# AADSTS500200: Personal Microsoft account not supported by this app (fix)

Canonical: https://brambrinkmeier.com/entra/aadsts/500200/
By Bram Brinkmeier. JSON: https://brambrinkmeier.com/api/aadsts/500200.json

**Short answer:** AADSTS500200 means someone signed in with a personal Microsoft account (for example Outlook.com, or a Gmail address used as a Microsoft account) to an app or tenant that only accepts work or school accounts. Microsoft's error reference doesn't list it. It has low attack value. Sign in with a work account, invite the person as a guest, or change the app's supported account types.

**Fix:** User: sign out and sign in with your work or school account, or ask the organization's admin to invite you. Admin: invite the person as a guest. Developer: set Supported account types to AzureADandPersonalMicrosoftAccount and sign in through /common or /consumers.

| Field | Value |
|---|---|
| Code | AADSTS500200 |
| Category | App configuration |
| Type | Configuration error |
| Attack signal | Low: usually configuration or user error |
| In Microsoft's error reference | No (checked 2026-10-30) |
| Verification | documentation |
| Last updated | 2026-10-30 |

## What does AADSTS500200 mean?

Microsoft's [error code reference](https://learn.microsoft.com/entra/identity-platform/reference-error-codes) doesn't list AADSTS500200 (checked 30 October 2026).

We found no Microsoft documentation page for it either. The wording below comes from user reports on Microsoft Q&A. Two separate threads quote the same message:

> AADSTS500200: User account '…' is a personal Microsoft account. Personal Microsoft accounts are not supported for this application unless explicitly invited to an organization. Try signing out and signing back in with an organizational account.

A personal Microsoft account (for example Outlook.com, or a Gmail address used as a Microsoft account) tried to sign in to an app that only accepts work or school accounts. The message itself names two ways out: an invitation to the organization, or a work account.

A Microsoft employee answering in the [first thread](https://learn.microsoft.com/en-us/answers/questions/1059353/aadsts500200-user-account-is-a-personal-microsoft) gives the cause as the app's supported account type: *"If your app registration is set to a single-tenant account type, users from other directories or identity providers can't sign into that application."* He says to make sure the user *"was invited to your Azure AD tenant, or that the App you're trying to sign into allows `AzureADandPersonalMicrosoftAccount`."*

That matches what Microsoft documents about account types. An app registration's `signInAudience` decides who can sign in. Microsoft's [supported account types page](https://learn.microsoft.com/entra/identity-platform/supported-accounts-validation) lists four values:

| `signInAudience` | Label in the app registration |
|---|---|
| `AzureADMyOrg` | Accounts in this organizational directory only (Single tenant) |
| `AzureADMultipleOrgs` | Accounts in any organizational directory (Multitenant) |
| `AzureADandPersonalMicrosoftAccount` | Accounts in any organizational directory and personal Microsoft accounts (such as Skype, Xbox) |
| `PersonalMicrosoftAccount` | Personal Microsoft accounts only |

Only the last two take a personal account that hasn't been invited. The authority the app signs in through matters too. Microsoft's MSAL configuration page says `/organizations` signs in *"users with work and school accounts"*, a tenant-specific authority signs in *"users of a specific organization only"*, and only `/common` and `/consumers` take personal accounts. Our reading: an app on `/organizations` or a tenant authority gets this error for a personal account even when the registration allows personal accounts. We have not tested that.

## Is it an attack?

No. It is an account-type mismatch. The account is real, but the app doesn't accept that kind of account.

| Pattern | Likely meaning |
|---|---|
| One person, a consumer address (outlook.com, gmail.com) | They used a personal account where a work account is needed. Benign. |
| Users report it on Microsoft 365 apps on a phone while editing their own documents | In the [second thread](https://learn.microsoft.com/en-us/answers/questions/1476251/how-to-fix-error-aadsts500200-user-account-is-a-pe), one user with a Microsoft 365 Family account gets it when editing on Android, and another only in the OneNote Android app. Likely the app was routed to a work-account sign-in, but that is unconfirmed. Not something an admin can fix. |
| Users report it on the Microsoft Learn sandbox | Same thread. The sandbox needs a work account in a tenant. |
| An external partner using a personal address, hitting one of your apps | They were never invited as a guest. Invite them if they need access. |
| A developer's own app, right after registration | The registration is single tenant or multitenant without personal accounts. |

We found no source that links 500200 to an attack pattern. The sign-in fails before any of your resources are reached.

## How do I find it in my logs (KQL)?

Microsoft doesn't document which sign-in table 500200 is logged in, or whether it is logged in your tenant at all. Our reading: a personal account that was never invited has no user object in your tenant, so a row may not appear there. Check first:

```kusto
union withsource=SourceTable SigninLogs, AADNonInteractiveUserSignInLogs, AADServicePrincipalSignInLogs
| where TimeGenerated > ago(30d)
| where ResultType == "500200"
| summarize Rows = count() by SourceTable
```

If rows exist, see which apps and which home tenants they come from. `HomeTenantId` is documented as *"the tenant identifier of the user initiating the sign in"*:

```kusto
SigninLogs
| where TimeGenerated > ago(30d)
| where ResultType == "500200"
| summarize Attempts = count(), Users = dcount(UserPrincipalName), Sample = make_set(UserPrincipalName, 10)
          by AppDisplayName, AppId, HomeTenantId
| sort by Attempts desc
```

## How do I fix AADSTS500200?

**For the user:** sign out and sign in again with your work or school account, as the message says. If you don't have one for this organization, ask its admin to invite you. Volunteer moderators on Q&A suggest trying a private browser window first, in case the browser keeps signing you in with the personal account. One user in the second thread says that didn't help.

**For developers:**
1. Check **Supported account types** in the app registration, or `signInAudience` in the manifest. If personal accounts must work, use `AzureADandPersonalMicrosoftAccount`. Microsoft warns: *"If you change this property you may need to change other properties first."* Personal-account audiences have extra limits, for example no national clouds and at most two client secrets.
2. Sign in through `/common` (work and personal accounts) or `/consumers` (personal only). `/organizations` and a tenant ID only take work and school accounts.
3. In a comment on the first Q&A thread, one user reports the error with `signInAudience` set to `AzureADandPersonalMicrosoftAccount` and `accessTokenAcceptedVersion` set to 2, on an Azure App Service site. Nobody replied to that comment. If you hit the same, check the authority in the app's configuration (point 2), which is our best guess, not a confirmed cause.

**For admins:**
1. If the person needs access to your app, invite them as a guest. Microsoft says B2B guests *"can use their own personal Microsoft accounts for B2B collaboration without further configuration."*
2. If the app is a third-party product that should accept personal accounts, that is the vendor's registration to change, not yours.

## Evidence

Not in Microsoft's error reference and not reproduced in the lab; built from lab results, other Microsoft pages and user reports, which the page names.

## Sources

1. [Microsoft Entra authentication and authorization error codes](https://learn.microsoft.com/en-us/entra/identity-platform/reference-error-codes)
2. [Microsoft Q&A: AADSTS500200: User account is a personal Microsoft account](https://learn.microsoft.com/en-us/answers/questions/1059353/aadsts500200-user-account-is-a-personal-microsoft)
3. [Microsoft Q&A: How to fix error AADSTS500200](https://learn.microsoft.com/en-us/answers/questions/1476251/how-to-fix-error-aadsts500200-user-account-is-a-pe)
4. [Validation differences by supported account types (signInAudience)](https://learn.microsoft.com/entra/identity-platform/supported-accounts-validation)
5. [Client application configuration (MSAL)](https://learn.microsoft.com/en-us/entra/identity-platform/msal-client-application-configuration)
6. [Use Microsoft accounts (MSA) for B2B collaboration](https://learn.microsoft.com/entra/external-id/microsoft-account)
7. [SigninLogs table reference (Azure Monitor)](https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/signinlogs)

## Related codes

[AADSTS50020](https://brambrinkmeier.com/entra/aadsts/50020/), [AADSTS90072](https://brambrinkmeier.com/entra/aadsts/90072/), [AADSTS50034](https://brambrinkmeier.com/entra/aadsts/50034/), [AADSTS700016](https://brambrinkmeier.com/entra/aadsts/700016/)

## License and citation

CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). CC BY 4.0 covers the author's own text and classification fields. Quoted Microsoft error wording belongs to Microsoft, is quoted with its source and can change.

Cite as: Bram Brinkmeier, "AADSTS500200: Personal Microsoft account not supported by this app (fix)", https://brambrinkmeier.com/entra/aadsts/500200/ (CC BY 4.0), last updated 2026-10-30.