Skip to content
errata/docs

AADSTS50076

MFA required due to Conditional Access policy

Product
Microsoft Entra ID
Severity
Severity: medium
Updated
Read
3 min

A token request was blocked because the user must complete multi-factor authentication. Common with legacy clients and non-interactive service flows.

Error message
AADSTS50076: Due to a configuration change made by your administrator, or because you moved to a new location, you must use multi-factor authentication.

Symptoms

  • Scripts using ROPC or basic auth begin failing overnight.
  • Sign-in logs show "Failure reason: Strong Authentication is required."
  • Interactive users are prompted repeatedly from a new network.

Cause

  • A new Conditional Access policy targets all cloud apps.
  • The client uses a grant flow that cannot satisfy MFA (ROPC, legacy auth).
  • The request originates outside a configured named location.

Resolution

  1. Step 1: Identify the policy in sign-in logs

    Open the failed sign-in, select the Conditional Access tab, and note which policy reported "Failure".

  2. Step 2: Move automation to a workload identity

    Replace user credentials in scripts with a service principal using a certificate or managed identity. These are not subject to user MFA.

    bash
    az login --service-principal \
  --username $APP_ID \
  --tenant $TENANT_ID \
  --certificate ./sp-cert.pem

  3. Step 3: Scope the policy exclusion carefully

    If an exclusion is unavoidable, exclude a dedicated group combined with a trusted named location — never exclude all service accounts globally.

← Back to index