Aadsts700003 Restore Missing Microsoft Entra Device Identity

If you are seeing error AADSTS700003, it means Microsoft Entra ID (formerly Azure Active Directory) cannot find the device identity that your device claims to have. This usually happens after a device is unjoined and re-joined, after a system restore, or when the device object is deleted from Entra ID. The fix is to re-register the device with Entra ID, either by removing the old registration and re-adding it, or by using the built-in reset option in Windows.

What Is the AADSTS700003 Error?

AADSTS700003 is an authentication error that occurs during device-based sign-in. When you try to sign in to a Microsoft service (like Outlook, OneDrive, or a corporate app) from a device that is supposed to be Entra ID joined or registered, Entra ID looks up the device object in its directory. If the device object is missing, inactive, or the device’s certificate does not match, Entra ID returns this error.

The error message usually looks like: “AADSTS700003: The device object was not found in the tenant.” This indicates that the device identity that your computer presents does not exist in your organization’s Entra ID tenant. It can affect Windows 10/11 devices, as well as mobile devices that are enrolled in mobile device management (MDM).

Why Does the Device Identity Go Missing?

Several scenarios can lead to a missing device identity:

• Device object deleted: An admin or automated cleanup process removed the device from Entra ID, but the local device still thinks it is registered.
• System restore or reimaging: Restoring Windows to an earlier point can revert the device’s registration state, leaving an orphaned identity.
• Unjoin/Rejoin mismatch: If the device was unjoined from Entra ID and then rejoined without a full cleanup, the old certificate may remain.
• Certificate issues: The device’s certificate (used for authentication) may have expired or been deleted, making the device identity invalid.
• Tenant migration: Moving between tenants (e.g., after a merger) can leave device objects behind.

In most cases, the local device has a valid registration, but the cloud-side object is gone or mismatched.

How to Restore the Missing Device Identity

To fix AADSTS700003, you need to re-establish the device’s trust with Entra ID. Here are the steps for a Windows 10/11 device:

1. Check current status: Open Command Prompt as administrator and run dsregcmd /status. Look at the “AzureAdJoined” and “WorkplaceJoined” fields. If they show “NO”, the device is not properly registered.
2. Remove old registration: If the device shows as joined but you still get the error, run dsregcmd /leave to unjoin it from Entra ID. This clears the local registration.
3. Restart the device: A restart ensures all services are stopped.
4. Rejoin the device: Go to Settings > Accounts > Access work or school. Click Connect and sign in with your work or school account. Follow the prompts to join the device to Entra ID again.
5. Verify: After rejoining, run dsregcmd /status again. The “AzureAdJoined” field should now show “YES”, and the error should be resolved.

If the device is already joined but the error persists, you can also try deleting the device object from the Entra admin center and then re-registering. To do this, an admin must sign in to the Entra admin center, go to Devices, find the device, and delete it. Then on the device, run dsregcmd /leave and rejoin as above.

What If the Device Is Not Entra ID Joined?

If your device is only registered (not joined), the process is slightly different. For a workplace-joined device (e.g., a personal device with a work account added), you can remove the account and re-add it:

1. Go to Settings > Accounts > Access work or school.
2. Select the account and click Disconnect.
3. Restart the device.
4. Go back to Access work or school and click Connect, then sign in again.

This re-registers the device with Entra ID, creating a new device object if needed.

Common Problems and Troubleshooting

Here are some issues you might encounter during the fix:

• Error when running dsregcmd /leave: This can happen if you don’t have administrator rights. Make sure you run Command Prompt as an administrator.
• Device still shows as joined after /leave: Sometimes the registry keys are not fully cleared. You can manually delete the registry keys under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AAD and HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CDJ (if they exist), but be careful – only delete the ones related to the device registration.
• Rejoin fails with an error: This can be due to network issues, proxy settings, or a misconfigured DNS. Ensure you can reach your organization’s Entra ID endpoints.
• Certificate issues: If the device’s certificate is expired, you can try renewing it by running certutil -pulse in an elevated command prompt, then restarting.

If the problem persists after rejoining, check the event logs under Applications and Services Logs > Microsoft > Windows > User Device Registration. Look for errors that might indicate a deeper issue.

Preventing Future Occurrences

To avoid this error in the future, consider these best practices:

• Always use the proper unjoin process when removing a device from Entra ID (via Settings or dsregcmd /leave).
• If you need to reimage or restore a device, back up the device’s registration state or rejoin after the restore.
• Ensure that device cleanup policies in Entra ID do not delete devices that are still in use. Review your stale device policy.
• Keep Windows updated, as some fixes for device registration issues are included in cumulative updates.

Frequently Asked Questions

Can I fix AADSTS700003 without admin rights?

No, you need local administrator rights on the device to run dsregcmd /leave and to rejoin the device. If you don’t have admin rights, contact your IT support.

Will I lose any data if I rejoin the device?

No, rejoining a device to Entra ID does not delete local files or applications. It only changes the device’s registration status. Your user profile remains intact.

What if the device is already Entra ID joined but the error still appears?

This can happen if the device object is missing in the tenant. An admin needs to check if the device exists in the Entra admin center. If it’s missing, you need to unjoin and rejoin the device to create a new object.

Does this error affect personal Microsoft accounts?

No, AADSTS700003 is specific to work or school accounts that use Entra ID. Personal Microsoft accounts (like Outlook.com) do not use device objects in the same way.

How long does the fix take?

The unjoin and rejoin process typically takes less than 10 minutes. However, if you need to wait for an admin to delete a device object, it may take longer.

Can I use a PowerShell script to fix this?

Yes, you can automate the process with PowerShell. For example, you can run dsregcmd /leave and then trigger a rejoin using the Join-AzureADDevice cmdlet (if you have the AzureAD module), but the built-in Settings method is simpler and more reliable for most users.

Related

• Windows 11 Stuck in Dark Mode? Fix It
• Build a Flutter Translator App Without Google Translate API
• Check Disk Space in Linux: 6 Commands