Sign-in & Login Problems

How to Fix AADSTS Errors for Federated Users in Azure AD and Google Workspace

Huda Qurayshi Oct 13, 2026 868 views

Question details

Users experience AADSTS errors when trying to sign into Microsoft services using Google Workspace credentials in a federated environment.

How to Fix AADSTS Errors for Federated Users in Azure AD and Google Workspace

Product: Azure Active Directory / Microsoft 365
Device & OS: not provided
Scenario: Accessing OneDrive, Edge, or Microsoft 365 using federated Google Workspace credentials.
Observed behavior: Users who signed in prior to the federation setup encounter AADSTS51004 or similar Azure AD sign-in errors, while sign-ins for new users work normally.

Before you start

Ensure you have global administrator access to both your Azure AD portal and the Google Workspace admin console to review authentication logs and federation settings.

Solution 1Recommended

Review Azure AD Error Codes and Escalate to Microsoft Q&A

Identify the exact AADSTS error code and consult Microsoft identity experts to resolve federation-specific account conflicts.

Because this issue involves complex Azure AD federation rather than standard Exchange Online settings, the solution typically requires tenant-level diagnostics. Error codes like AADSTS51004 often point to synchronization issues, credential mismatches, or legacy tokens conflicting with new federation policies.

Access Azure AD Sign-in Logs

Log into the Azure Portal as an administrator, navigate to Microsoft Entra ID (formerly Azure AD), and click on 'Sign-in logs' under the 'Monitoring' section.

Identify the Error Code

Filter the logs by the affected user to locate the failed sign-in attempts. Note the exact AADSTS error code (e.g., AADSTS51004) and the failure reason provided.

Cross-Reference Documentation

Look up the exact error code in Microsoft's official 'Azure AD authentication and authorization error codes' documentation to understand the root cause.

Post in Microsoft Q&A

Navigate to the Microsoft Learn Q&A forum. Post your detailed scenario using tags for Azure AD and Identity, making sure to include the affected applications, error codes, federation setup, and the distinction between old and new user behaviors.

Review Azure AD Error Codes and Escalate to Microsoft Q&A

Tagging your question: When posting in the Microsoft forum, properly tagging your question with 'Azure Active Directory' and 'Federation' ensures it reaches the appropriate identity experts faster.

Solution 2

Revoke User Sessions and Clear Cache

Since the issue primarily affects users who signed in before the federation was enabled, clearing old session tokens can force a fresh authentication request.

Free Microsoft Office alternative

Avoid Cloud Login Hassles with WPS Office

Tired of dealing with complex Azure AD federation and AADSTS login errors? WPS Office provides a lightweight, hassle-free alternative that works perfectly offline without strict cloud identity dependencies.

1. Download the Software: Visit the official WPS Office website and download the free installation package for your operating system.
2. Install Locally: Run the installer and complete the setup in minutes without needing to configure complex cloud accounts.
3. Work Without Interruptions: Open existing Office files directly from your hard drive and start working immediately, avoiding any AADSTS login loops.

Fully compatible with Microsoft Word, Excel, and PowerPoint formats (.docx, .xlsx, .pptx).Edit and save documents locally without relying on Azure AD or Google Workspace federation logins.Lightweight installation that consumes minimal system resources.Familiar user interface that requires no steep learning curve for Microsoft Office users.

Frequently Asked Questions

What does the AADSTS51004 error mean in Azure AD?

AADSTS51004 typically indicates that a user account does not exist in the directory or that there is a synchronization issue between the federated identity provider (like Google Workspace) and Azure AD during the authentication process.

Why do only users who signed in before federation experience this error?

Users who accessed Microsoft services prior to federation may have cached authentication tokens or legacy non-federated identities stored in Azure AD. These old tokens conflict with the new login routing required by the federation setup.

Can I bypass Azure AD federation errors by using local credentials?

If a domain is strictly set to 'Federated', users associated with that domain cannot bypass it using local cloud-only passwords. However, administrators can use a break-glass cloud-only admin account (e.g., ending in .onmicrosoft.com) to log in and investigate.

Login & Account Issues