AADSTS90072: external account doesn't exist in the tenant
The external account the user signed in with doesn't exist in the tenant, so the user can't satisfy that tenant's MFA requirements.
From Microsoft's documentation, checked 9 Nov 2026.
AADSTS90072: PassThroughUserMfaError - The external account that the user signs in with doesn't exist on the tenant that they signed into; so the user can't satisfy the MFA requirements for the tenant.Also searched as: PassThroughUserMfaError
What it means
The user's account isn't an external user in the tenant they signed in to. Microsoft's reference says the account must be added as an external user first, and that the error can also occur for synced users whose ImmutableID (sourceAnchor) differs between Active Directory and Microsoft Entra ID. Home-tenant sign-in logs show 90072 when the resource tenant returns AADSTS50020.
Common causes
- The external user hasn't been added to the tenant.
- A synced user's ImmutableID (sourceAnchor) doesn't match between Active Directory and Microsoft Entra ID.
How to fix it
Find the failing sign-in
In the Microsoft Entra admin center, go to Entra ID > Monitoring & health > Sign-in logs and filter by user, date and correlation ID. Or query the logs with Microsoft Graph PowerShell (needs AuditLog.Read.All); Microsoft recommends a time range so the request doesn't time out.
$since = (Get-Date).ToUniversalTime().AddDays(-7).ToString("yyyy-MM-ddTHH:mm:ssZ")
Get-MgAuditLogSignIn -Filter "status/errorCode eq 90072 and createdDateTime ge $since" -Top 10Check the guest account exists
Look for the user as a guest in the tenant they're signing in to. If they aren't there, invite them through B2B collaboration.
Check ImmutableID for synced users
For a synced user, compare the ImmutableID (sourceAnchor) in Active Directory with the value in Microsoft Entra ID.
How to confirm it's fixed
- The user signs out, signs in with the right account, and the sign-in succeeds.
Related notes
In the resource tenant the user sees AADSTS50020 for the same situation.
Related engineering templates
Follow Microsoft Entra ID failures and fixes
A short email about twice a week with new runbooks, configuration traps and fixes from KBY Technologies.