AADSTS50057
User account is disabled
Answer: The submitted account exists but is disabled in Microsoft Entra ID.
Resolution playbook
Fix it, then prove it
Use the error record as the starting point; use tenant evidence to confirm the actual cause.
Likely causes
- Enabling an account is a security decision; validate ownership and intended access first.
- Conditional Access, MFA, identity risk, session, tenant routing, or account state changed the authentication decision.
- The sign-in used a different application, resource, device, location, or authentication flow than the working comparison.
Recommended fix
- Confirm whether the account was intentionally disabled.
- Review identity lifecycle, HR, and security actions before enabling it.
- Check synchronization status if the source account is on-premises.
Verify
- Repeat the sign-in using the intended tenant and supported interactive or non-interactive flow.
- In Entra sign-in logs, confirm the new event succeeds and review Authentication Details and Conditional Access tabs.
- If a policy was changed, confirm the expected policy result using report-only or What If before broad rollout.
Escalate when
- The failure persists after the documented prerequisites and a new authentication/session attempt.
- Multiple users, apps, devices, or networks show the same error, suggesting tenant policy or service scope.
- You can provide the exact UTC time, tenant, application/resource, correlation or request ID, and sanitized logs.
Capture the support evidence
Error code: AADSTS50057
UTC timestamp: <yyyy-mm-dd hh:mm:ssZ>
Correlation ID: <guid>
Tenant ID: <guid>
Application / resource: <name>Template only. Fill it from the failed sign-in and keep user identifiers out of public tickets.
Admin context
Enabling an account is a security decision; validate ownership and intended access first.
Evidence to preserve
- UTC timestamp and correlation/request ID
- Tenant, application, resource, and authentication flow
- Sanitized service log details and exact operation
Advertisement