AADSTS500200: Personal Microsoft account not supported by this app (fix)

What does AADSTS500200 mean?

Microsoft’s error code reference doesn’t list AADSTS500200 (checked 30 October 2026).

We found no Microsoft documentation page for it either. The wording below comes from user reports on Microsoft Q&A. Two separate threads quote the same message:

AADSTS500200: User account ‘…’ is a personal Microsoft account. Personal Microsoft accounts are not supported for this application unless explicitly invited to an organization. Try signing out and signing back in with an organizational account.

A personal Microsoft account (for example Outlook.com, or a Gmail address used as a Microsoft account) tried to sign in to an app that only accepts work or school accounts. The message itself names two ways out: an invitation to the organization, or a work account.

A Microsoft employee answering in the first thread gives the cause as the app’s supported account type: “If your app registration is set to a single-tenant account type, users from other directories or identity providers can’t sign into that application.” He says to make sure the user “was invited to your Azure AD tenant, or that the App you’re trying to sign into allows AzureADandPersonalMicrosoftAccount.”

That matches what Microsoft documents about account types. An app registration’s signInAudience decides who can sign in. Microsoft’s supported account types page lists four values:

signInAudience	Label in the app registration
AzureADMyOrg	Accounts in this organizational directory only (Single tenant)
AzureADMultipleOrgs	Accounts in any organizational directory (Multitenant)
AzureADandPersonalMicrosoftAccount	Accounts in any organizational directory and personal Microsoft accounts (such as Skype, Xbox)
PersonalMicrosoftAccount	Personal Microsoft accounts only

Only the last two take a personal account that hasn’t been invited. The authority the app signs in through matters too. Microsoft’s MSAL configuration page says /organizations signs in “users with work and school accounts”, a tenant-specific authority signs in “users of a specific organization only”, and only /common and /consumers take personal accounts. Our reading: an app on /organizations or a tenant authority gets this error for a personal account even when the registration allows personal accounts. We have not tested that.

Is it an attack?

No. It is an account-type mismatch. The account is real, but the app doesn’t accept that kind of account.

Pattern	Likely meaning
One person, a consumer address (outlook.com, gmail.com)	They used a personal account where a work account is needed. Benign.
Users report it on Microsoft 365 apps on a phone while editing their own documents	In the second thread, one user with a Microsoft 365 Family account gets it when editing on Android, and another only in the OneNote Android app. Likely the app was routed to a work-account sign-in, but that is unconfirmed. Not something an admin can fix.
Users report it on the Microsoft Learn sandbox	Same thread. The sandbox needs a work account in a tenant.
An external partner using a personal address, hitting one of your apps	They were never invited as a guest. Invite them if they need access.
A developer’s own app, right after registration	The registration is single tenant or multitenant without personal accounts.

We found no source that links 500200 to an attack pattern. The sign-in fails before any of your resources are reached.

How do I find it in my logs (KQL)?

Microsoft doesn’t document which sign-in table 500200 is logged in, or whether it is logged in your tenant at all. Our reading: a personal account that was never invited has no user object in your tenant, so a row may not appear there. Check first:

union withsource=SourceTable SigninLogs, AADNonInteractiveUserSignInLogs, AADServicePrincipalSignInLogs
| where TimeGenerated > ago(30d)
| where ResultType == "500200"
| summarize Rows = count() by SourceTable

If rows exist, see which apps and which home tenants they come from. HomeTenantId is documented as “the tenant identifier of the user initiating the sign in”:

SigninLogs
| where TimeGenerated > ago(30d)
| where ResultType == "500200"
| summarize Attempts = count(), Users = dcount(UserPrincipalName), Sample = make_set(UserPrincipalName, 10)
          by AppDisplayName, AppId, HomeTenantId
| sort by Attempts desc

How do I fix AADSTS500200?

For the user: sign out and sign in again with your work or school account, as the message says. If you don’t have one for this organization, ask its admin to invite you. Volunteer moderators on Q&A suggest trying a private browser window first, in case the browser keeps signing you in with the personal account. One user in the second thread says that didn’t help.

For developers:

1. Check Supported account types in the app registration, or signInAudience in the manifest. If personal accounts must work, use AzureADandPersonalMicrosoftAccount. Microsoft warns: “If you change this property you may need to change other properties first.” Personal-account audiences have extra limits, for example no national clouds and at most two client secrets.
2. Sign in through /common (work and personal accounts) or /consumers (personal only). /organizations and a tenant ID only take work and school accounts.
3. In a comment on the first Q&A thread, one user reports the error with signInAudience set to AzureADandPersonalMicrosoftAccount and accessTokenAcceptedVersion set to 2, on an Azure App Service site. Nobody replied to that comment. If you hit the same, check the authority in the app’s configuration (point 2), which is our best guess, not a confirmed cause.

For admins:

1. If the person needs access to your app, invite them as a guest. Microsoft says B2B guests “can use their own personal Microsoft accounts for B2B collaboration without further configuration.”
2. If the app is a third-party product that should accept personal accounts, that is the vendor’s registration to change, not yours.