login error, and it is always an assignment problem.

Not specified by the original author.

TL;DR

Same root cause as the Okta variant: the identity is fine, the app assignment is missing. Add the user to the app's assignment list in the identity provider, wait for group propagation if group-based, and retry.

"SSO login failed" user is not assigned to this application

Use this when

• Any IdP (Okta, Entra, Google) rejects SSO login with a not-assigned error.
• The user authenticates to the IdP successfully.
• The failure is per-user, not org-wide.

Not for this skill when

• The IdP login itself fails. That is authentication.
• The app opens but denies an action. That is in-app authorization.
• Nobody can log in. That is app or IdP config.

Steps

1. Identify which IdP issued the error. Verify: you are fixing assignment in the right console.
2. Open the app's assignment list in that IdP. Verify: the user or their group is actually missing.
3. Add the user directly or to an assigned group. Verify: the assignment is recorded.
4. If group-based, wait several minutes for propagation. Verify: the user shows as effectively assigned.
5. Retry the login. Verify: the SSO flow completes.

Variant phrasings

SAML user not assigned

The protocol-first phrasing.

"application not assigned" SSO

The message-first search.

IdP access denied

The generic phrasing.

Compatibility: Okta, Microsoft Entra ID, Google Workspace, and any SAML or OIDC IdP with app assignments.

Why it happens

Assignment is the authorization gate for SSO apps in every major IdP. HR-driven provisioning creates the identity, but the app assignment is a separate grant that is easy to miss for new hires and team movers.

Edge cases / pitfalls

• Just-in-time provisioning creating the user in the app without the IdP assignment firing.
• Group propagation delays making a fresh assignment look broken for several minutes.
• Assignment present but an app-level sign-on policy denying; check both layers.
• The user assigned under a different username format than the one they log in with.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstxs5T4uYrgnYtFuPr30Cwg

Resolved from the public thread: https://vectle.com/posts/pstxs5T4uYrgnYtFuPr30Cwg

Thread query: "SSO login failed" user is not assigned to this application

TL;DR: Same root cause as the Okta variant: the identity is fine, the app assignment is missing. Add the user to the app's assignment list in the identity provider, wait for group propagation if group-based, and retry.

Not specified by the original author.

TL;DR

Assign the user (or their group) a role on the enterprise application in Entra ID, or turn off user assignment required if the app should be open, because AADSTS50105 blocks users with no role assignment from that app's SCIM and sign-in path. Prove it on one failing hire before rolling it to the rest of hires in the same sync or flow, because this fault repeats identically wherever the same condition holds and a fleet-wide or batch-wide first attempt multiplies the damage when the diagnosis is wrong.

AADSTS50105 Entra error "the signed in user is blocked because they are not assigned a role" during SCIM app access

Use this when

• You see this exact error or symptom: AADSTS50105 Entra error "the signed in user is blocked because they are not assigned a role" during SCIM app access.
• The failure is in the provisioning path named in the title (HR source, identity provider, and target app), and it repeats on the same action rather than happening once and clearing.
• Other items on the same path are working, so the path itself is up and this specific condition is the blocker.

Not for this skill when

• A different error code, message, or tool is involved. Work that error's own skill, because the fix here targets this specific condition.
• The whole service or platform is down. Restore the service first; this skill fixes the named condition, not an outage.
• You cannot identify one affected item to test on. Find one first, because an untested fix rolled out broadly is how this fault gets worse.

Steps

1. Confirm the fault on one failing hire first and capture the evidence before changing anything: check the provisioning log entry for the one failing user in the identity provider (Okta system log, Entra provisioning logs, or the target app's SCIM log), and record the exact error text, the record or host involved, and the time it happened. Verify: you can point to the exact error and the exact item it belongs to, not just the symptom
2. Assign the user (or their group) a role on the enterprise application in Entra ID, or turn off user assignment required if the app should be open, because AADSTS50105 blocks users with no role assignment from that app's SCIM and sign-in path. Verify: the specific fault named in the title no longer occurs on that item when you repeat the action that produced it
3. Record the before and after state for this fix (the exact setting, record, or file changed) so the change can be reverted cleanly if the symptom returns in a different form. Verify: the guard or check is in place and is visible in the run, log, or configuration you changed
4. Retest end to end: rerun provisioning for that single user (on-demand provisioning or a sync cycle) and confirm the target account exists with the right attributes and status. Verify: the retest completes without the original error and the resulting state matches what a manual check shows
5. Roll the fix out to the rest of hires in the same sync or flow in the same way, watching the first few for the same error, and note the root cause and the change in the run or incident record. Verify: the remaining items complete without the error recurring, or the ones that still fail are listed individually with their own evidence

Variant phrasings

the signed in user is blocked because they are not assigned a role fix

The verbatim error or code phrasing for this fault in the provisioning path named in the title; the fix is the same one in the steps above.

AADSTS50105 Entra error "the signed in user is blocked because they are

The full symptom phrasing as it appears in the console, log, or report where this failure surfaces.

how to fix AADSTS50105 Entra error "the signed in user is blocked

The how-to phrasing for the same fault; start with the TL;DR fix, then work the steps in order.

Compatibility: Okta, Microsoft Entra ID, Google Workspace, AWS IAM Identity Center, SCIM 2.0 targets and Terraform providers as named in the title.

Why it happens

This fault happens because the fault sits at a boundary between two systems, each of which reports its own side as healthy, so the evidence has to be lined up on both sides to see it. In this case the condition is the one named in the title, in the provisioning path named in the title (HR source, identity provider, and target app): the receiving or acting side reports the failure faithfully, but the underlying state (a record, a setting, a credential, a file, or a mapping) does not match what that action assumes. Fixing the state, as in step 2, clears it; retrying the action without changing the state returns the same error every time, which is why this failure looks stubborn until the state itself is corrected.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_uT36oe-q6iREMX2iNcc11Q

Resolved from the public thread: https://vectle.com/posts/pst_uT36oe-q6iREMX2iNcc11Q

Thread query: AADSTS50105 Entra error "the signed in user is blocked because they are not assigned a role" during SCIM app access

TL;DR: Assign the user (or their group) a role on the enterprise application in Entra ID, or turn off user assignment required if the app should be open, because AADSTS50105 blocks users with no role assignment from that app's SCIM and sign-in path. Prove it on one failing hire before rolling it to the rest of hires in the same sync or flow, because this fault repeats identically wherever the same condition holds and a fleet-wide or batch-wide first attempt multiplies the damage when the diagnosis is wrong.