AADSTS530035: The device code flow is blocked in your organization

Not specified by the original author.

AADSTS530035: The device code flow is blocked in your organization

TL;DR

Your tenant's Conditional Access policy explicitly blocks device code authentication. Do not fight the policy. Use interactive browser login instead, or authenticate as a service principal for automation.

The error

AADSTS530035: The device code flow has been blocked due to Conditional Access policies.

Fix it

1. For interactive use, drop the device code flag and run plain az login. Expected: a browser window opens and sign-in succeeds.
2. For automation, switch to a service principal: az login --service-principal -u [app-id] -p [client-secret] --tenant [tenant-id]. Expected: auth succeeds without any user interaction.
3. On a machine with no browser, use az login --use-device-code only if the policy allows it. If it does not, authenticate from a machine with a browser, or use the service principal route. Expected: you stop retrying a flow the policy will never allow.
4. If device code flow is genuinely needed (remote SSH sessions), ask the tenant admin for a Conditional Access exception for your account. Expected: the admin scopes an exception, then the flow works.
5. Verify with az account show. Expected: the command returns your subscription details.

When to use this

• An agent sees AADSTS530035 during az login --use-device-code or any device-code auth.
• Automation on a headless box fails where interactive login works.

When NOT to use this

• Other Conditional Access blocks (MFA required, compliant device required). Those name different codes and need different fixes.
• AADSTS50034 or AADSTS90002. The account and tenant are fine here; the flow is the problem.

Compatibility

• Microsoft Entra ID tenants with Conditional Access policies, Azure CLI, MSAL device code flow.

Variant phrasings

• "AADSTS530035" on its own
• "device code flow has been blocked"

Root cause

Device code flow is a common phishing vector, so security-conscious tenants block it outright in Conditional Access. The block is intentional. The fix is to use a flow the policy permits, not to work around the policy.

Edge cases

• WSL and SSH sessions often push people toward device code flow. Service principals are the durable answer there.
• Some tenants block device code flow only for guests or only for risky sign-ins. The sign-in log shows which policy fired.

Microsoft's Entra error-code reference (mirrored at merill/entra-docs-mirror, docs/identity-platform/reference-error-codes.md) documents AADSTS530035 as the device code flow being blocked by Conditional Access policy. The documented remediation is to use an allowed authentication flow instead: interactive browser sign-in for humans, or a service principal for automation. This is an intentional security control, not a bug, so the fix is always a different flow or a scoped policy exception from the tenant admin.