'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
How to Fix GDAP Application Blocked by Microsoft Entra Conditional Access (AADSTS53003)
Question details
The user needs to resolve an issue where an application managed through GDAP is blocked by Conditional Access policies, preventing token issuance.
- Product
- Microsoft Entra ID (Azure AD)
- Device & OS
- not provided
- Scenario
- Attempting to access or manage an application through Granular Delegated Admin Privileges (GDAP) with cross-tenant access settings enabled.
- Observed behavior
- The system throws error AADSTS53003, indicating that a Conditional Access policy has blocked the token issuance, and the exact sign-in failure event is unclear.
Before reaching out to support, note down your tenant ID, the exact AADSTS53003 error code, and the timestamp of the blocked sign-in attempt to help expedite the investigation.
Submit a Microsoft Support Ticket via Microsoft 365 Admin Center
Because community forums and external responders cannot access your tenant's private diagnostic logs, contacting Microsoft Support directly is the necessary path to investigate backend token-issuance and cross-tenant failures.
Troubleshooting advanced GDAP and Conditional Access issues requires deep visibility into backend Azure AD sign-in logs. Support engineers have the necessary access to safely review your tenant's configuration and pinpoint exactly which policy is triggering the AADSTS53003 block.
Navigate to the Microsoft 365 admin center (admin.microsoft.com) and log in using your Global Administrator or appropriate admin credentials.
On the left-hand navigation menu, click on 'Support' and then select 'Help & support' to open the service request panel.
Type 'GDAP Application Blocked AADSTS53003' into the search bar and press Enter to view related self-help articles.
Click the 'Contact support' button at the bottom of the panel. Fill in the required details, providing your tenant ID, the error code, and timestamps of the failed sign-ins.
Choose your preferred contact method (email or phone) and click 'Submit'. A Microsoft support engineer will reach out to review your sign-in logs and Conditional Access policies.
Looking for a Lightweight Alternative to Microsoft Office?
Dealing with complex Microsoft Entra admin policies and GDAP configurations can be stressful. If you are looking for a simpler, hassle-free office suite for your daily document, spreadsheet, and presentation needs, WPS Office provides a highly compatible and lightweight alternative.
- 1. Visit the Official Website: Go to the official WPS Office website to find the latest free version.
- 2. Download the Installer: Click the 'Free Download' button to download the lightweight setup file to your computer.
- 3. Install and Enjoy: Run the installer, follow the simple on-screen instructions, and start working on your documents immediately.
Frequently Asked Questions
What does error code AADSTS53003 mean?
Error AADSTS53003 signifies that access has been blocked by Microsoft Entra Conditional Access policies. This typically happens when the user, device, or application fails to meet required security conditions, such as being on a trusted network or passing Multi-Factor Authentication (MFA).
Can I fix GDAP application blocks without contacting Microsoft support?
If you are the tenant administrator, you can review your own Conditional Access policies and sign-in logs. However, for complex cross-tenant GDAP token failures, community members cannot access your diagnostic logs, so Microsoft support is usually required to identify the specific policy conflict.
Where can I check Conditional Access policies myself?
You can view and manage active policies by logging into the Microsoft Entra admin center, navigating to 'Protection', and clicking on 'Conditional Access'. From there, you can see which policies might be applying to your GDAP application.
How do I find the specific sign-in logs for this blocked event?
Sign-in logs are located in the Microsoft Entra admin center under 'Identity' > 'Monitoring & health' > 'Sign-in logs'. Filtering these logs by the specific application or user can reveal exactly which Conditional Access policy triggered the block.
