How to Fix “AADSTS50020” User Account from Identity Provider Error

The AADSTS50020 error occurs during Microsoft 365 or Azure portal sign-in when an account attempts to access a target tenant where it is neither registered as a native user nor invited as a B2B guest. This error typically surfaces as “User account from identity provider does not exist in tenant” during SharePoint access, Teams guest invites, or cross-tenant collaboration links. It indicates an identity boundary mismatch where the authentication token issued by your home identity provider is rejected by the destination tenant’s access controls.

Fast-Fix: The 45-Second Solution

The AADSTS50020 error occurs when signing into a resource using an account that is not registered as a native user or guest in that Microsoft Entra ID tenant. Risk Tier: Low (blocks resource access; local data remains safe). Primary Reset Step: Clear browser cache, use an InPrivate window, or ask the admin to re-issue a guest user invitation.

Diagnostic Snapshot

• Severity Tier: Moderate (blocks access to target tenant applications, SharePoint sites, and Teams channels).
• Data Safety Risk: Zero (local user files and home tenant data remain completely secure).
• Common Cause: Account identity mismatch, stale browser token cache, or signing in with a personal Microsoft account (MSA) instead of a business account.
• Admin Requirement: Tenant Administrator required only if a B2B guest invitation needs to be created, redeemed, or reset in Entra ID.

The System Break (What This Means)

Microsoft Entra ID enforces strict tenant boundary isolation. When you navigate to a shared document or tenant portal, the application sends your authentication request to a specific tenant ID endpoint. If your browser automatically presents an active token from a personal account or your home company account, and that account lacks a corresponding User Object in the target tenant’s directory, the authentication gate halts the session and throws error AADSTS50020.

Think of it like trying to use a keycard from Office Building A at the front door of Office Building B. Even though Building A verifies who you are, Building B’s security desk has no record of your name on its building roster. Until Building B issues you a visitor badge (a B2B Guest account), its door access system will turn you away every time you swipe.

Conflict Escalators

• Multiple Signed-In Profiles: Using a single browser profile for both personal Microsoft services and enterprise client tenants increases token contamination.
• Custom Vanity Domains and Aliases: Registering a work email address as a personal Microsoft Account (MSA) creates dual identity records under the same address, causing the sign-in prompt to route to the wrong identity provider.
• Direct-Link Sharing: Clicking deep links to SharePoint files sent via email without explicitly selecting “Switch Directory” or using an incognito profile.

Common Misdiagnoses

• Misdiagnosing as an Incorrect Password: Users frequently attempt password resets. However, AADSTS50020 is a directory membership failure, not a credential authentication error.
• Misdiagnosing as a Network or Firewall Block: Because access is denied, users assume an IP or VPN block exists. In reality, the network connection is established cleanly; the cloud directory service is deliberately rejecting the identity token.

Immediate Action Steps

Step 1: Force an InPrivate/Incognito Browser Session

1. Close all active browser tabs connected to Microsoft 365 or Azure portals.
2. Open a fresh InPrivate (Edge) or Incognito (Chrome) browser window.
3. Paste the target portal or document URL directly into the address bar.
4. When prompted, carefully type the exact work email address that received the guest access permission, avoiding auto-filled personal credentials.

Step 2: Clear Stale Browser Tokens and Identity Cache

1. In your primary web browser, open settings and clear browsing data for .microsoft.com, .microsoftonline.com, and .sharepoint.com.
2. Open Windows Credential Manager via the Start Menu.
3. Select Windows Credentials and expand entries under Generic Credentials.
4. Remove all entries starting with adal_ or MicrosoftOffice16_Data:.

Step 3: Verify Account Type (Personal vs. Work Account)

1. Navigate to https://myaccount.microsoft.com in an InPrivate window and sign in.
2. If prompted with “It looks like this email is used with more than one account from Microsoft,” select Work or school account.
3. If your work email was previously registered as a personal Microsoft account, remove the personal alias or ensure you consistently select the enterprise option during tenant authentication.

Hard-Stop Red Flags

• Guest Account Deleted: The target tenant administrator confirms that your guest user object was purged from Entra ID.
• Tenant Access Disabled: The sign-in response presents error AADSTS50057 (“User account is disabled”) alongside AADSTS50020.
• Cross-Tenant B2B Policy Block: Cross-Tenant Access Policies in Entra ID explicitly restrict outbound/inbound B2B collaboration between the two organizations.

What the IT Admin Will Check

• Entra ID B2B User Object: Search Entra ID > Users in the target tenant to confirm the guest account exists and that User type is set to Guest.
• Invitation Redemption State: Inspect the guest user profile for External user state. If it displays PendingAcceptance, click Resend invitation.
• App Registration Audience: For custom app developers, verify supportedDeviceFamilies and signInAudience in the Azure App Registration manifest to confirm multi-tenant support is enabled.

Resolution Complexity

• Complexity Level: Minor (User-side) to Moderate (Admin-side).
• Resolution Scope: User-level session clearing resolves 80% of occurrences instantly. B2B guest re-invitation or Entra ID tenant policy adjustment required if directory objects are missing or corrupt.

Ticket Closed

When sign-in fails with error AADSTS50020, clearing browser session caches or using an InPrivate window resolves identity switching conflicts in most cases. If the error persists in a clean session, the destination tenant administrator must verify that a B2B Guest user record exists in Entra ID and re-issue the invitation link.