Windows Integration Errors

Fix Azure and Entra ID Authentication Token Errors (AADSTS50020)

John Wilson Oct 9, 2026 870 views

Question details

Users are encountering AADSTS50020 and Microsoft_Azure_Support token errors when attempting to authenticate in Azure or Microsoft Entra ID.

How to Fix Azure and Entra ID Authentication Token Errors

Product: Azure and Microsoft Entra ID
Device & OS: not provided
Scenario: Signing into Azure or Entra ID services using a personal or GitHub-linked Microsoft account.
Observed behavior: The system throws authentication token errors (such as AADSTS50020) because the external personal identity is not authorized or does not exist in the target Microsoft Entra tenant.

Before you start

Confirm which Microsoft account you are currently logged into, and verify the specific Microsoft Entra tenant directory you are attempting to access.

Solution 1Recommended

Sign In With a Target Tenant User Account

Use an account natively registered to the target Microsoft Entra tenant rather than a personal Microsoft or GitHub account.

Personal Microsoft accounts or external GitHub identities often lack the necessary authorizations to obtain tokens for tenant-specific Azure extensions. To fix this, you must use a dedicated user account inside the target tenant.

Sign out of your current session

Click your profile picture in the top right corner of the Azure Portal or Microsoft Entra admin center and select 'Sign out'.

Clear browser cache or use an incognito window

Open a new InPrivate or Incognito browsing window to prevent cached personal credentials from automatically signing you back in.

Sign in with a tenant-specific account

Log in using a corporate or school account (e.g., user@yourtenant.onmicrosoft.com) that has the required permissions in the specific directory.

Select the correct directory

If you are part of multiple tenants, click the 'Directories + subscriptions' icon in the top toolbar to ensure you have selected the correct target directory.

Sign In With a Target Tenant User Account

Proper Authentication: Signing in with a native tenant account directly resolves the AADSTS50020 authorization failure by providing the correct token scopes.

Solution 2

Invite the Personal Account as a Guest User

If you must use a personal or GitHub-linked account, invite it to the Azure tenant as a guest to grant the necessary permissions.

Free Microsoft Office alternative

Boost Your Productivity with WPS Office

While troubleshooting Azure and Microsoft Entra ID authentication errors can be complex, managing your daily documents shouldn't be. WPS Office is a powerful, lightweight, and free alternative to Microsoft Office that lets you focus on your work without frustrating login hurdles.

1. Download the Installer: Visit the official WPS website and download the free installer designed for your operating system.
2. Install WPS Office: Run the setup file and follow the straightforward on-screen instructions to complete the installation.
3. Edit Your Documents: Launch WPS Office to instantly open, edit, and save your existing Microsoft Office files with perfect formatting preservation.

Fully compatible with Microsoft Word, Excel, and PowerPoint formatsLightweight design ensures fast startup and smooth performanceFree built-in PDF editing, merging, and conversion toolsWork offline easily without relying on complex cloud authentications

microsoft office alternative - wps office

Frequently Asked Questions

What does the AADSTS50020 error mean in Azure?

The AADSTS50020 error indicates that the user account from the identity provider does not exist in the target Microsoft Entra tenant. It usually happens when you try to access a tenant-specific resource using a personal Microsoft account that hasn't been invited as a guest.

Can I use my personal GitHub account to manage my Azure tenant?

Yes, but your GitHub-linked personal account must first be invited as a guest user to the specific Microsoft Entra directory. Once the invitation is accepted and appropriate roles are assigned, you can fetch the correct authentication tokens.

How do I switch directories in the Azure Portal?

In the Azure Portal, click the 'Directories + subscriptions' icon (which looks like a gear and filter) in the top menu bar. From the panel that appears, locate your target directory and click the 'Switch' button next to it.

Why do my newly created users still get a token error?

Newly created users might still experience token errors if they have not been assigned the proper Role-Based Access Control (RBAC) permissions for the resource, or if browser caching is attempting to sign them in with an old session token. Clear the browser cache or use an Incognito window to log in.

Microsoft Office Error Codes