Microsoft 365 Admin Decoder Fast answers for working admins
AADSTS50034

User account does not exist in the directory

Answer: Microsoft Entra ID could not find the submitted user account in the tenant used by the sign-in request.
Resolution playbook

Fix it, then prove it

Use the error record as the starting point; use tenant evidence to confirm the actual cause.

1

Likely causes

  • This commonly appears when an application sends the user to the wrong tenant or the entered sign-in name belongs to a different directory.
  • Conditional Access, MFA, identity risk, session, tenant routing, or account state changed the authentication decision.
  • The sign-in used a different application, resource, device, location, or authentication flow than the working comparison.
2

Recommended fix

  1. Confirm the user principal name and tenant are correct.
  2. Check whether the account exists as a member or guest in the target tenant.
  3. For guest access, verify the invitation was redeemed with the expected identity.
3

Verify

  1. Repeat the sign-in using the intended tenant and supported interactive or non-interactive flow.
  2. In Entra sign-in logs, confirm the new event succeeds and review Authentication Details and Conditional Access tabs.
  3. If a policy was changed, confirm the expected policy result using report-only or What If before broad rollout.
4

Escalate when

  • The failure persists after the documented prerequisites and a new authentication/session attempt.
  • Multiple users, apps, devices, or networks show the same error, suggesting tenant policy or service scope.
  • You can provide the exact UTC time, tenant, application/resource, correlation or request ID, and sanitized logs.
Capture the support evidence
Error code: AADSTS50034
UTC timestamp: <yyyy-mm-dd hh:mm:ssZ>
Correlation ID: <guid>
Tenant ID: <guid>
Application / resource: <name>

Template only. Fill it from the failed sign-in and keep user identifiers out of public tickets.

Admin context

This commonly appears when an application sends the user to the wrong tenant or the entered sign-in name belongs to a different directory.

Evidence to preserve

  • UTC timestamp and correlation/request ID
  • Tenant, application, resource, and authentication flow
  • Sanitized service log details and exact operation
Advertisement