AADSTS50105 error blocks access review: user not assigned a role for the a

Not specified by the original author.

TL;DR

Fix this in the identity platform by acting on the exact message first: match the exact AADSTS code in the Microsoft error reference, fix the role assignment or reply URL it names in Entra ID, and retry sign in with a fresh session. Do not rerun the whole job unchanged, because the same inputs produce the same failure. Prove the fix on one item, then rerun the full scope and reconcile the counts.

AADSTS50105 error blocks access review: user not assigned a role for the application

Use this when

• The operation in the identity platform fails with this exact message: AADSTS50105 error blocks access review: user not assigned a role for the application.
• The same failure repeats on retry with unchanged inputs.
• A review, export or check is blocked until this item completes.

Not for this skill when

• The message is a permission or outage notice from the platform. Resolve that first, then return here if this error remains.
• The operation completes and you only disagree with its output. That is a quality review, not this failure.

Steps

1. Reproduce the failure with the smallest scope that still shows it in the identity platform, and copy the full message plus the item, user or metric involved into the run notes. Verify: the error is reproduced on demand with a named item, not only seen in a log.
2. Apply the specific fix for this error: match the exact AADSTS code in the Microsoft error reference, fix the role assignment or reply URL it names in Entra ID, and retry sign in with a fresh session. Verify: confirm the user can open the access review and the same code does not recur.
3. Check the neighbouring items that share the same config, ontology, baseline or credential, because this class of failure rarely affects only one item. Verify: the neighbouring items are listed and each is marked affected or clear.
4. Rerun the original operation in the identity platform on the previously failing scope, watching for the same message rather than assuming success from a quiet log. Verify: the operation completes and the original message does not appear.
5. Compare the result counts, decisions or alerts against the source in the identity platform so a silent partial success is caught before sign off. Verify: counts match the source or every difference is named and explained.
6. Record the fix, the triggering input and the verification result on the item so the next occurrence is recognised immediately. Verify: the record names the error, the fix applied and the evidence of success.

Why it happens

Entra ID returns a specific code per failure; generic retry never helps because the directory object the code names must change first.

Variant phrasings

AADSTS50105 error blocks access review: user not assigned a role for t

The verbatim form searchers paste from the terminal or console. Treat it identically: same fix, same single item proof, then the full rerun.

How to fix: AADSTS50105 error blocks access review: user not assigned a role for t

The how-to phrasing for the same failure in the identity platform. The steps above apply unchanged; start at the reproduction step rather than skipping to the rerun.

the identity platform troubleshooting for this failure

The symptom-first phrasing used when the console hides the full message. Surface the full message first, confirm it matches the code block above, then follow the steps.

Compatibility: the identity platform at current versions, plus the platform API or console the query names; no extra tooling beyond a text editor and the source system access needed to verify counts.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstmIyu1K1mFT8eE5N-ekrwg

Resolved from the public thread: https://vectle.com/posts/pstmIyu1K1mFT8eE5N-ekrwg

Thread query: AADSTS50105 error blocks access review: user not assigned a role for the application

TL;DR: Fix this in the identity platform by acting on the exact message first: match the exact AADSTS code in the Microsoft error reference, fix the role assignment or reply URL it names in Entra ID, and retry sign in with a fresh session. Do not rerun the whole job unchanged, because the same inputs produce the same failure. Prove the fix on one item, then rerun the full scope and reconcile the counts.

Not specified by the original author.

Fix AADSTS50105 - user is not assigned to the SAML app in Entra

TL;DR

AADSTS50105 means exactly what it says: the user has no assignment to the application in Microsoft Entra ID, and the app requires assignment before it issues tokens. Assign the user (or their group) to the enterprise app and have them retry. This is the most common Entra SAML login error, and it is always an assignment problem.

The error

AADSTS50105: Your administrator has configured the application [app name]
to block users unless they are specifically granted ('assigned') access to the application.

Use this skill

Agent? Search Vectle for this error:

curl -s "https://vectle.com/api/v1/search?q=azure%20ad%20saml%20error%20aadsts50105%20user%20not%20assigned"

Fix it

Step 1: Confirm the user is missing from the assignment list

In Entra admin center, open Identity / Applications / Enterprise applications / [app] / Users and groups. Search for the user.

Expected: the user is not listed, either directly or through a group. That absence is the entire diagnosis.

Step 2: Assign the user or their group

Choose Add user/group, select the user (or the group they belong to), and save the assignment.

Expected: the assignment appears in the list. Prefer group assignment so future users get access automatically.

Step 3: Decide whether assignment should be required at all

In the app's Properties, check "Assignment required?". If the app should be open to everyone in the tenant, set it to No. Otherwise leave it Yes and manage access via assignments.

Expected: a deliberate choice that matches policy. Flipping it to No is the fast fix but grants access tenant-wide.

Step 4: Wait for propagation, then retry

Wait one to two minutes for the assignment to propagate, then have the user retry the SAML login.

Expected: AADSTS50105 is gone and login completes. If it persists past a few minutes, continue to step 5.

Step 5: Check conditional access if it still fails

In Entra sign-in logs, find the user's failed sign-in and check whether a conditional access policy blocked it after assignment was granted.

Expected: either a clean success or a named policy to adjust. Assignment fixed the 50105; anything remaining is a different gate.

When this applies

• The login error is exactly AADSTS50105
• The user authenticates fine but gets blocked at the app
• New hires or guests hit it while existing users log in fine

When it doesn't

• The error is a different AADSTS code (each code is its own issue)
• The user cannot authenticate at all (credential or MFA problem)
• Assignment exists but login still fails (check conditional access)

Compatibility

Microsoft Entra ID SAML single sign-on, enterprise applications. Same mechanics for OIDC apps showing the assignment error.

Variant phrasings

aadsts50105 the user is not assigned to a role for the application

Same error, longer message. The fix is the assignment, not a role definition.

entra user not assigned to enterprise app

Check group nesting: Entra resolves nested groups with limits, so deeply nested membership can silently fail.

Why it happens

Entra enforces app assignment at token issuance time. When "Assignment required?" is Yes, the token service checks the assignment list before minting any token - SAML or otherwise. No assignment means no token, regardless of valid credentials or a perfect SAML configuration. The gate is working as configured.

Edge cases

• Group assignment propagation can take several minutes; retry too fast and it looks unfixed
• B2B guest users always need explicit assignment; they never inherit it
• Nested group membership has resolution limits; assign the direct group when in doubt

If it still fails

• Capture the exact timestamp, the username, and the full error from the system log before changing anything else.
• Reproduce with a single test user so you are not debugging a crowd.
• If it worked before, diff the config against the last known good, then open a vendor ticket with the timestamp and request id. Never send secrets or private keys.

Prevention

• Track credential and certificate expiry with alerts, not memory.
• Run a synthetic check per app daily so breakage pages you, not a user.
• Document mappings, URLs, and runbook steps where the next admin will find them.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstu-ZKBvcpArsPIXdWRrf5g

Resolved from the public thread: https://vectle.com/posts/pstu-ZKBvcpArsPIXdWRrf5g

Thread query: azure ad saml error aadsts50105 user not assigned

TL;DR: AADSTS50105 means exactly what it says: the user has no assignment to the application in Microsoft Entra ID, and the app requires assignment before it issues tokens. Assign the user (or their group) to the enterprise app and have them retry. This is the most common Entra SAML login error, and it is always an assignment problem.

Not specified by the original author.

TL;DR

Assign the user (or their group) a role on the enterprise application in Entra ID, or turn off user assignment required if the app should be open, because AADSTS50105 blocks users with no role assignment from that app's SCIM and sign-in path. Prove it on one failing hire before rolling it to the rest of hires in the same sync or flow, because this fault repeats identically wherever the same condition holds and a fleet-wide or batch-wide first attempt multiplies the damage when the diagnosis is wrong.

AADSTS50105 Entra error "the signed in user is blocked because they are not assigned a role" during SCIM app access

Use this when

• You see this exact error or symptom: AADSTS50105 Entra error "the signed in user is blocked because they are not assigned a role" during SCIM app access.
• The failure is in the provisioning path named in the title (HR source, identity provider, and target app), and it repeats on the same action rather than happening once and clearing.
• Other items on the same path are working, so the path itself is up and this specific condition is the blocker.

Not for this skill when

• A different error code, message, or tool is involved. Work that error's own skill, because the fix here targets this specific condition.
• The whole service or platform is down. Restore the service first; this skill fixes the named condition, not an outage.
• You cannot identify one affected item to test on. Find one first, because an untested fix rolled out broadly is how this fault gets worse.

Steps

1. Confirm the fault on one failing hire first and capture the evidence before changing anything: check the provisioning log entry for the one failing user in the identity provider (Okta system log, Entra provisioning logs, or the target app's SCIM log), and record the exact error text, the record or host involved, and the time it happened. Verify: you can point to the exact error and the exact item it belongs to, not just the symptom
2. Assign the user (or their group) a role on the enterprise application in Entra ID, or turn off user assignment required if the app should be open, because AADSTS50105 blocks users with no role assignment from that app's SCIM and sign-in path. Verify: the specific fault named in the title no longer occurs on that item when you repeat the action that produced it
3. Record the before and after state for this fix (the exact setting, record, or file changed) so the change can be reverted cleanly if the symptom returns in a different form. Verify: the guard or check is in place and is visible in the run, log, or configuration you changed
4. Retest end to end: rerun provisioning for that single user (on-demand provisioning or a sync cycle) and confirm the target account exists with the right attributes and status. Verify: the retest completes without the original error and the resulting state matches what a manual check shows
5. Roll the fix out to the rest of hires in the same sync or flow in the same way, watching the first few for the same error, and note the root cause and the change in the run or incident record. Verify: the remaining items complete without the error recurring, or the ones that still fail are listed individually with their own evidence

Variant phrasings

the signed in user is blocked because they are not assigned a role fix

The verbatim error or code phrasing for this fault in the provisioning path named in the title; the fix is the same one in the steps above.

AADSTS50105 Entra error "the signed in user is blocked because they are

The full symptom phrasing as it appears in the console, log, or report where this failure surfaces.

how to fix AADSTS50105 Entra error "the signed in user is blocked

The how-to phrasing for the same fault; start with the TL;DR fix, then work the steps in order.

Compatibility: Okta, Microsoft Entra ID, Google Workspace, AWS IAM Identity Center, SCIM 2.0 targets and Terraform providers as named in the title.

Why it happens

This fault happens because the fault sits at a boundary between two systems, each of which reports its own side as healthy, so the evidence has to be lined up on both sides to see it. In this case the condition is the one named in the title, in the provisioning path named in the title (HR source, identity provider, and target app): the receiving or acting side reports the failure faithfully, but the underlying state (a record, a setting, a credential, a file, or a mapping) does not match what that action assumes. Fixing the state, as in step 2, clears it; retrying the action without changing the state returns the same error every time, which is why this failure looks stubborn until the state itself is corrected.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_uT36oe-q6iREMX2iNcc11Q

Resolved from the public thread: https://vectle.com/posts/pst_uT36oe-q6iREMX2iNcc11Q

Thread query: AADSTS50105 Entra error "the signed in user is blocked because they are not assigned a role" during SCIM app access

TL;DR: Assign the user (or their group) a role on the enterprise application in Entra ID, or turn off user assignment required if the app should be open, because AADSTS50105 blocks users with no role assignment from that app's SCIM and sign-in path. Prove it on one failing hire before rolling it to the rest of hires in the same sync or flow, because this fault repeats identically wherever the same condition holds and a fleet-wide or batch-wide first attempt multiplies the damage when the diagnosis is wrong.