Request a trial
Menu
Products
Solutions
ERP
Authentication
Apps
LearnDocsWhy SSOGENRequest a trial

SSOGEN / Free tools / AADSTS50105: User Not Assigned to a Role for the App

Free tool

AADSTS50105: User Not Assigned to a Role for the App

AADSTS50105 means the enterprise application has Assignment required set to Yes and the person who signed in has no assignment to it. Paste the error text below to read it, then assign the user or a group in Microsoft Entra, or change the setting.

Try it on your systems

Read the error text

Paste the message from the sign-in page, the error_description in a redirect, or a line from the sign-in log.

The reader extracts the code, Trace ID, Correlation ID, timestamp, accounts and the IDs the message names, then lists what to check. It also handles the other AADSTS codes on its short list.

The message from the sign-in page, the error_description in a redirect, or a line from the sign-in log. It starts with AADSTS and a number.

Private by design. Reading happens in this page and nothing is sent anywhere. The text can hold email addresses, tenant names and IDs: use a copy you are allowed to look at. Real messages vary in wording; the samples are shortened.

Free, in your browser. No sign-up, no limit, and the page sends nothing. Error text can contain email addresses, tenant names and IDs, so paste a copy you are allowed to share. The samples use acme.example, a reserved example domain.

The reader never reads your tenant, so it cannot tell whether the application has the setting on. The steps below complete the diagnosis.

What AADSTS50105 is

AADSTS50105 is what Microsoft Entra ID returns when an enterprise application requires assignment and the user signing in is not assigned.

Authentication succeeded, so the credentials were valid. Entra then checked the application’s list of assigned users and groups and found no entry for the user.

There are two fixes:

  • Give the user an assignment, directly or through a group the user belongs to.
  • Turn the requirement off, if everyone in the tenant should have the app.

What the error says

  • The message. Microsoft’s troubleshooting article gives it as: “Error AADSTS50105 - The signed in user is not assigned to a role for the application.”
  • The name. Microsoft’s error-code list names it EntitlementGrantsNotFound: the signed-in user must be assigned to the app (both read 2026-10-11).
  • The cause. The service principal has Assignment required? set to Yes, and the requesting user has no app role assignment to the application.
  • The reach. Microsoft says the check can apply to apps that use SAML, OpenID Connect, OAuth 2.0, WS-Federation or Application Proxy preauthentication.

Causes, ranked

This order is our judgment of how tenants are usually configured, not a count from Microsoft. Start at the top.

Rank Cause How to check it
1 The user was never assigned to the application, and Assignment required? is Yes Enterprise app, Users and groups: is the user, or a group holding them, in the list?
2 The user is only in a group that is nested inside the assigned group Microsoft says nested group memberships are not supported for group-based assignment. Check whether the user is a direct member of the assigned group.
3 The user has been added to a group, but the group was never assigned to the application Compare the group on the Users and groups list with the group the person joined.
4 The sign-in went to the wrong application or the wrong tenant The message names the application. Confirm it is the one you configured, in the tenant you expect.
5 The assignment was just made or removed Look at Users and groups again, then ask the person to sign in again with a fresh session.
6 You tested with an administrator account Microsoft says the assignment requirement does not apply to Global Administrators, so a test with that account passes while the real user still fails.

Rank 6 is the usual reason an administrator believes the error is fixed when it is not. Microsoft says to verify with the affected user, not a Global Administrator.

Direct, group and nested assignment

Microsoft’s article lists two ways to satisfy the requirement: assign the user to the application directly, or assign a group the user is a direct member of.

How the person is connected Satisfies the requirement? Source note
Assigned directly to the application Yes Microsoft’s troubleshooting article
Direct member of a group assigned to the application Yes Same article
Member of a group that is nested in an assigned group Do not rely on it Microsoft says assignment does not cascade to nested groups and that nested membership is not currently supported
Assigned to Default Access where the app has no named role Yes, for the requirement Microsoft says it adds no roles claim to the token

Group-based assignment requires a Microsoft Entra ID P1 or P2 license, according to Microsoft’s assign-users page. Without that license, assign users individually.

Assignment is not the same as an app role

Two different things share the word role:

  • An app role is a named permission the application defines, such as an Analyst role. The app reads it from the roles claim.
  • An assignment links a user or group to the enterprise application. When you assign a user, you pick a role. If the app exposes none, the assignment uses Default Access, whose ID is the all-zero GUID (00000000-0000-0000-0000-000000000000) in Microsoft’s PowerShell notes.

AADSTS50105 does not mean the user lacks a permission inside the app. It means the user has no assignment at all, and Entra enforces that before it issues any token.

If the assignment is correct and the app still denies access, the problem is in the app’s own role handling, not in Entra.

Fix it in the Entra admin center

You need an account that can update the enterprise application: Cloud Application Administrator, Application Administrator, or an owner of the application’s service principal. These are the steps from Microsoft’s troubleshooting page (read 2026-10-11).

First, check the setting.

  1. Sign in to the Microsoft Entra admin center.
  2. Browse to Microsoft Entra ID, then Enterprise apps, then All applications. (Microsoft’s other pages show the first item as Entra ID.)
  3. Select the application, then Properties.
  4. Read Assignment required?.

If only selected users should have access, assign them.

  1. In the enterprise application, select Users and groups, then Add user/group.
  2. On the Add Assignment pane, select None Selected under Users and groups, pick the user or group and select Select.
  3. Under Select a role, pick a role, or Default Access if none is defined.
  4. Select Assign.

If everyone in the tenant should have access, switch the requirement off.

  1. On Properties, set Assignment required? to No.
  2. Select Save.

Microsoft warns that this lets unassigned users get tokens for the application. Conditional Access policies and the app’s own authorization still apply.

Then test with the affected user. Microsoft also notes that when an application requires assignment, user consent is not allowed, so the app needs tenant-wide admin consent.

Why the check exists

  • The default. Microsoft says an application registered in a tenant is open to all users of the tenant who sign in successfully.
  • The requirement. Requiring assignment reverses that: users and services must be assigned, or they cannot sign in or get an access token.
  • The use. A tenant uses it to keep a payroll or finance app away from employees who do not need it.
  • Without it. Microsoft says unassigned users do not see the app in My Apps but can still sign in to it directly.

The error is Entra enforcing the list you set. Loosening it is a policy decision, not a repair.

Where this meets SSOGEN

SSOGEN can use Microsoft Entra ID as an upstream identity provider over SAML or OpenID Connect. Our Entra ID guide covers both routes:

  • On the SAML route, the users who may sign in are the users and groups assigned to the enterprise application. An unassigned user gets an Entra error page before the request reaches SSOGEN.
  • On the OpenID Connect route, the assigned users may sign in when Assignment required is on.

AADSTS50105 during an Entra sign-in is therefore fixed in Entra, as above.

SSOGEN also keeps its own assignment for each application it protects. That list is separate from the one in Entra.

  • My Apps. A user sees an application in My Apps when they are assigned directly or through a group.
  • Test tab. It runs a dry run that shows whether a chosen user is assigned.

A redirect URI problem is a different error: see AADSTS50011. More tools are on the free tools page.

Questions people ask

What can I do to fix the error 'selected user does not exist in tenant' when trying to log in?
That wording matches AADSTS50020, not 50105. Microsoft says the account comes from an identity provider but does not exist in the tenant. Add the account to the tenant as an external user, invite them through B2B if they should be a member, or sign in with a different Entra account.
How do I unblock my Azure AD account?
AADSTS50105 is not a block. If you are locked out, an administrator with at least the Password Administrator role can reset the password: Entra ID, Users, select the user, Reset password. Microsoft says this works only where your tenant is the user’s home directory, not for external or Microsoft accounts.
What does Microsoft error 50012 mean and how can I fix it?
AADSTS50012 is AuthenticationFailed. Microsoft lists reasons such as a signing certificate whose subject name or thumbprint is not authorized, an invalid certificate chain, a missing tenant policy, or a client assertion with an invalid signature. Fix the one your message points to, starting with the certificate.
What does the Teams error code AADSTS50020 mean?
AADSTS50020 is UserUnauthorized. Microsoft says the user’s account from the identity provider does not exist in the tenant and cannot access the application there. Add it as an external user first, or sign out and sign in with a different Entra account. Members of the tenant should be invited through B2B.
Does a user in a nested group get access?
Do not count on it. Microsoft says assigning a group gives access to users in that group and does not cascade to nested groups, and that nested group membership is not currently supported for group-based assignment. Make the user a direct member of the assigned group, or assign the user directly.

Where to go next

Sources, all read 2026-10-11: Microsoft Learn, Error AADSTS50105, Microsoft Entra authentication and authorization error codes, Manage users and groups assignment to an application, Restrict a Microsoft Entra app to a set of users, Manage access to apps and Reset a user’s password. SSOGEN statements come from our own documentation. Microsoft and Entra are trademarks of their owner; SSOGEN is not affiliated with Microsoft.