Fix Access Denied in Azure AD / Microsoft Entra ID

This guide walks you through resolving “Access Denied� errors in Microsoft Entra ID (formerly Azure Active Directory). You’ll learn the likely causes—misconfigured roles, conditional access policies, or token issues—and the exact steps to diagnose and fix each one. No prior admin experience is needed, but you should have at least one account with Global Administrator or Privileged Role Administrator permissions.

What You’ll Need

• Access to the Microsoft Entra admin center (entra.microsoft.com) with an account that has Global Administrator or Privileged Role Administrator role.
• The user’s sign-in logs (you can view them with the same admin account).
• The exact error message or code you’re seeing (screenshot it if possible).

Step-by-Step

1. Identify the exact error message. Access Denied can appear in the Azure portal, Microsoft 365 admin center, or when using PowerShell. Note the error code (e.g., AADSTS70001, AADSTS50013) and the full text. This tells you whether the problem is with the user’s role, a conditional access policy, or the app’s configuration.
2. Check the user’s role assignments. Go to Identity > Users > All users, select the affected user, then click Assigned roles. If the user lacks a role that the resource requires (e.g., they need “Application Administrator� to manage app registrations), assign it by clicking Add assignment, choosing the role, and saving. If you don’t have permission to assign roles, ask a Global Administrator to do it.
3. Review conditional access policies. Under Protection > Conditional Access, check if any policy applies to the user or the app they’re trying to access. Policies can block access based on location, device compliance, or sign-in risk. If a policy is incorrectly blocking the user, you can either adjust the policy (if you’re an admin) or have the user try from a compliant device or approved location. Temporarily disable the policy to test—but re-enable it after.
4. Verify the app registration permissions. If the error occurs when using a custom app, go to Identity > Applications > App registrations, select the app, then API permissions. Ensure the required permissions (e.g., Microsoft Graph User.Read.All) are granted and that an admin has consented. Click Grant admin consent for the tenant if needed.
5. Check the enterprise application user assignment. For gallery apps, go to Identity > Applications > Enterprise applications, select the app, then Users and groups. If “User assignment required?� is set to Yes, the user must be assigned. Add the user to the app’s access list.
6. Inspect sign-in logs. Under Identity > Monitoring & health > Sign-in logs, find the failed sign-in for that user. Click it and look at the Conditional Access and Troubleshooting and support tabs. The logs often show which policy or role caused the denial.
7. Clear cached tokens or re-authenticate. Sometimes the user has an old token that doesn’t reflect new role assignments. Ask the user to sign out of all sessions, close the browser, and sign back in. In the portal, they can also go to Sign out everywhere from their own account settings.

Common Mistakes

• Assuming it’s a role problem when it’s a policy problem. Conditional access policies block access even if the user has the right role. Always check both.
• Forgetting admin consent. Even if permissions are added to an app, they don’t take effect until a Global Administrator grants consent. Without consent, the app gets an “Access Deniedâ€� when calling APIs.
• Editing the wrong directory. If you have access to multiple tenants, you might be looking at the wrong one. Check the tenant name in the top-right corner of the portal.
• Not waiting for replication. Role assignments and policy changes can take a few minutes to propagate. Don’t immediately assume a fix failed; wait 5–10 minutes and retry.

Tips

• Use the “What Ifâ€� tool in Conditional Access to simulate a user’s sign-in before making changes. It helps you see which policies would apply without affecting real users.
• Create a break-glass account (a separate Global Administrator account) that is excluded from conditional access policies, so you don’t lock yourself out.
• Enable diagnostic logging for your app in Azure Monitor to see detailed error traces.
• If you’re using PowerShell, make sure you’re connected to the correct tenant with Connect-MgGraph -TenantId "your-tenant-id".

Troubleshooting

If the error persists after following the steps:

• Check the service health. Go to Health > Service health in the admin center to see if there’s an ongoing incident with Entra ID or the app you’re using.
• Use the sign-in log’s “Troubleshooting and supportâ€� tab. It often gives a specific reason like “User not foundâ€� or “Token expired.â€� Follow the suggested actions.
• Test with a different user. If another user with the same role can access the resource, the problem is specific to the original user—check their account status (disabled? expired password?) or group memberships.
• Review the app’s manifest. For custom apps, open the app registration and go to Manifest. Look for errors in requiredResourceAccess or oauth2Permissions. A misconfigured manifest can cause access denied.
• Check if the user is blocked. In the user’s profile, under Settings, ensure “Block sign inâ€� is set to No.

Frequently Asked Questions

Why do I get “Access Denied� even though I’m a Global Administrator?

Global Administrators have broad access, but conditional access policies can still block them. Also, some tasks require a specific admin role (e.g., “User Administrator� to reset passwords). Check the policy and the required role.

Can I fix Access Denied without admin rights?

No. Most fixes require at least a Privileged Role Administrator or Global Administrator. If you’re a regular user, contact your IT admin and provide the error message and time of the issue.

How long do role changes take to take effect?

Usually within 5–10 minutes, but in rare cases it can take up to an hour. Sign out and back in to refresh your token.

What does “AADSTS70001� mean?

This error means the application was not found in the tenant. It often happens when the app registration is deleted or the tenant ID is wrong. Check the app registration still exists.

Does clearing browser cookies help?

Yes, sometimes. Old cookies can hold stale tokens. Clearing them forces a fresh sign-in and can resolve access issues after role changes.

Can I bypass conditional access to fix the error?

You can temporarily disable a policy for testing, but don’t leave it disabled. Instead, adjust the policy to exclude the user or device, or add a condition that matches the legitimate access.

Related

• Enable Admin Shares in Windows: Step-by-Step
• How to Lock WhatsApp on iPhone and Android
• How to Turn Off Promotion on iPhone 13