AADSTS50158: external security challenge not satisfied
The user was sent to satisfy an extra requirement, such as terms of use or a third-party MFA provider. On its own this code isn't a failure.
From Microsoft's documentation, checked 9 Nov 2026.
AADSTS50158: External security challenge not satisfied. User will be redirected to another page or authentication provider to satisfy additional authentication challenges.Also searched as: external security challenge
What it means
The user must meet more requirements before authentication finishes and was redirected to another page, such as terms of use or a third-party MFA provider. Microsoft notes this code alone doesn't mean the user failed to sign in; the sign-in logs may show whether the challenge was then passed or failed.
Common causes
- The user must accept terms of use.
- The user is redirected to a third-party MFA provider.
How to fix it
Find the failing sign-in
In the Microsoft Entra admin center, go to Entra ID > Monitoring & health > Sign-in logs and filter by user, date and correlation ID. Or query the logs with Microsoft Graph PowerShell (needs AuditLog.Read.All); Microsoft recommends a time range so the request doesn't time out.
$since = (Get-Date).ToUniversalTime().AddDays(-7).ToString("yyyy-MM-ddTHH:mm:ssZ")
Get-MgAuditLogSignIn -Filter "status/errorCode eq 50158 and createdDateTime ge $since" -Top 10Follow the rest of the sign-in
Filter the sign-in logs by the event's correlation ID to see whether the challenge that followed passed or failed.
Find the requirement
In the Conditional Access tab, check which policy applied a terms of use or custom control requirement.
How to confirm it's fixed
- A later event with the same correlation ID shows success.
Related engineering templates
Follow Microsoft Entra ID failures and fixes
A short email about twice a week with new runbooks, configuration traps and fixes from KBY Technologies.