AADSTS90072: Account Not in the Tenant, Free Error Reader

Paste the full error text into the box: the sign-in page message, the error_description in a redirect, or a line from the sign-in log.

The reader finds the code, Trace ID, Correlation ID and timestamp, and lists the accounts and IDs named in the message. It then prints the checks Microsoft’s reference gives for that code.

The Acme sample button loads a shortened AADSTS90072 message so you can see the output first.

Free, in your browser. There is no sign-up, and the page makes no network request when you read an error. It never reads your tenant.

Messages contain email addresses and tenant names, so paste only a copy you are allowed to share. The same reader covers AADSTS50020, AADSTS50105 and AADSTS700016. For other codes, it points to Microsoft’s list.

Microsoft’s sync pages define the terms. The sourceAnchor attribute “uniquely identifies an object as being the same object on-premises and in Microsoft Entra ID”. It is also called immutableId, and its value cannot change after the object is created.

By default the value is the Base64 form of the mS-DS-ConsistencyGuid attribute, or objectGUID depending on configuration. It becomes the ImmutableId in Entra ID.

When Entra Connect or Cloud Sync adds an object, Microsoft Entra ID tries to find an existing cloud object to join:

• A hard match compares the sourceAnchor with the ImmutableId of existing objects.
• A soft match compares the userPrincipalName or the primary SMTP address.
• Where neither matches, a new object is created.

When a soft match finds the same address but a different sourceAnchor, Microsoft says the attempt to create a new object normally ends in an AttributeValueMustBeUnique export error.

Microsoft’s fix for a user you are re-provisioning is to set the on-premises user’s mS-DS-ConsistencyGuid to the same value as the existing cloud user’s ImmutableId. The hard match then succeeds.

To read the cloud side, use Microsoft Graph PowerShell. Microsoft’s Get-MgUser page says properties not returned by default must be selected, and the cmdlet’s -Property parameter does that:

Connect-MgGraph -Scopes 'User.Read.All'
Get-MgUser -UserId '<object-id>' -Property Id,UserPrincipalName,OnPremisesImmutableId |
  Format-List Id, UserPrincipalName, OnPremisesImmutableId

Compare the result with the Base64 value of the on-premises attribute.

A blog post on a tenant migration (read 2026-10-11) shows how a mismatch happens in practice.

A migration tool copied ms-DS-ConsistencyGuid between domains, and the object GUID AD FS sent in the token no longer matched the ImmutableId. This is one reported case, not a general rule.

Microsoft gives two cautions:

• Hard match is not a general repair tool. From July 1, 2026, Microsoft says a hard match can be blocked when the target cloud account holds or is eligible for a privileged Entra role, or already has onPremisesObjectIdentifier set.
• You cannot change the sourceAnchor in Entra Connect after the first install without uninstalling and reinstalling. Confirm the mapping you want before you retry a sync.