What does AADSTS50076 mean?

The sign-in needs multifactor authentication — usually because of a Conditional Access policy or a change in location — but the request did not include MFA and the client did not complete an MFA prompt.

Should I exclude the user from MFA to fix AADSTS50076?

No. Fix the client or authentication flow instead — use modern, interactive sign-in for users and certificate-based app-only authentication or managed identities for scripts and services.

AADSTS50076: why MFA blocks sign-in and how to fix it

Error / symptom

A user, app or script fails to sign in with:

AADSTS50076: Due to a configuration change made by your administrator, or because you moved to a new location, you must use multi-factor authentication to access '<resource>'.

You often see it in scripts, older Office clients, third-party apps, or sync tools — anything that tries to sign in without being able to show an MFA prompt.

Cause

The sign-in requires MFA, but the request did not satisfy it. Common reasons:

Cause	Typical example
A Conditional Access policy requires MFA	New “Require MFA for all users” policy was switched on
The client uses a non-interactive or legacy flow	A script signing in with username + password (ROPC), an old mail client using basic auth
The user moved to a location not trusted by policy	Policy excludes named locations; user is now outside them
Token issued before the policy changed	Refresh token reused after a policy change forces re-evaluation

Fix

Find the exact sign-in. In the Entra admin center open Sign-in logs, filter by the user and Status: Failure, and open the event with error code 50076.
Check the Conditional Access tab to see which policy required MFA, and the Basic info tab for the client app and authentication flow used.
Fix the client, not the policy:
- Users: sign in with a modern client (current Outlook, Teams, browser) that can show the MFA prompt. Ask them to sign out and back in after a policy change.
- Scripts and automation: stop using username + password. Use app-only authentication with a certificate, or a managed identity when running in Azure.
- Legacy protocols (POP, IMAP, SMTP AUTH, ActiveSync basic auth): move the app to modern authentication. These can’t do MFA.
Only if a service account truly can’t change yet, scope a temporary, documented exception (named group, owner, expiry date) — and plan its removal.

PowerShell check

Find recent 50076 failures with Microsoft Graph PowerShell (needs AuditLog.Read.All and Entra ID P1/P2 for sign-in logs):

Connect-MgGraph -Scopes 'AuditLog.Read.All' -NoWelcome

Get-MgAuditLogSignIn -Filter "status/errorCode eq 50076" -Top 50 |
  Select-Object CreatedDateTime, UserPrincipalName, AppDisplayName, ClientAppUsed, IPAddress,
    @{ n = 'CAStatus'; e = { $_.ConditionalAccessStatus } } |
  Format-Table -AutoSize

Look for patterns: the same app or ClientAppUsed value across many users usually points to one client that needs updating.

AADSTS50079 — the user must register for MFA first.
AADSTS50074 — strong authentication is required and the user must complete it interactively.

Don’t

Don’t disable MFA or exclude users “until it works”. That swaps a support ticket for a security incident.
Don’t fix it by adding the user’s current IP to a trusted location unless that location is genuinely trusted.

Weekly · 5-minute read

The Identity Brief

Identity & Microsoft 365 changes that need action, one SOP, one script — every week. Verified against official Microsoft sources.

No spam. Unsubscribe anytime. Privacy