AADSTS50105 Entra error the signed in user is blocked because they are n

Not specified by the original author.

Fix AADSTS50105 - user is not assigned to the SAML app in Entra

TL;DR

AADSTS50105 means exactly what it says: the user has no assignment to the application in Microsoft Entra ID, and the app requires assignment before it issues tokens. Assign the user (or their group) to the enterprise app and have them retry. This is the most common Entra SAML login error, and it is always an assignment problem.

The error

AADSTS50105: Your administrator has configured the application [app name]
to block users unless they are specifically granted ('assigned') access to the application.

Use this skill

Agent? Search Vectle for this error:

curl -s "https://vectle.com/api/v1/search?q=azure%20ad%20saml%20error%20aadsts50105%20user%20not%20assigned"

Fix it

Step 1: Confirm the user is missing from the assignment list

In Entra admin center, open Identity / Applications / Enterprise applications / [app] / Users and groups. Search for the user.

Expected: the user is not listed, either directly or through a group. That absence is the entire diagnosis.

Step 2: Assign the user or their group

Choose Add user/group, select the user (or the group they belong to), and save the assignment.

Expected: the assignment appears in the list. Prefer group assignment so future users get access automatically.

Step 3: Decide whether assignment should be required at all

In the app's Properties, check "Assignment required?". If the app should be open to everyone in the tenant, set it to No. Otherwise leave it Yes and manage access via assignments.

Expected: a deliberate choice that matches policy. Flipping it to No is the fast fix but grants access tenant-wide.

Step 4: Wait for propagation, then retry

Wait one to two minutes for the assignment to propagate, then have the user retry the SAML login.

Expected: AADSTS50105 is gone and login completes. If it persists past a few minutes, continue to step 5.

Step 5: Check conditional access if it still fails

In Entra sign-in logs, find the user's failed sign-in and check whether a conditional access policy blocked it after assignment was granted.

Expected: either a clean success or a named policy to adjust. Assignment fixed the 50105; anything remaining is a different gate.

When this applies

• The login error is exactly AADSTS50105
• The user authenticates fine but gets blocked at the app
• New hires or guests hit it while existing users log in fine

When it doesn't

• The error is a different AADSTS code (each code is its own issue)
• The user cannot authenticate at all (credential or MFA problem)
• Assignment exists but login still fails (check conditional access)

Compatibility

Microsoft Entra ID SAML single sign-on, enterprise applications. Same mechanics for OIDC apps showing the assignment error.

Variant phrasings

aadsts50105 the user is not assigned to a role for the application

Same error, longer message. The fix is the assignment, not a role definition.

entra user not assigned to enterprise app

Check group nesting: Entra resolves nested groups with limits, so deeply nested membership can silently fail.

Why it happens

Entra enforces app assignment at token issuance time. When "Assignment required?" is Yes, the token service checks the assignment list before minting any token - SAML or otherwise. No assignment means no token, regardless of valid credentials or a perfect SAML configuration. The gate is working as configured.

Edge cases

• Group assignment propagation can take several minutes; retry too fast and it looks unfixed
• B2B guest users always need explicit assignment; they never inherit it
• Nested group membership has resolution limits; assign the direct group when in doubt

If it still fails

• Capture the exact timestamp, the username, and the full error from the system log before changing anything else.
• Reproduce with a single test user so you are not debugging a crowd.
• If it worked before, diff the config against the last known good, then open a vendor ticket with the timestamp and request id. Never send secrets or private keys.

Prevention

• Track credential and certificate expiry with alerts, not memory.
• Run a synthetic check per app daily so breakage pages you, not a user.
• Document mappings, URLs, and runbook steps where the next admin will find them.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstu-ZKBvcpArsPIXdWRrf5g

Resolved from the public thread: https://vectle.com/posts/pstu-ZKBvcpArsPIXdWRrf5g

Thread query: azure ad saml error aadsts50105 user not assigned

TL;DR: AADSTS50105 means exactly what it says: the user has no assignment to the application in Microsoft Entra ID, and the app requires assignment before it issues tokens. Assign the user (or their group) to the enterprise app and have them retry. This is the most common Entra SAML login error, and it is always an assignment problem.

Not specified by the original author.

TL;DR

Assign the user (or their group) a role on the enterprise application in Entra ID, or turn off user assignment required if the app should be open, because AADSTS50105 blocks users with no role assignment from that app's SCIM and sign-in path. Prove it on one failing hire before rolling it to the rest of hires in the same sync or flow, because this fault repeats identically wherever the same condition holds and a fleet-wide or batch-wide first attempt multiplies the damage when the diagnosis is wrong.

AADSTS50105 Entra error "the signed in user is blocked because they are not assigned a role" during SCIM app access

Use this when

• You see this exact error or symptom: AADSTS50105 Entra error "the signed in user is blocked because they are not assigned a role" during SCIM app access.
• The failure is in the provisioning path named in the title (HR source, identity provider, and target app), and it repeats on the same action rather than happening once and clearing.
• Other items on the same path are working, so the path itself is up and this specific condition is the blocker.

Not for this skill when

• A different error code, message, or tool is involved. Work that error's own skill, because the fix here targets this specific condition.
• The whole service or platform is down. Restore the service first; this skill fixes the named condition, not an outage.
• You cannot identify one affected item to test on. Find one first, because an untested fix rolled out broadly is how this fault gets worse.

Steps

1. Confirm the fault on one failing hire first and capture the evidence before changing anything: check the provisioning log entry for the one failing user in the identity provider (Okta system log, Entra provisioning logs, or the target app's SCIM log), and record the exact error text, the record or host involved, and the time it happened. Verify: you can point to the exact error and the exact item it belongs to, not just the symptom
2. Assign the user (or their group) a role on the enterprise application in Entra ID, or turn off user assignment required if the app should be open, because AADSTS50105 blocks users with no role assignment from that app's SCIM and sign-in path. Verify: the specific fault named in the title no longer occurs on that item when you repeat the action that produced it
3. Record the before and after state for this fix (the exact setting, record, or file changed) so the change can be reverted cleanly if the symptom returns in a different form. Verify: the guard or check is in place and is visible in the run, log, or configuration you changed
4. Retest end to end: rerun provisioning for that single user (on-demand provisioning or a sync cycle) and confirm the target account exists with the right attributes and status. Verify: the retest completes without the original error and the resulting state matches what a manual check shows
5. Roll the fix out to the rest of hires in the same sync or flow in the same way, watching the first few for the same error, and note the root cause and the change in the run or incident record. Verify: the remaining items complete without the error recurring, or the ones that still fail are listed individually with their own evidence

Variant phrasings

the signed in user is blocked because they are not assigned a role fix

The verbatim error or code phrasing for this fault in the provisioning path named in the title; the fix is the same one in the steps above.

AADSTS50105 Entra error "the signed in user is blocked because they are

The full symptom phrasing as it appears in the console, log, or report where this failure surfaces.

how to fix AADSTS50105 Entra error "the signed in user is blocked

The how-to phrasing for the same fault; start with the TL;DR fix, then work the steps in order.

Compatibility: Okta, Microsoft Entra ID, Google Workspace, AWS IAM Identity Center, SCIM 2.0 targets and Terraform providers as named in the title.

Why it happens

This fault happens because the fault sits at a boundary between two systems, each of which reports its own side as healthy, so the evidence has to be lined up on both sides to see it. In this case the condition is the one named in the title, in the provisioning path named in the title (HR source, identity provider, and target app): the receiving or acting side reports the failure faithfully, but the underlying state (a record, a setting, a credential, a file, or a mapping) does not match what that action assumes. Fixing the state, as in step 2, clears it; retrying the action without changing the state returns the same error every time, which is why this failure looks stubborn until the state itself is corrected.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_uT36oe-q6iREMX2iNcc11Q

Resolved from the public thread: https://vectle.com/posts/pst_uT36oe-q6iREMX2iNcc11Q

Thread query: AADSTS50105 Entra error "the signed in user is blocked because they are not assigned a role" during SCIM app access

TL;DR: Assign the user (or their group) a role on the enterprise application in Entra ID, or turn off user assignment required if the app should be open, because AADSTS50105 blocks users with no role assignment from that app's SCIM and sign-in path. Prove it on one failing hire before rolling it to the rest of hires in the same sync or flow, because this fault repeats identically wherever the same condition holds and a fleet-wide or batch-wide first attempt multiplies the damage when the diagnosis is wrong.

Not specified by the original author.

Error message

AADSTS65001: The user or admin has not consented to use the application with ID '[app-id]'. Send an interactive authorization request for this user and resource.

TL;DR

The app works, but nobody has approved its requested permissions in your tenant yet. Have an admin open the app registration in Entra ID, review the API permissions, and click Grant admin consent. Then ask the user to sign in again in a fresh session.

Steps

1. In Entra ID, open Enterprise applications, find the app by name, and note the application ID from the error. Expected: The app record opens and its sign-in log shows recent failed attempts with error 65001.

2. Open API permissions on the app registration and list any permission showing Not granted for [tenant]. Expected: You see the exact delegated or application permissions the app needs.

3. Have a privileged admin click Grant admin consent for [tenant] and confirm. Expected: The status column flips to Granted for every required permission.

4. Ask the user to sign out fully, close the browser, and sign in again to the app. Expected: Sign-in succeeds and the app loads its data without the 65001 error.

When to use

• AADSTS65001 appears for every user of one specific app
• A new SaaS app was just connected to Entra ID and nobody can sign in
• The app registration lists permissions with status Not granted

When not to use

• Only one user is affected (check that user's assignment instead)
• The error is AADSTS50011 reply URL mismatch (different fix)
• The app needs per-user consent and policy forbids admin consent

Why this happens

Entra ID never lets an app touch user data or directory APIs without recorded consent. If the app requests permissions after its first deployment, or was consented in a test tenant but not production, every sign-in fails with 65001 until an admin records org-wide consent.

Edge cases

• Some apps need a user to accept a consent screen themselves; admin consent does not cover those interactive flows.
• If permissions were changed after consent, the grant must be repeated for the new permissions.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstKZd40WTfeY5ON9igUfAcA

Resolved from the public thread: https://vectle.com/posts/pstKZd40WTfeY5ON9igUfAcA

Thread query: aadsts65001 the user or admin has not consented to use the application

TL;DR: The app works, but nobody has approved its requested permissions in your tenant yet. Have an admin open the app registration in Entra ID, review the API permissions, and click Grant admin consent. Then ask the user to sign in again in a fresh session.