KBY Technologies Logo
AADSTS50076

AADSTS50076: multifactor authentication required

The user must complete multifactor authentication to reach the resource, because of a Conditional Access policy, per-user MFA or a new location.

From Microsoft's documentation, checked 9 Nov 2026.

Microsoft Entra ID multifactor authenticationAuthenticationwarning
Error text as Microsoft documents it
AADSTS50076: UserStrongAuthClientAuthNRequired - Due to a configuration change made by the admin such as a Conditional Access policy, per-user enforcement, or because you moved to a new location, the user must use multifactor authentication to access the resource.

Also searched as: UserStrongAuthClientAuthNRequired · MFA required

What it means

Entra ID needs an MFA claim for this resource and the current request doesn't have one. Microsoft's reference says the client should retry with a new authorize request for the resource, which gives the user the chance to complete MFA. On its own the code means MFA is required, not that the user failed it.

Common causes

  • A Conditional Access policy requires multifactor authentication.
  • Per-user MFA enforcement is on for the user.
  • The user moved to a new location.
From Microsoft's documentation

How to fix it

1

Find the failing sign-in

In the Microsoft Entra admin center, go to Entra ID > Monitoring & health > Sign-in logs and filter by user, date and correlation ID. Or query the logs with Microsoft Graph PowerShell (needs AuditLog.Read.All); Microsoft recommends a time range so the request doesn't time out.

$since = (Get-Date).ToUniversalTime().AddDays(-7).ToString("yyyy-MM-ddTHH:mm:ssZ")
Get-MgAuditLogSignIn -Filter "status/errorCode eq 50076 and createdDateTime ge $since" -Top 10
2

See what required MFA

In the event's Conditional Access tab, check whether a policy with Require multifactor authentication applied, and the Authentication Details tab for what the user completed.

3

Retry with a new authorize request

Have the app send a new authorize request for the resource so the user can complete MFA, as Microsoft's reference advises.

How to confirm it's fixed

  • The next sign-in event for the user and app shows success.

Related notes

AADSTS50079 is the related code when the user first has to register security information for MFA.

Copyable operational controls

Related engineering templates

Conditional Access Deployment Checklist
The KBY Brief

Follow Microsoft Entra ID failures and fixes

A short email about twice a week with new runbooks, configuration traps and fixes from KBY Technologies.