'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
How to Fix Microsoft OAuth 2 Authentication Error AADSTS50079 with MFA Enabled
Question details
An OAuth 2 token request fails with error AADSTS50079 when multifactor authentication (MFA) is required, but it succeeds when MFA is disabled.
- Product
- Microsoft Entra ID
- Device & OS
- not provided
- Scenario
- Requesting an OAuth 2 authentication token in an environment that enforces multifactor authentication.
- Observed behavior
- The authentication flow is interrupted and the system returns error code AADSTS50079 because the current token flow cannot process the required MFA prompt.
Ensure you have administrator access to the Microsoft Entra ID portal and verify what specific token grant type your application is currently using.
Review Entra ID Conditional Access Policies and Update Token Flow
Ensure your OAuth flow supports interactive authentication and verify whether Conditional Access rules are forcing MFA unexpectedly.
Error AADSTS50079 typically occurs because the application is using a non-interactive OAuth 2 flow (such as Resource Owner Password Credentials) while the organization's policies strictly enforce MFA. Non-interactive flows cannot prompt the user for a secondary authentication factor.
Log into the portal using an account with Conditional Access Administrator privileges.
Navigate to the 'Protection' menu on the left sidebar and select 'Conditional Access'.
Review your enabled policies to see if MFA is strictly enforced for your target application, specific user groups, or based on sign-in risk.
If MFA is intentionally required, update your application's authentication code to use an MFA-capable interactive flow, such as the Authorization Code flow or Device Code flow.
Consult Microsoft Q&A for Advanced Troubleshooting
If you have verified your policies and flows but the issue persists, seek specialized assistance from Microsoft support engineers.
Looking for a Simpler Productivity Solution? Try WPS Office
Complex authentication systems and restrictive cloud policies can sometimes slow down your workflow. If you need a hassle-free, lightweight, and highly compatible productivity suite, WPS Office provides an excellent alternative for your daily document needs.
Frequently Asked Questions
What does error AADSTS50079 mean in Microsoft OAuth 2?
Error AADSTS50079 indicates that multi-factor authentication (MFA) is required by an active policy (such as Conditional Access), but the authentication flow being used does not support prompting the user to complete the MFA challenge.
Which OAuth 2 flows support MFA in Microsoft Entra ID?
Interactive flows, such as the Authorization Code flow and the Device Code flow, support MFA. These flows allow a browser or interactive prompt to securely ask the user for their secondary authentication factor.
Can using a VPN trigger an MFA requirement in Microsoft Entra ID?
Yes. Connecting through a VPN changes your IP address and perceived login location. If your organization relies on risk-based Conditional Access policies, logging in from an unfamiliar IP address can trigger an immediate and mandatory MFA prompt.
