← cd ~/errors
// entra id sign-in errors
Conditional Access and devices errors
Sign-ins blocked by Conditional Access policies, device state or location. The fix is usually in a policy or on the device, not the user's password.
How to investigate
- Open the failed sign-in in the Entra admin center and select the Conditional Access tab. It lists every policy that applied and which one failed.
- Check the Device info tab: whether the device is registered, compliant and managed.
- Use What If in Conditional Access with the same user, app and device platform to reproduce the decision.
Common errors (9)
- AADSTS50097 DeviceAuthenticationRequired
- AADSTS50131 ConditionalAccessFailed
- AADSTS50155 DeviceAuthenticationFailed
- AADSTS53000 DeviceNotCompliant
- AADSTS53001 DeviceNotDomainJoined
- AADSTS53002 ApplicationUsedIsNotAnApprovedApp
- AADSTS53003 BlockedByConditionalAccess
- AADSTS53004 ProofUpBlockedDueToRisk
- AADSTS530032 BlockedByConditionalAccessOnSecurityPolicy