Table of Contents

Admin Consent Troubleshooting

While ordinarily the Admin Consent process goes smoothly, something there can be an error shown by Microsoft infrastructure. This page is a reference guide intended to assist with errors you might be having.

AADSTS50097

Device authentication is required

This error occurs when Microsoft Entra ID requires the sign-in to come from a device that satisfies a conditional access policy, such as device registration or compliance status.

The AADSTS50097 error usually means:

  • The tenant enforces a conditional access policy that requires a managed or compliant device.
  • The device used for the consent action isn't registered or joined to Microsoft Entra ID.

  1. Sign In From a Compliant Device Use a device that is registered, Microsoft Entra joined, or managed by Intune and meets the tenant's compliance requirements.

  2. Confirm the Applicable Conditional Access Policy Check with your Microsoft Entra ID administrator to confirm which conditional access policies apply to your account and what device requirements they enforce.

  3. Register the Device If prompted, complete Microsoft Entra ID device registration or join before retrying the consent action.

AADSTS90092

Non-retryable error has occurred.

This is a generic, non-retryable failure returned by Microsoft Entra ID. It indicates the request itself cannot succeed as submitted, so retrying without changes doesn't resolve it.

The AADSTS90092 error usually means:

  • The application or consent request contains a configuration issue that Microsoft Entra ID can't process.
  • The service principal, permissions, or tenant configuration involved in the request is invalid or incomplete.

Recommended Steps

  • Collect the correlation ID and timestamp from the error and Contact Altus support for further investigation.

AADSTS90204

A transient error has occurred. Please try again.

This is a transient, temporary error returned by Microsoft's authentication service. It doesn't indicate a problem with your configuration and typically clears after a short wait.

The AADSTS90204 error usually means:

  • Microsoft Entra ID experienced a temporary service disruption while processing the request.
  • The condition is expected to clear on its own without any configuration changes.

Recommended Steps

  1. Wait and Retry Wait a few minutes and try the consent action again. Transient errors typically clear quickly.

  2. Check Microsoft 365 Service Health Review the Microsoft 365 Service Health dashboard or Azure status page for any reported incidents affecting Microsoft Entra ID.

  3. Escalate if the Error Persists If the error continues after multiple retries and no reported outage, contact support and provide the correlation ID and timestamp from the error and Contact Altus support

AADSTS500200

This error indicates the account used to sign in is a personal Microsoft account, such as an outlook.com or hotmail.com account, rather than a work or school account that belongs to an organization's Microsoft Entra ID tenant.

The AADSTS500200 error usually means:

  • The sign-in used a personal Microsoft account instead of an organizational account.
  • The application requires an account that belongs to a Microsoft Entra ID tenant, unless explicitly invited as a guest.

Recommended Steps

  1. Sign Out and Sign In with an Organizational Account Sign out completely, then sign back in using your work or school account.

  2. Confirm the Correct Account is Selected If multiple accounts are cached in the browser, use an incognito or private window to ensure the intended organizational account is used.

  3. Request an Invitation if Using an External Account If you need to use a personal account, ask your administrator to invite the account to the organization as a guest before retrying.

AADSTS650051

AADSTS650051: Consent action for Application '<Application_ID>' failed due to following error: The <Application_ID> service principal name is already present for the tenant <Tenant_ID>.

This error typically indicates that Entra believes a service principal (Enterprise Application) for the app already exists in the tenant.

The AADSTS650051 error usually means:

  • Microsoft Entra ID has detected that a service principal with the same Application ID already exists.
  • In many cases, this detection is a false positive, often caused by incomplete propagation or a temporary conflict within the tenant’s directory metadata.

Recommended Steps

  1. Try the Consent Action Again In most cases, simply retrying the consent resolves the issue. Propagation delays or transient directory conditions often cause temporary conflicts that disappear on retry.

  2. Try the Consent Action Again in an Incognito Browser Try the same process again in an incognito browser. The issue sometimes happens if there are multiple accounts available to sign in. By using an incognito window, the account you want to use has to be entered.

Errors not listed above

If the error you are encountering is not listed above please try:

Edit this page