azure ad saml error aadsts50105 user not assigned

Fix AADSTS50105 - user is not assigned to the SAML app in Entra

TL;DR

AADSTS50105 means exactly what it says: the user has no assignment to the application in Microsoft Entra ID, and the app requires assignment before it issues tokens. Assign the user (or their group) to the enterprise app and have them retry. This is the most common Entra SAML login error, and it is always an assignment problem.

The error

AADSTS50105: Your administrator has configured the application [app name]
to block users unless they are specifically granted ('assigned') access to the application.

Use this skill

Agent? Search Vectle for this error:

curl -s "https://vectle.com/api/v1/search?q=azure%20ad%20saml%20error%20aadsts50105%20user%20not%20assigned"

Fix it

Step 1: Confirm the user is missing from the assignment list

In Entra admin center, open Identity / Applications / Enterprise applications / [app] / Users and groups. Search for the user.

Expected: the user is not listed, either directly or through a group. That absence is the entire diagnosis.

Step 2: Assign the user or their group

Choose Add user/group, select the user (or the group they belong to), and save the assignment.

Expected: the assignment appears in the list. Prefer group assignment so future users get access automatically.

Step 3: Decide whether assignment should be required at all

In the app's Properties, check "Assignment required?". If the app should be open to everyone in the tenant, set it to No. Otherwise leave it Yes and manage access via assignments.

Expected: a deliberate choice that matches policy. Flipping it to No is the fast fix but grants access tenant-wide.

Step 4: Wait for propagation, then retry

Wait one to two minutes for the assignment to propagate, then have the user retry the SAML login.

Expected: AADSTS50105 is gone and login completes. If it persists past a few minutes, continue to step 5.

Step 5: Check conditional access if it still fails

In Entra sign-in logs, find the user's failed sign-in and check whether a conditional access policy blocked it after assignment was granted.

Expected: either a clean success or a named policy to adjust. Assignment fixed the 50105; anything remaining is a different gate.

When this applies

• The login error is exactly AADSTS50105
• The user authenticates fine but gets blocked at the app
• New hires or guests hit it while existing users log in fine

When it doesn't

• The error is a different AADSTS code (each code is its own issue)
• The user cannot authenticate at all (credential or MFA problem)
• Assignment exists but login still fails (check conditional access)

Compatibility

Microsoft Entra ID SAML single sign-on, enterprise applications. Same mechanics for OIDC apps showing the assignment error.

Variant phrasings

aadsts50105 the user is not assigned to a role for the application

Same error, longer message. The fix is the assignment, not a role definition.

entra user not assigned to enterprise app

Check group nesting: Entra resolves nested groups with limits, so deeply nested membership can silently fail.

Why it happens

Entra enforces app assignment at token issuance time. When "Assignment required?" is Yes, the token service checks the assignment list before minting any token - SAML or otherwise. No assignment means no token, regardless of valid credentials or a perfect SAML configuration. The gate is working as configured.

Edge cases

• Group assignment propagation can take several minutes; retry too fast and it looks unfixed
• B2B guest users always need explicit assignment; they never inherit it
• Nested group membership has resolution limits; assign the direct group when in doubt

If it still fails

• Capture the exact timestamp, the username, and the full error from the system log before changing anything else.
• Reproduce with a single test user so you are not debugging a crowd.
• If it worked before, diff the config against the last known good, then open a vendor ticket with the timestamp and request id. Never send secrets or private keys.

Prevention

• Track credential and certificate expiry with alerts, not memory.
• Run a synthetic check per app daily so breakage pages you, not a user.
• Document mappings, URLs, and runbook steps where the next admin will find them.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstu-ZKBvcpArsPIXdWRrf5g