Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errors“Access denied” in Microsoft Authenticator is usually the result of a Microsoft Entra sign-in decision, not proof that your phone is faulty. A Conditional Access policy may reject the device, application, authentication method, or sign-in risk; account status, app assignment, licensing, and stale registration can also block access. Capture the error details, inspect the failed sign-in event, identify the exact policy or account condition, and then correct that condition. The steps below cover both user actions and the administrator changes that may be required.
What “Access denied” means
The message is an outcome rather than a diagnosis. Microsoft Entra evaluates the user, device, client application, target resource, authentication method, and risk before granting access. If a required condition is not met, Authenticator can show a denial even when the password is correct and the app itself opens normally.
As an Amazon Associate I earn from qualifying purchases.
Common Conditional Access codes
| Code | Meaning | Typical blocker |
|---|---|---|
AADSTS53000 |
DeviceNotCompliant | The device does not satisfy the organization’s compliance rules. |
AADSTS53001 |
DeviceNotDomainJoined | The policy requires a domain-joined device, but the device is not joined as required. |
AADSTS53002 |
ApplicationUsedIsNotAnApprovedApp | The sign-in used a client that the organization has not approved. |
AADSTS53003 |
BlockedByConditionalAccess | A Conditional Access policy explicitly blocked the request. |
AADSTS53004 |
ProofUpBlockedDueToRisk | Risk controls prevented the user from completing registration or additional verification. |
AADSTS53009 |
Application must enforce Intune protection policies | The application must apply the organization’s Intune app-protection requirements. |
These codes point toward the area to investigate, but the sign-in event contains the authoritative policy result and assessed conditions.
Recommended Free Tools
Account and application causes
An administrator should also verify that the account exists, is enabled for sign-in, is not locked, has current authentication contact information, is assigned to the target application, and has any required license. A recently changed assignment may not appear in an existing session; signing out and back in can force a fresh evaluation. Browser cookies and application configuration can independently interfere with registration or sign-in.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Capture evidence before trying again
Repeated retries can make the event harder to identify. On the denial screen, record:
- The exact error text and any
AADSTScode. - The request ID and correlation ID, if shown.
- The approximate time, including time zone.
- The username and target application or service.
- The device, operating system, browser, and client app used.
Send this information to your help desk or tenant administrator if you cannot view sign-in logs. The correlation ID and time let them locate the matching event instead of guessing which policy applied.
Find the failed sign-in event
A tenant administrator can determine the actual blocker in the Microsoft Entra admin center:
- Open Entra ID.
- Choose Monitoring & health, then Sign-in logs.
- Filter by the affected user and the approximate date and time. Narrow the results by application and correlation ID when available.
- Open the failed event.
- Review Conditional Access, Authentication Details, and Troubleshooting and support.
The Conditional Access tab identifies the policy or policies that interrupted the request and shows the user and device details that were assessed. Do not change a policy solely because its name looks relevant; confirm that its result is the failure recorded in this event.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Check which policy condition failed
After opening the event, compare the failed condition with the policy’s assignments and grant controls. The following checks cover the most common outcomes.
| Event finding | What to inspect | Likely correction |
|---|---|---|
| Device not compliant | Device compliance state, management enrollment, and the policy’s device-platform conditions. | Bring the device into the required compliant state or have an administrator adjust the assignment after confirming the business requirement. |
| Device not domain joined | Whether the policy requires a particular join state and whether this device has that state. | Use an appropriately joined device or revise the policy for the intended population. |
| Unapproved application | Client-app conditions and the application used for the request. | Use the organization-approved client or have the administrator change the allowed client condition. |
| Authentication strength not met | The strength shown under Authentication Details and the methods enabled for the user. | Register and use a method that satisfies the required strength, or have an administrator correct the policy if it is mis-scoped. |
| Risk blocked proof-up | The risk-related policy and the reason registration was challenged. | Follow the organization’s risk-remediation process; an administrator may need to clear or investigate the risk before registration can continue. |
| Intune protection required | Whether the app supports and is receiving the required Intune protection policy. | Use a supported, managed app configuration or have the administrator correct the app-protection assignment. |
Use the Conditional Access What If tool
In the Microsoft Entra admin center, an administrator can open Conditional Access and use What If to simulate a user, resource or user action, and sign-in conditions. It lists policies that would apply to that combination and can expose an unexpected assignment or exclusion. What If does not account for service dependencies, so treat the failed sign-in event—not the simulation—as authoritative for the incident that already occurred.
Verify authentication method and strength
An authentication method must be both registered for the user and enabled by the tenant’s authentication-method policy. A user can therefore own a phone with Authenticator installed and still be denied because the method is disabled, unregistered, or insufficient for the required authentication strength.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- In the failed event, open Authentication Details and note the required authentication strength and the method that was attempted.
- Compare that requirement with the methods enabled for the user by the authentication-method policy.
- Confirm that the user has actually completed registration for an allowed method, rather than merely installing the app.
- If the required method is unavailable, ask the help desk or Authentication Policy Administrator which alternative is permitted and whether a recovery process can issue a Temporary Access Pass.
Do not weaken an authentication-strength requirement as a first response. A policy change affects every user and application in its scope; registration of an approved method is usually narrower and easier to reverse.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Check account, application, and licensing configuration
An administrator should validate the account independently of Conditional Access:
- Confirm the user object exists and is enabled for sign-in.
- Check for a lockout or other account state that prevents authentication.
- Verify that authentication contact information is current.
- Confirm the user is assigned to the target application, directly or through the expected group.
- Confirm that the user has the license required by that application or feature.
- Check the application’s configuration if only one app is failing.
If an assignment was just made, sign out of the application and browser, close existing sessions, and sign in again. For browser-based registration, clearing cookies for the affected sign-in session can remove a stale session state; do this only when you understand that it will sign you out of that browser.
Manual fixes a user can try
Start with the approved sign-in path
Use the organization’s approved application and browser rather than an old bookmark, embedded web view, or unapproved client. If the event reports an unapproved application or an Intune-protection requirement, switching to another personal client will not satisfy the policy.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Refresh the registration session
- Close the Authenticator prompt and the related browser or application.
- Sign out of the affected account where possible.
- Reopen the organization’s documented sign-in or registration page.
- Start registration again and complete every approval prompt shown by the organization.
This refreshes the session, but it cannot override a tenant policy. If the same code returns, stop retrying and provide the new event details to the administrator.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Use a compliant or correctly joined device
When the event identifies compliance or join state, check the device status in the organization’s management workflow and complete any required remediation. If you cannot change the device’s compliance or join state yourself, use a device that already meets the policy or contact the help desk. Installing Authenticator alone does not make a device compliant or domain joined.
Update account details through the approved administrator process
If your contact information is obsolete, your account is locked, or the application assignment is missing, only the organization’s administrator can correct the directory state. Give them the username, application, time, and correlation ID so they can verify the request before changing anything.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Administrator fixes by scope
One user or one device
For a single affected user, first verify enablement, lockout, contact information, method registration, app assignment, and licensing. For a single device, inspect compliance and join state. These changes have a narrower blast radius than editing a tenant-wide policy.
A group, application, or platform
If several users in one group or one application fail, review the Conditional Access assignment, exclusions, client-app conditions, device platforms, grant controls, and authentication strength. Confirm that the target users and applications are intended to be in scope. Test with a controlled account before applying a broad correction.
Best Value
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
A tenant-wide policy
Do not disable a broad policy simply to make one sign-in succeed. Identify the affected users, apps, and devices, document the original settings, and make the smallest reversible change that addresses the confirmed condition. Recheck the failed sign-in event after the change to verify that the decision—not merely the error display—has changed.
Recover access when Authenticator is unavailable
If every existing method fails, use the organization’s account-recovery option when one is available. Microsoft’s documented recovery flow verifies the user’s identity and can issue a Temporary Access Pass (TAP). After receiving the TAP, the user is redirected to Security info to register a new authentication method.
- Open the organization’s account-recovery entry point.
- Complete the identity checks requested by the recovery flow.
- Use the issued TAP within its validity period and according to the organization’s instructions.
- At Security info, register a new method that satisfies the tenant’s authentication policy.
- Test the new method with the affected application, then remove or replace obsolete registration only through the approved process.
A help desk or Authentication Policy Administrator may need to enable recovery or issue the TAP. Tenant policy can limit who may use this route, so its absence does not necessarily indicate a problem with the phone.
If administrators are locked out
When a Conditional Access policy blocks every administrator, Microsoft’s guidance is for another administrator who is not blocked to disable or correct the policy. That administrator should use the sign-in event to identify the exact policy and preserve the original configuration before changing it. If no administrator can make the correction, submit a Microsoft support request; support can review and update the policy after the tenant’s ownership and situation are confirmed.
Choose the right fix path
| Situation | Who can act | Best evidence | Scope and reversibility |
|---|---|---|---|
| Stale browser session or recent assignment | User | Time of failure and application name | One session; signing out or clearing relevant cookies is reversible. |
| Missing method or insufficient strength | User plus help desk or administrator | Authentication Details and method-policy result | Registering an approved method is narrower than changing policy. |
| Compliance or join-state failure | User, device-management team, or administrator | Conditional Access tab and device assessment | Usually one device; policy edits may affect many devices. |
| App assignment or license | Application or directory administrator | Account state, assignment, and license records | Can be limited to one user or group. |
| Tenant-wide Conditional Access lockout | Unblocked administrator or Microsoft support | Correlation ID, sign-in event, and policy name | High impact; document and test every change. |
Common mistakes that prolong the denial
- Deleting and reinstalling Authenticator before identifying the policy that blocked registration.
- Assuming a correct password proves that the device and authentication strength meet policy.
- Changing a tenant-wide policy without checking which users, applications, and platforms it covers.
- Using What If as proof that a policy caused an already-recorded event; service dependencies can make the simulation incomplete.
- Repeating retries without recording the correlation ID, making the relevant event harder to isolate.
- Requesting a new method without checking whether that method is enabled and satisfies the required strength.
Final verification
After a correction, perform one controlled sign-in and record the result. The new event should show the expected device, client, authentication method, and Conditional Access outcome. If it still fails, capture the new correlation ID and time; a changed error code usually means the first blocker was removed and another condition is now being evaluated.
Quick Recap
As an optional shortcut for local Windows issues around the sign-in app, Outbyte PC Repair can address more than 100 common Windows problems, adjust settings, clear temporary and cache files, and provide an app-crash log. It runs on Windows 11, 10, 8, and 7, with a free trial by category of at least two days followed by a subscription. It complements antivirus software rather than replacing it; results vary, and no tool repairs every crash or overrides a Microsoft Entra policy.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
