How to Fix AADSTS5000228 on a New Dynamics 365 Trial Tenant

Setting up a customer relationship management environment should be a straightforward process, but encountering an Entra ID authentication block halts the entire deployment. If you are actively working to Fix AADSTS5000228 on a New Dynamics 365 Trial Tenant, you are dealing with a strict tenant restriction or a cross-tenant access policy failure. This specific diagnostic code indicates that the identity you are using to sign in is blocked by the Azure directory's external collaboration settings, or your browser is passing conflicting cached credentials from a different corporate session. The following workflow details the exact administrative actions required to clear this block, validate your identity, and access your trial workspace.

Eliminate Conflicting Entra ID Tokens via InPrivate Browsing

Modern browsers frequently cache active session tokens from your primary corporate Microsoft 365 account. When you attempt to provision a secondary environment, Microsoft Entra ID rejects the mismatched tenant IDs, leading to the access block. The fundamental first step in Understanding the process of fixing AADSTS5000228 on a New Dynamics 365 Trial Tenant is isolating your browser session to ensure no background authentication tokens interfere with the new provisioning request.

• Right-click your browser icon on the taskbar and select New InPrivate window (Microsoft Edge) or New Incognito window (Google Chrome).
• Navigate directly to the official Dynamics 365 trial signup page without logging into any other Microsoft portal first.
• Enter the specific work email address you intend to use for the trial environment.
• Authenticate using the password and the associated Microsoft Authenticator MFA prompt.
• Verify the result: If the Dynamics 365 initialization dashboard loads successfully, your primary browser profile was passing the wrong tenant token. You can continue using this InPrivate window for the duration of your trial setup.

Deploy a Dedicated OnMicrosoft Domain for the Trial

Many corporate IT departments deploy strict B2B collaboration policies that prevent users from binding new trial environments to the company's primary domain architecture. If the browser isolation method fails, the most reliable method for fixing AADSTS5000228 on a New Dynamics 365 Trial Tenant is to bypass your heavily restricted corporate domain entirely by provisioning a clean, standalone tenant.

• Navigate to the Microsoft Entra admin center at entra.microsoft.com and sign in using an account with tenant creation privileges.
• In the left navigation pane, expand the Identity dropdown and click Overview.
• Click Manage tenants from the top horizontal menu bar, then click the + Create button.
• Select Microsoft Entra ID as the tenant type and click Next: Configuration.
• Enter a unique organization name and an initial domain name (for example, type crmdemo2024 to create crmdemo2024.onmicrosoft.com). Click Review + create.
• Once the deployment completes, click your profile icon in the top right, select Switch directory, and choose the new tenant.
• Navigate to Users > All users > New user > Create new user. Assign this user the Global Administrator role.
• Log out entirely, open a fresh browser window, and use this newly created `.onmicrosoft.com` credential to register for the Dynamics 365 trial.

Modify Cross-Tenant Access Policies in Entra ID

If you must use your existing corporate identity to set up the trial and you possess Global Administrator privileges, the error stems from restrictive inbound or outbound access policies blocking external application connections. To execute fixing AADSTS5000228 on a New Dynamics 365 Trial Tenant from an administrative policy standpoint, you must explicitly allow external access for B2B collaboration.

• Sign in to the Microsoft Entra admin center as a Global Administrator or Security Administrator.
• In the left pane, navigate to Identity > External Identities > Cross-tenant access settings.
• Click on the Default settings tab located in the main viewing pane.
• Under the Inbound access settings section, click the link titled Edit inbound defaults.
• Select the B2B collaboration tab. Under the Users and groups section, change the radio button to Allow access.
• Click the Applications tab in the same window and verify that access is also set to Allow access.
• Click Save at the bottom of the pane. Wait exactly 15 minutes for the Azure Active Directory synchronization engine to propagate the policy changes across global nodes before re-attempting the trial login.

Processing Trial CRM Data with WPS Office

WPS Office cannot alter Microsoft Entra ID policies, bypass cloud network restrictions, or manage Windows administration settings. However, once you successfully resolve fixing AADSTS5000228 on a New Dynamics 365 Trial Tenant and your environment is active, your immediate next step is usually importing legacy customer lists into the CRM or exporting trial reports for stakeholder review. WPS Office provides an efficient, lightweight suite for formatting these data transitions without requiring a secondary Microsoft 365 subscription.

• In your active Dynamics 365 dashboard, navigate to Sales > Accounts.
• Click the Export to Excel button located on the top command bar and select Static Worksheet to download the `.xlsx` file to your local drive.
• Open WPS Spreadsheet and click Open to load the exported Dynamics file.
• Highlight your data columns and navigate to the Data tab. Click Highlight Duplicates to identify any overlapping customer records before re-importing updated data back into Dynamics 365.
• Use the Save As function in WPS to format the file strictly as a CSV (Comma Delimited) file, which is the optimal format for the Dynamics 365 Data Import Wizard.

Use Word, Excel, and PPT for FREE

Free Download

Frequently Asked Questions

Why does this specific Entra ID error only appear during trial setups?

Trial setups often trigger automatic security defaults designed to prevent unauthorized shadow IT and unmanaged data environments. while working on fixing AADSTS5000228 on a New Dynamics 365 Trial Tenant, you will find that Microsoft restricts standard organizational users from creating new directories tied to a heavily secured corporate tenant. The system throws the 5000228 block code to enforce your company's data governance policies.

Can I bypass the authentication block by using a personal email address?

No. Dynamics 365 trial environments strictly require a work or school account. Attempting to input a personal address, such as an outlook.com or gmail.com account, will fail before the tenant policy check even occurs. You must use an organizational account or utilize the Entra admin center to create a dedicated `.onmicrosoft.com` identity.

How long does it take for modified tenant access settings to take effect?

After editing the inbound or outbound B2B collaboration settings in the Microsoft Entra admin center, it takes approximately 15 to 30 minutes for the directory replication to complete across all global nodes. Attempting to log into the Dynamics 365 portal immediately after clicking save will likely result in the exact same authentication error.

Does disabling security defaults entirely fix the login issue?

While toggling off security defaults in the Entra properties panel can bypass strict access rules temporarily, it removes mandatory multi-factor authentication (MFA) and vital baseline protections for your entire directory. It is highly recommended to configure targeted cross-tenant access settings or use an isolated `.onmicrosoft.com` domain instead of globally disabling security defaults to force a trial activation.