{
  "schemaVersion": "1.0",
  "code": "16000",
  "name": "InteractionRequired",
  "title": "AADSTS16000: Account isn't in the tenant the app uses (fix)",
  "url": "https://brambrinkmeier.com/entra/aadsts/16000/",
  "alternates": {
    "markdown": "https://brambrinkmeier.com/entra/aadsts/16000.md",
    "json": "https://brambrinkmeier.com/api/aadsts/16000.json",
    "html": "https://brambrinkmeier.com/entra/aadsts/16000/"
  },
  "description": "AADSTS16000: the account isn't in the tenant the app uses. Usually a personal account or an uninvited guest. Low attack value. Fix and KQL.",
  "summary": "AADSTS16000 means a user signed in with an account that doesn't exist in the tenant the app sent them to, so it can't use that app there. Usually it's a personal Microsoft account, the wrong account in the browser, or an external user who was never added as a guest. It has low attack value. The fix is to sign in with the right account or invite the user.",
  "inMicrosoftReference": true,
  "unlistedChecked": null,
  "meaningText": "Microsoft's description:\n\n> **InteractionRequired**: User account '{EmailHidden}' from identity provider '{idp}' doesn't exist in tenant '{tenant}' and can't access the application '{appid}'({appName}) in that tenant. This account needs to be added as an external user in the tenant first. Sign out and sign in again with a different Microsoft Entra user account. This error is fairly common when you try to sign in to Microsoft Entra admin center by using personal Microsoft Account and no directory associated with it.\n\nThe user proved who they are at their own identity provider. The tenant the app sent them to has no user or guest object for that account, so the sign-in stops there.\n\nThe wording is almost the same as [50020](https://brambrinkmeier.com/entra/aadsts/50020/). Microsoft doesn't document when Entra returns 16000 and when it returns 50020. Our reading: the name `InteractionRequired` suggests 16000 is the variant returned when the user can fix it by signing in again with another account. Treat the causes and fixes of the two codes as the same.",
  "sections": [
    {
      "heading": "What does AADSTS16000 mean?",
      "text": "Microsoft's description:\n\n> **InteractionRequired**: User account '{EmailHidden}' from identity provider '{idp}' doesn't exist in tenant '{tenant}' and can't access the application '{appid}'({appName}) in that tenant. This account needs to be added as an external user in the tenant first. Sign out and sign in again with a different Microsoft Entra user account. This error is fairly common when you try to sign in to Microsoft Entra admin center by using personal Microsoft Account and no directory associated with it.\n\nThe user proved who they are at their own identity provider. The tenant the app sent them to has no user or guest object for that account, so the sign-in stops there.\n\nThe wording is almost the same as [50020](https://brambrinkmeier.com/entra/aadsts/50020/). Microsoft doesn't document when Entra returns 16000 and when it returns 50020. Our reading: the name `InteractionRequired` suggests 16000 is the variant returned when the user can fix it by signing in again with another account. Treat the causes and fixes of the two codes as the same."
    },
    {
      "heading": "Is it an attack?",
      "text": "No, in almost all cases. Microsoft's description names the most common cause itself: a personal Microsoft account used on the Entra admin center. Microsoft's 50020 troubleshooting article explains that case: *\"you are connected to the Microsoft Services tenant by default. Within the default tenant, there is no linked directory for performing any actions. This behavior is expected.\"*\n\n| Pattern | Likely meaning |\n|---|---|\n| A personal account (outlook.com, hotmail.com) on an Azure or Entra portal | The user picked the wrong account, or has no directory of their own. Benign. |\n| A partner user on one specific app, repeating | The partner was never invited as a guest, or the guest object was deleted. |\n| One user who has both a work and a personal account | The browser silently reused the wrong session. Benign. |\n| Many users from one other company on one app | The app sends everyone to your tenant (a tenant-specific authority) but expects outside users. App or invitation problem. |\n\nThere is no documented attack pattern for 16000. The account has already authenticated at its home, and your tenant refuses it. As far as we can tell, an attacker gains nothing from this error that they didn't already have."
    },
    {
      "heading": "How do I find it in my logs (KQL)?",
      "text": "Microsoft doesn't document which sign-in table 16000 is logged in. Check where it lands in your workspace:\n\n```kusto\nunion withsource=SourceTable SigninLogs, AADNonInteractiveUserSignInLogs\n| where TimeGenerated > ago(7d)\n| where ResultType == \"16000\"\n| summarize Rows = count(), Users = dcount(UserPrincipalName) by SourceTable\n```\n\nWhich apps and which home tenants are involved. `HomeTenantId` is documented as *\"the tenant identifier of the user initiating the sign in\"*, so it tells you which organisation the outside users come from:\n\n```kusto\nSigninLogs\n| where TimeGenerated > ago(7d)\n| where ResultType == \"16000\"\n| summarize Rows = count(),\n            Users = dcount(UserPrincipalName),\n            Sample = make_set(UserPrincipalName, 10)\n          by AppDisplayName, AppId, HomeTenantId, ResourceTenantId\n| sort by Users desc\n```\n\nWe haven't checked this against real data, but the user name may be hidden or empty in these rows, because Microsoft's message template shows `{EmailHidden}`. If `UserPrincipalName` is empty, look at `SignInIdentifier`.\n\nUsers who keep failing with 16000 on the same app and never succeed afterwards. These are the ones that need an invitation or an app change, not a retry:\n\n```kusto\nlet fails =\n    SigninLogs\n    | where TimeGenerated > ago(7d)\n    | where ResultType == \"16000\"\n    | summarize Fails = count(), LastFail = max(TimeGenerated) by UserPrincipalName, AppId, AppDisplayName;\nlet successes =\n    SigninLogs\n    | where TimeGenerated > ago(7d)\n    | where ResultType == \"0\"\n    | summarize LastSuccess = max(TimeGenerated) by UserPrincipalName, AppId;\nfails\n| join kind=leftouter successes on UserPrincipalName, AppId\n| where isnull(LastSuccess) or LastSuccess < LastFail\n| where Fails >= 3\n| project UserPrincipalName, AppDisplayName, Fails, LastFail\n| sort by Fails desc\n```\n\nThe threshold of 3 is a starting point. If the first query shows most rows in `AADNonInteractiveUserSignInLogs`, run the others against that table too. Non-interactive rows are aggregated when application, user, IP address, status and resource ID match, so row counts there are not request counts."
    },
    {
      "heading": "How do I fix AADSTS16000?",
      "text": "**For the user:** sign out, or open a private browser window, and sign in again with your work account. Microsoft's description says to *\"sign in again with a different Microsoft Entra user account\"*. If you used a personal Microsoft account on the Azure or Entra portal and you have no directory of your own, you need to create one; Microsoft's 50020 article says *\"If you aim to have a directory, you must create an Azure account and a new tenant.\"* If you are from another organisation, ask the app owner to invite you as a guest.\n\n**For developers:** check which authority your app uses. Microsoft's 50020 article says that with `https://login.microsoftonline.com/<YourTenantNameOrID>` *\"users from other organizations can't access the application. You have to add these users as guests in the tenant that's specified in the request.\"* If the app is meant for any organisation, use `/organizations` (or `/common` if personal accounts are allowed too), and make sure the app registration's supported account types allow it.\n\n**For admins:**\n1. External user who needs access: invite them as a guest (B2B). Microsoft's description says the account *\"needs to be added as an external user in the tenant first.\"*\n2. Guest that used to work: check whether the guest object was deleted, or whether the home tenant re-created the account. For the second case Microsoft's 50020 article says to reset the guest's redemption status instead of deleting and re-inviting.\n3. Give guests a tenant-specific link. Microsoft's redemption article: *\"A direct link is tenant-specific. In other words, it includes a tenant ID or verified domain so the guest can be authenticated in your tenant.\"*\n4. Many users from one partner on one app: decide whether that app should accept them at all. If yes, invite them, ideally as a group; if no, the error is doing its job."
    }
  ],
  "microsoftWording": {
    "text": "**InteractionRequired**: User account '{EmailHidden}' from identity provider '{idp}' doesn't exist in tenant '{tenant}' and can't access the application '{appid}'({appName}) in that tenant. This account needs to be added as an external user in the tenant first. Sign out and sign in again with a different Microsoft Entra user account. This error is fairly common when you try to sign in to Microsoft Entra admin center by using personal Microsoft Account and no directory associated with it.",
    "source": "Microsoft's error code reference, as quoted on the page",
    "sourceUrl": "https://learn.microsoft.com/en-us/entra/identity-platform/reference-error-codes"
  },
  "securityReading": {
    "category": {
      "id": "b2b-tenant",
      "label": "Guests and tenants"
    },
    "kind": {
      "id": "failure",
      "label": "Failure"
    },
    "attackSignal": {
      "level": "low",
      "label": "Low: usually configuration or user error"
    },
    "mitre": [],
    "tables": [
      "SigninLogs",
      "AADNonInteractiveUserSignInLogs"
    ],
    "isItAnAttack": "No, in almost all cases. Microsoft's description names the most common cause itself: a personal Microsoft account used on the Entra admin center. Microsoft's 50020 troubleshooting article explains that case: *\"you are connected to the Microsoft Services tenant by default. Within the default tenant, there is no linked directory for performing any actions. This behavior is expected.\"*\n\n| Pattern | Likely meaning |\n|---|---|\n| A personal account (outlook.com, hotmail.com) on an Azure or Entra portal | The user picked the wrong account, or has no directory of their own. Benign. |\n| A partner user on one specific app, repeating | The partner was never invited as a guest, or the guest object was deleted. |\n| One user who has both a work and a personal account | The browser silently reused the wrong session. Benign. |\n| Many users from one other company on one app | The app sends everyone to your tenant (a tenant-specific authority) but expects outside users. App or invitation problem. |\n\nThere is no documented attack pattern for 16000. The account has already authenticated at its home, and your tenant refuses it. As far as we can tell, an attacker gains nothing from this error that they didn't already have.",
    "conditionalAccess": null
  },
  "kql": [
    {
      "title": null,
      "leadIn": "Microsoft doesn't document which sign-in table 16000 is logged in. Check where it lands in your workspace:",
      "query": "union withsource=SourceTable SigninLogs, AADNonInteractiveUserSignInLogs\n| where TimeGenerated > ago(7d)\n| where ResultType == \"16000\"\n| summarize Rows = count(), Users = dcount(UserPrincipalName) by SourceTable"
    },
    {
      "title": null,
      "leadIn": "Which apps and which home tenants are involved. `HomeTenantId` is documented as *\"the tenant identifier of the user initiating the sign in\"*, so it tells you which organisation the outside users come from:",
      "query": "SigninLogs\n| where TimeGenerated > ago(7d)\n| where ResultType == \"16000\"\n| summarize Rows = count(),\n            Users = dcount(UserPrincipalName),\n            Sample = make_set(UserPrincipalName, 10)\n          by AppDisplayName, AppId, HomeTenantId, ResourceTenantId\n| sort by Users desc"
    },
    {
      "title": null,
      "leadIn": "Users who keep failing with 16000 on the same app and never succeed afterwards. These are the ones that need an invitation or an app change, not a retry:",
      "query": "let fails =\n    SigninLogs\n    | where TimeGenerated > ago(7d)\n    | where ResultType == \"16000\"\n    | summarize Fails = count(), LastFail = max(TimeGenerated) by UserPrincipalName, AppId, AppDisplayName;\nlet successes =\n    SigninLogs\n    | where TimeGenerated > ago(7d)\n    | where ResultType == \"0\"\n    | summarize LastSuccess = max(TimeGenerated) by UserPrincipalName, AppId;\nfails\n| join kind=leftouter successes on UserPrincipalName, AppId\n| where isnull(LastSuccess) or LastSuccess < LastFail\n| where Fails >= 3\n| project UserPrincipalName, AppDisplayName, Fails, LastFail\n| sort by Fails desc"
    }
  ],
  "kqlSectionText": "Microsoft doesn't document which sign-in table 16000 is logged in. Check where it lands in your workspace:\n\n```kusto\nunion withsource=SourceTable SigninLogs, AADNonInteractiveUserSignInLogs\n| where TimeGenerated > ago(7d)\n| where ResultType == \"16000\"\n| summarize Rows = count(), Users = dcount(UserPrincipalName) by SourceTable\n```\n\nWhich apps and which home tenants are involved. `HomeTenantId` is documented as *\"the tenant identifier of the user initiating the sign in\"*, so it tells you which organisation the outside users come from:\n\n```kusto\nSigninLogs\n| where TimeGenerated > ago(7d)\n| where ResultType == \"16000\"\n| summarize Rows = count(),\n            Users = dcount(UserPrincipalName),\n            Sample = make_set(UserPrincipalName, 10)\n          by AppDisplayName, AppId, HomeTenantId, ResourceTenantId\n| sort by Users desc\n```\n\nWe haven't checked this against real data, but the user name may be hidden or empty in these rows, because Microsoft's message template shows `{EmailHidden}`. If `UserPrincipalName` is empty, look at `SignInIdentifier`.\n\nUsers who keep failing with 16000 on the same app and never succeed afterwards. These are the ones that need an invitation or an app change, not a retry:\n\n```kusto\nlet fails =\n    SigninLogs\n    | where TimeGenerated > ago(7d)\n    | where ResultType == \"16000\"\n    | summarize Fails = count(), LastFail = max(TimeGenerated) by UserPrincipalName, AppId, AppDisplayName;\nlet successes =\n    SigninLogs\n    | where TimeGenerated > ago(7d)\n    | where ResultType == \"0\"\n    | summarize LastSuccess = max(TimeGenerated) by UserPrincipalName, AppId;\nfails\n| join kind=leftouter successes on UserPrincipalName, AppId\n| where isnull(LastSuccess) or LastSuccess < LastFail\n| where Fails >= 3\n| project UserPrincipalName, AppDisplayName, Fails, LastFail\n| sort by Fails desc\n```\n\nThe threshold of 3 is a starting point. If the first query shows most rows in `AADNonInteractiveUserSignInLogs`, run the others against that table too. Non-interactive rows are aggregated when application, user, IP address, status and resource ID match, so row counts there are not request counts.",
  "fix": {
    "short": "User: sign out or open a private window, then sign in with your work account. From another organisation? Ask the app owner to invite you as a guest. Admin: invite the external user as a guest (B2B). Developer: use `/organizations` or `/common` if the app should accept other organisations.",
    "steps": "**For the user:** sign out, or open a private browser window, and sign in again with your work account. Microsoft's description says to *\"sign in again with a different Microsoft Entra user account\"*. If you used a personal Microsoft account on the Azure or Entra portal and you have no directory of your own, you need to create one; Microsoft's 50020 article says *\"If you aim to have a directory, you must create an Azure account and a new tenant.\"* If you are from another organisation, ask the app owner to invite you as a guest.\n\n**For developers:** check which authority your app uses. Microsoft's 50020 article says that with `https://login.microsoftonline.com/<YourTenantNameOrID>` *\"users from other organizations can't access the application. You have to add these users as guests in the tenant that's specified in the request.\"* If the app is meant for any organisation, use `/organizations` (or `/common` if personal accounts are allowed too), and make sure the app registration's supported account types allow it.\n\n**For admins:**\n1. External user who needs access: invite them as a guest (B2B). Microsoft's description says the account *\"needs to be added as an external user in the tenant first.\"*\n2. Guest that used to work: check whether the guest object was deleted, or whether the home tenant re-created the account. For the second case Microsoft's 50020 article says to reset the guest's redemption status instead of deleting and re-inviting.\n3. Give guests a tenant-specific link. Microsoft's redemption article: *\"A direct link is tenant-specific. In other words, it includes a tenant ID or verified domain so the guest can be authenticated in your tenant.\"*\n4. Many users from one partner on one app: decide whether that app should accept them at all. If yes, invite them, ideally as a group; if no, the error is doing its job."
  },
  "labReproduced": null,
  "labSectionText": null,
  "labRuns": [],
  "verification": "documentation",
  "related": [
    "50020",
    "50034",
    "90072",
    "90002"
  ],
  "coveredBy": [],
  "sources": [
    {
      "title": "Microsoft Entra authentication and authorization error codes",
      "url": "https://learn.microsoft.com/en-us/entra/identity-platform/reference-error-codes"
    },
    {
      "title": "Troubleshoot error AADSTS50020 (user account from identity provider does not exist in tenant)",
      "url": "https://learn.microsoft.com/en-us/troubleshoot/azure/entra/entra-id/app-integration/error-code-aadsts50020-user-account-identity-provider-does-not-exist"
    },
    {
      "title": "B2B collaboration invitation redemption",
      "url": "https://learn.microsoft.com/en-us/entra/external-id/redemption-experience"
    },
    {
      "title": "Troubleshoot Microsoft Entra B2B collaboration",
      "url": "https://learn.microsoft.com/en-us/entra/external-id/troubleshoot"
    },
    {
      "title": "Non-interactive user sign-ins",
      "url": "https://learn.microsoft.com/en-us/entra/identity/monitoring-health/concept-noninteractive-sign-ins"
    },
    {
      "title": "SigninLogs table reference (Azure Monitor)",
      "url": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/signinlogs"
    }
  ],
  "published": "2026-10-30",
  "lastUpdated": "2026-10-30",
  "lastVerified": null,
  "license": "CC BY 4.0",
  "licenseUrl": "https://creativecommons.org/licenses/by/4.0/",
  "licenseNote": "CC BY 4.0 covers the author's own text and classification fields. Quoted Microsoft error wording belongs to Microsoft, is quoted with its source and can change.",
  "attribution": "Bram Brinkmeier, \"AADSTS16000: Account isn't in the tenant the app uses (fix)\", https://brambrinkmeier.com/entra/aadsts/16000/ (CC BY 4.0)",
  "microsoftErrorLookup": "https://login.microsoftonline.com/error?code=16000"
}