KBY Technologies Logo
AADSTS53000

AADSTS53000: device not compliant

A Conditional Access policy requires a compliant device and the device signing in isn't marked compliant.

From Microsoft's documentation, checked 9 Nov 2026.

Microsoft Entra Conditional Access and Intune complianceDevice compliancehigh
Error text as Microsoft documents it
AADSTS53000: DeviceNotCompliant - Conditional Access policy requires a compliant device, and the device isn't compliant.

Also searched as: DeviceNotCompliant · 53000

What it means

The policy uses the Require device to be marked as compliant grant control. A device must be registered in Microsoft Entra ID and enrolled in Intune (or, for Windows, a supported non-Microsoft MDM) before it can be marked compliant. The control supports Windows 10 and later, iOS, Android, macOS and Linux Ubuntu.

Common causes

  • The device isn't enrolled in Intune or another approved MDM.
  • The device is enrolled but isn't marked compliant.
  • On Windows the user signed in with Microsoft Edge InPrivate, which counts as a noncompliant device.
  • The device platform isn't one the compliant-device control supports.
From Microsoft's documentation

How to fix it

1

Find the failing sign-in

In the Microsoft Entra admin center, go to Entra ID > Monitoring & health > Sign-in logs and filter by user, date and correlation ID. Or query the logs with Microsoft Graph PowerShell (needs AuditLog.Read.All); Microsoft recommends a time range so the request doesn't time out. The Device Info tab shows the device details used for the decision.

$since = (Get-Date).ToUniversalTime().AddDays(-7).ToString("yyyy-MM-ddTHH:mm:ssZ")
Get-MgAuditLogSignIn -Filter "status/errorCode eq 53000 and createdDateTime ge $since" -Top 10
2

Check registration and enrolment

Confirm the device is registered in Microsoft Entra ID and enrolled in Intune. Microsoft's guidance for this code is that the user must enrol the device with an approved MDM provider such as Intune.

3

Check the browser

In a browser, the user has to select the device certificate when prompted. On Windows, Edge InPrivate is treated as noncompliant.

How to confirm it's fixed

  • Once the device is marked compliant, sign in again; the event's Conditional Access tab shows the policy as Success.
Copyable operational controls

Related engineering templates

Conditional Access Deployment Checklist
The KBY Brief

Follow Microsoft Entra ID failures and fixes

A short email about twice a week with new runbooks, configuration traps and fixes from KBY Technologies.