Microsoft 365 Error Codes

How to Fix Microsoft 365 Sign-In Error AADSTS51004 with Google Workspace SSO

Natalie Taylor Oct 19, 2026 869 views

Question details

Users are unable to access Microsoft 365 due to an AADSTS51004 error during Google Workspace SSO, indicating a missing or mismatched user account in Microsoft Entra ID.

Product: Microsoft 365
Device & OS: not provided
Scenario: Users are attempting to sign in to Microsoft 365 services via Google Workspace single sign-on (SSO).
Observed behavior: The authentication fails with error AADSTS51004 because Microsoft 365 cannot locate the user in the Entra ID directory. The issue recurs every few weeks despite temporary UPN fixes via PowerShell.

Before you start

Ensure you have global administrator or privileged identity administrator access to both your Google Workspace admin console and the Microsoft Entra admin center before troubleshooting.

Solution 1Recommended

Verify Cross-Platform Identity and Synchronization Settings

Check the immutable identifiers, UPNs, and domain claims between Google Workspace and Microsoft Entra ID to ensure accounts are properly synchronized and authenticated.

The AADSTS51004 error occurs when the identity provided by Google Workspace during SSO does not exactly match an active identity in Microsoft Entra ID. Manually changing the User Principal Name (UPN) is only a temporary workaround, as directory sync processes will often overwrite it again.

Access Microsoft Entra ID Users

Verify User Principal Names (UPN)

Check the UPN of the affected accounts and ensure they exactly match the users' primary Google Workspace email addresses.

Check Immutable IDs

Confirm that the Immutable ID (Source Anchor) matches the expected mapping in your Google Workspace SAML configuration, ensuring SSO federation routes correctly.

Review Sync Rules

Check your user provisioning software or Microsoft Entra Connect sync rules for conflicting synchronization policies that might be periodically reverting the UPN.

Verify Cross-Platform Identity and Synchronization Settings

Avoid Repeated PowerShell UPN Changes: Continuously updating the UPN via PowerShell does not fix the root cause. A proper, permanent sync configuration prevents the error from recurring.

Solution 2

Escalate to Microsoft 365 Business Support

If backend directory records, federation settings, or claims are corrupted, Microsoft support engineers will need to investigate and collect logs remotely.

Free Microsoft Office alternative

Experience Hassle-Free Productivity with WPS Office

Tired of dealing with complex Microsoft 365 admin configurations, recurring SSO bugs, and sign-in errors? WPS Office offers a seamless, offline-capable productivity suite that bypasses complicated cloud authentication while fully supporting standard Office file formats.

1. Download the Installer: Visit the official WPS website and download the free installer for your operating system.
2. Install WPS Office: Run the setup file and follow the on-screen prompts to quickly install the application.
3. Open Your Documents: Launch WPS Office and directly open your existing Microsoft Office files with full layout preservation.

Fully compatible with Microsoft Word, Excel, and PowerPoint formats (.docx, .xlsx, .pptx).Lightweight desktop application that runs smoothly without relying on complex SSO or cloud connectivity.Free to download and use, offering a familiar interface with no steep learning curve.Built-in PDF editing, cloud storage integration, and extensive template libraries.

microsoft office alternative - wps office

Frequently Asked Questions

What does Microsoft 365 error code AADSTS51004 mean?

Error code AADSTS51004 indicates that a user account could not be found in the configured Microsoft Entra ID directory during a Single Sign-On (SSO) attempt. This usually happens when the credentials passed from the identity provider (like Google Workspace) do not match any active account records in Microsoft's backend.

Why does the AADSTS51004 error return after I fix it with PowerShell?

Using PowerShell to change a User Principal Name (UPN) is only a temporary fix. Background synchronization processes, such as Microsoft Entra Connect or Google provisioning, often run on a schedule and will overwrite your manual changes if the source directory rules remain unfixed.

Where can I find the sign-in logs to troubleshoot Microsoft 365 SSO?

You can locate sign-in logs by logging into the Microsoft Entra admin center. Expand the 'Identity' menu, navigate to 'Monitoring & health', and click on 'Sign-in logs'. These logs will reveal the exact authentication step where the SSO process is failing.

Microsoft Office Error Codes