Conditional Access Problems

How to Fix Azure AD Error 500121 During User Sign-In

Maira Mehtab Sep 24, 2026 870 views

Question details

Users are blocked from signing in due to Azure AD authentication error 500121, which is related to Conditional Access or multifactor authentication (MFA) policies.

Product: Microsoft Azure AD / Microsoft 365
Device & OS: not provided
Scenario: A user is attempting to sign in to a Microsoft 365 or Azure AD-integrated service and is prompted for authentication.
Observed behavior: The sign-in process fails entirely, returning error code 500121 and preventing the user from accessing their account and resources.

Before you start

Verify if the affected user is the only global administrator in the Microsoft 365 tenant, as resolving this issue requires access to an alternate administrator account.

Solution 1Recommended

Require MFA Re-registration for the Affected User

Use another administrator account to force the affected user to re-register their multifactor authentication (MFA) methods in the Microsoft Entra admin center.

Error 500121 typically indicates a failure during the multifactor authentication process. By forcing a reset of the user's MFA methods, you clear corrupted or misconfigured authentication tokens, allowing them to set up their verification methods freshly upon their next sign-in.

Sign in as an alternate administrator

Log in to the Microsoft Entra admin center or Azure portal using a different account that possesses Global Administrator or Authentication Administrator privileges.

Locate the affected user profile

In the left-hand navigation pane, go to 'Users' and then select 'All users'. Use the search bar to find the specific user experiencing the 500121 error.

Require re-registration of MFA

Click on the user's name to open their profile. In the left menu under 'Manage', click on 'Authentication methods'. At the top of the pane, click the 'Require re-register MFA' button.

Have the user retry sign-in

Notify the affected user to attempt signing in again. They will be prompted to set up their multifactor authentication methods from scratch, bypassing the previous error.

Single Administrator Accounts: If the affected user is the only administrator on the tenant and is locked out, you cannot perform this step yourself. You will need to contact Microsoft Data Protection Support to regain access.

Free Microsoft Office alternative

Looking for a Lightweight and Free Office Suite?

While resolving Microsoft 365 authentication errors can take time, your daily productivity shouldn't be interrupted. WPS Office is a free, fast, and highly compatible alternative to Microsoft Office that lets you edit documents locally without relying on complex cloud authentication.

1. Download the software: Visit the official WPS Office website and click on the 'Download' button.
2. Install WPS Office: Run the downloaded installer and follow the simple on-screen instructions to complete the setup.
3. Start working instantly: Open WPS Office and immediately start editing your Word, Excel, or PowerPoint files without needing complex account setups.

Fully compatible with Microsoft Office formats like .docx, .xlsx, and .pptx.Work locally on your device without worrying about Azure AD login errors or MFA blocks.Lightweight installation and incredibly fast loading times for maximum productivity.Familiar user interface that requires zero learning curve for current Office users.

microsoft office alternative - wps office

Frequently Asked Questions

What exactly does Azure AD Error 500121 mean?

Error 500121 occurs when authentication fails during a multifactor authentication (MFA) request. This usually happens if the user denies the MFA prompt, fails the challenge multiple times, or if there is a mismatch in their registered authentication methods.

Can I temporarily bypass the MFA requirement to fix error 500121?

As an administrator, you can temporarily exclude the affected user from the Conditional Access policy that enforces MFA. However, for security reasons, it is highly recommended to fix the root cause by requiring them to re-register their MFA methods instead.

What should I do if I am the only administrator and get locked out by error 500121?

If you are the sole global administrator for the tenant and cannot bypass the MFA block, you must contact Microsoft Support (specifically the Data Protection team) to verify your identity and have them temporarily disable the MFA requirement on your account.

How do Conditional Access policies trigger this specific error?

If a Conditional Access policy strictly requires MFA for accessing certain apps or connecting from specific locations, and the user's MFA method is unregistered, expired, or fails during the challenge, Azure AD will proactively block the sign-in and return error 500121.

Microsoft Office Security Issues