AADSTS53003: blocked by Conditional Access
A Conditional Access policy blocked token issuance for this sign-in. The sign-in log records which policy applied and why.
From Microsoft's documentation, checked 9 Nov 2026.
AADSTS53003: BlockedByConditionalAccess - Access has been blocked by Conditional Access policies. The access policy does not allow token issuance.Also searched as: BlockedByConditionalAccess · 53003
What it means
Entra ID evaluated the Conditional Access policies that apply to this user, app and sign-in conditions, and the result doesn't allow a token to be issued. If the block is unexpected, the sign-in event's Conditional Access tab shows the policy or policies that caused it, with the details used for the decision.
Common causes
- A policy with Block access applies to the user, app and conditions of this sign-in.
- A policy applies more broadly than intended; Microsoft warns that Block access for all users and all resources blocks the whole organisation.
How to fix it
Find the failing sign-in
In the Microsoft Entra admin center, go to Entra ID > Monitoring & health > Sign-in logs and filter by user, date and correlation ID. Or query the logs with Microsoft Graph PowerShell (needs AuditLog.Read.All); Microsoft recommends a time range so the request doesn't time out. Filtering on Conditional Access failures narrows the list.
$since = (Get-Date).ToUniversalTime().AddDays(-7).ToString("yyyy-MM-ddTHH:mm:ssZ")
Get-MgAuditLogSignIn -Filter "status/errorCode eq 53003 and createdDateTime ge $since" -Top 10Open the Conditional Access tab
Select the event and open the Conditional Access tab to see which policies applied. The Troubleshooting and support tab can give the reason; select a policy name to open its configuration.
Work out why the policy applied
Use the sign-in diagnostic (Basic info > Troubleshoot Event) or the What If tool with the same user, app and conditions, then change the policy or its exclusions.
How to confirm it's fixed
- Sign in again and check the new event's Conditional Access tab shows the result you intended.
- If you've locked yourself out, ask another administrator who isn't blocked to disable the policy, or open a support request with Microsoft.
Related engineering templates
Follow Microsoft Entra ID failures and fixes
A short email about twice a week with new runbooks, configuration traps and fixes from KBY Technologies.