Entra ID & Identity
AADSTS50020: which tenant the account is in, and how to fix it
8 min


AADSTS error codes grouped by what actually caused them, with the first sign-in log check for each group and the codes that are not failures at all.

The Entra policy is on, the session policy says Block download, and the file still downloads. Where Conditional Access App Control breaks, and the check for each layer.





Microsoft says PIM creates the active assignment within seconds. The wait you are measuring is the access token you already hold, and in a CAE session that token can live for up to 28 hours.


The newsletter
Subscribe and get my 8-page PDF: 13 common Intune problems, the order to check them in, and the fix for each. Then Microsoft 365 fixes from the field, about twice a month. From G.R Badhon, Microsoft MVP.