KBY Technologies Logo
AADSTS50020

AADSTS50020: user from another identity provider doesn't exist in the tenant

A user from another identity provider tried to sign in to a tenant where their account doesn't exist, typically a guest or multitenant sign-in problem.

From Microsoft's documentation, checked 9 Nov 2026.

Microsoft Entra B2B and app sign-in audienceExternal userswarning
Error text as Microsoft documents it
AADSTS50020: User account 'user@domain.com' from identity provider {IdentityProviderURL} does not exist in tenant {ResourceTenantName}.

Also searched as: UserUnauthorized

What it means

The resource tenant has no account for this user from this identity provider. Microsoft's troubleshooting article lists several causes, from a guest who was never invited to an app registered for a single tenant, the wrong sign-in endpoint, or a user signed in with a different account than the one invited.

Common causes

  • The guest user wasn't invited to the tenant.
  • The app registration only allows accounts from a single tenant.
  • A multitenant app signs users in through a tenant-specific endpoint instead of /organizations, /common or /consumers.
  • The user is signed in to the wrong tenant or with a different account from the one invited.
  • The enterprise application requires user assignment and the user isn't assigned.
  • A personal account used the resource owner password credentials flow.
  • A deleted guest's name was re-created in the home tenant.
From Microsoft's documentation

How to fix it

1

Find the failing sign-in

In the Microsoft Entra admin center, go to Entra ID > Monitoring & health > Sign-in logs and filter by user, date and correlation ID. Or query the logs with Microsoft Graph PowerShell (needs AuditLog.Read.All); Microsoft recommends a time range so the request doesn't time out.

$since = (Get-Date).ToUniversalTime().AddDays(-7).ToString("yyyy-MM-ddTHH:mm:ssZ")
Get-MgAuditLogSignIn -Filter "status/errorCode eq 50020 and createdDateTime ge $since" -Top 10
2

Compare the account and identity provider

Check the User account and Identity provider values in the error match the account that was invited. If not, have the user sign out and try again in a private browser session.

3

Check the guest, the app and the audience

Invite the guest if needed, check Assignment required on the enterprise application, and check signInAudience on the app registration. For a re-created home account, compare creation dates and reset the guest's redemption status.

$p = @('Id', 'UserPrincipalName', 'CreatedDateTime')
Get-MgUser -UserId <id or userPrincipalName> -Property $p | Select-Object $p

How to confirm it's fixed

  • The user signs in from a new private browser session with the invited account and the resource tenant's sign-in log shows success.
Copyable operational controls

Related engineering templates

Conditional Access Deployment Checklist
The KBY Brief

Follow Microsoft Entra ID failures and fixes

A short email about twice a week with new runbooks, configuration traps and fixes from KBY Technologies.