How to Fix AADSTS50105 Error in Microsoft Entra ID (Authorization Failure)

Microsoft Entra ID (formerly Azure Active Directory) is Microsoft’s cloud-based identity and access management service used to authenticate users and control access to applications, Microsoft 365 services, and enterprise resources. When a user attempts to sign in to an application protected by Microsoft Entra ID, administrators can restrict access using user assignments, groups, Conditional Access policies, and application permissions. If these requirements aren’t met, users may encounter the AADSTS50105 error, which indicates an authorization failure rather than an authentication problem.

The AADSTS50105 error typically appears with a message similar to “The signed in user is not assigned to a role for the application” or “The signed in user is not assigned to a role for the application that requires assignment.” This usually occurs because the user hasn’t been assigned to the enterprise application, belongs to the wrong group, lacks the required role, or is blocked by application assignment settings or Conditional Access policies.

Fortunately, administrators can usually resolve the issue by assigning the user or an appropriate group to the application, verifying role assignments, reviewing Conditional Access policies, and checking Microsoft Entra ID configuration. In this guide, we’ll walk you through the most effective methods to fix the AADSTS50105 Authorization Failure error in Microsoft Entra ID.

How to Fix AADSTS50105 Error in Microsoft Entra ID (Authorization Failure)

Before you begin, verify whether the issue affects only one user or multiple users. If several users receive the same error, the problem is likely related to the application’s configuration. If only one user is affected, review that user’s assignments and permissions first. Follow the methods below until the user can successfully access the application.

1. Verify That the User Is Assigned to the Application

The most common cause of AADSTS50105 is that the user hasn’t been assigned access.

1. Sign in to the Microsoft Entra admin center.
2. Navigate to Identity > Applications > Enterprise applications.
3. Select the affected application.
4. Open Users and groups.
5. Verify whether the user appears in the assignment list.
6. If not, click Add user/group.
7. Assign the appropriate user.
8. Save the changes.

Once assigned, ask the user to sign in again.

2. Check Group Membership

Many organizations assign applications through security groups instead of individual users.

1. Open the user’s profile in Microsoft Entra ID.
2. Review the user’s group memberships.
3. Verify that the required security group is assigned to the application.
4. Add the user to the correct group if necessary.
5. Wait for group membership to synchronize.

Group-based assignments simplify application management.

3. Verify Application Assignment Requirements

Enterprise applications can require explicit user assignment.

1. Open the affected enterprise application.
2. Select Properties.
3. Locate Assignment required?
4. Review its current setting.
5. If assignment is required, ensure all intended users are assigned.

If assignment isn’t necessary, administrators may choose to disable this requirement after evaluating security implications.

4. Confirm the Assigned Role

Some enterprise applications require users to have specific application roles.

1. Open Users and groups for the application.
2. Select the assigned user.
3. Verify the assigned role.
4. Assign the appropriate role if needed.
5. Save the changes.

An incorrect or missing application role can trigger the authorization failure.

5. Review Conditional Access Policies

Conditional Access policies may block authorized users under certain conditions.

1. Open the Microsoft Entra admin center.
2. Navigate to Protection > Conditional Access.
3. Review policies affecting the user.
4. Check conditions such as:
   • Device compliance
   • Location
   • Risk level
   • Authentication strength
5. Modify the policy if appropriate.

Ensure that the user satisfies all applicable policy requirements.

6. Check Licensing Requirements

Some enterprise applications require specific Microsoft licenses.

1. Open the user’s account.
2. Select Licenses.
3. Verify that the required licenses are assigned.
4. Assign missing licenses if necessary.
5. Allow time for license changes to propagate.

Missing licenses can prevent users from accessing certain applications.

7. Review Application Permissions

Incorrect application permissions may interfere with authorization.

1. Open the enterprise application.
2. Review its API permissions.
3. Verify that required permissions have been granted.
4. Grant admin consent if necessary.

Proper permissions are essential for successful authorization.

8. Force the User to Sign Out and Sign In Again

Recently applied changes may require a new authentication session.

1. Ask the user to sign out of Microsoft 365.
2. Close all browser windows.
3. Clear cached authentication data if necessary.
4. Sign in again.

A new session refreshes user assignments and access tokens.

9. Check Sign-in Logs

Microsoft Entra ID sign-in logs provide detailed error information.

1. Open the Microsoft Entra admin center.
2. Navigate to Monitoring & health > Sign-in logs.
3. Locate the failed sign-in.
4. Review:
   • Error codes
   • Failure reason
   • Conditional Access results
   • Application details

The logs often identify the exact cause of the authorization failure.

10. Wait for Directory Synchronization

If you’re using Microsoft Entra Connect, recent changes may not have synchronized yet.

1. Verify that directory synchronization completed successfully.
2. Wait for replication to finish.
3. Ask the user to try signing in again.

Assignment changes may take several minutes to propagate.

11. Verify B2B or Guest User Access

Guest users require proper assignments just like internal users.

1. Open the guest user’s profile.
2. Confirm that the invitation has been accepted.
3. Verify application assignments.
4. Check guest access policies.

Guest accounts that haven’t completed onboarding may receive authorization errors.

12. Review the Application Configuration

If all user assignments appear correct, review the application’s overall configuration.

Check:

• Supported account types
• Application registration
• Enterprise application settings
• Redirect URIs
• Assignment configuration
• Role definitions

Correcting application configuration issues can resolve persistent authorization failures.

Conclusion

The AADSTS50105 Authorization Failure error in Microsoft Entra ID usually occurs because the signed-in user hasn’t been assigned to the enterprise application, lacks the required application role, belongs to the wrong group, or is blocked by Conditional Access or licensing requirements. In most cases, assigning the appropriate user or group, verifying application roles, reviewing Conditional Access policies, and checking sign-in logs will resolve the issue.

If the error persists, verify directory synchronization, review guest user access, inspect application permissions, and confirm that the enterprise application’s configuration is correct. Regularly auditing user assignments, security groups, and application roles in Microsoft Entra ID will help prevent AADSTS50105 errors and ensure users can securely access the applications they need.