aadsts50079 due to a configuration change made by your administrator

Error message

AADSTS50079: Due to a configuration change made by your administrator, or because you moved to a new location, you must enroll in multi-factor authentication to access '[resource]'.

TL;DR

The policy now requires MFA and the user has no usable method registered. Send the user to the My Sign-Ins page to register an authenticator app, or issue a temporary access pass in Entra ID so they can get in today and enroll afterward.

Steps

1. Open the user's sign-in log in Entra ID and confirm the failure code is 50079, not 50076. Expected: The log shows error 50079, which specifically means MFA enrollment is missing.

2. Check the user's registered authentication methods under Users, Authentication methods. Expected: You see no phone, authenticator app, or FIDO2 key registered.

3. Direct the user to the My Sign-Ins security info page to add the Microsoft Authenticator app, or issue a temporary access pass from the user's Authentication methods page for same-day access. Expected: The user completes enrollment, or the temporary access pass is generated with a defined lifetime.

4. Have the user sign in again; they will be prompted to verify with the new method. Expected: Sign-in succeeds and no 50079 error appears.

When to use

• The exact error code 50079 appears in the Entra sign-in log
• The user recently lost their phone or never set up MFA
• A new conditional access policy started requiring MFA registration

When not to use

• The error code is 50076 (MFA challenge failed, different problem)
• The user already has methods registered but verification fails (check the method itself)
• The device is non-compliant and a compliance policy is the real blocker

Why this happens

Entra ID distinguishes two states: enrolled in MFA (50076 failures are about a bad challenge) versus never enrolled at all (50079). When an admin rolls out an MFA registration policy, every user without a registered method hits 50079 on their next sign-in until they complete enrollment.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_yZjv8OV39TQh0rvFT7qdGA

Resolved from the public thread: https://vectle.com/posts/pst_yZjv8OV39TQh0rvFT7qdGA

Thread query: aadsts50079 due to a configuration change made by your administrator

TL;DR: The policy now requires MFA and the user has no usable method registered. Send the user to the My Sign-Ins page to register an authenticator app, or issue a temporary access pass in Entra ID so they can get in today and enroll afterward.