Auth0 Error AADSTS50076 Occurs With Microsoft Azure Active Directory Enterprise Connections

An error occurs when a user attempts to sign in using a Microsoft Azure Active Directory (Azure AD) enterprise connection in Auth0. Azure AD enforcing Multi-Factor Authentication (MFA) due to risky sign-in detection, Conditional Access (CA) policies, or Entra ID enforcement causes this issue. Resolve this error by adjusting the MFA and CA configurations directly within the Azure AD environment.

The user encounters the following error message despite having previously signed in successfully with the same connection:

Error AADSTS50076: Due to a configuration change made by your administrator, or because you moved to a new location, you must use multi-factor authentication to access '<>'

• Auth0
• Microsoft Azure Active Directory (Azure AD)
• Enterprise Connections

This error occurs for one of the following reasons:

• Azure AD risky sign-in detection flags sign-ins from new or significantly different geographical locations as potentially risky. This detection automatically enforces CA policies, which require MFA for access.
• An MFA requirement or a CA policy blocks the administrator account. An exception exists if the administrator configures an IP address exclusion for the account that bypasses the MFA requirement.
• The Microsoft Entra ID instance enforces MFA.

How is the Microsoft Azure Active Directory error AADSTS50076 resolved?

The issue originates from the Azure AD Identity Provider (IdP) configuration. Updating the Auth0 configuration does not resolve the issue.

Confirm the correct configuration on Azure AD by reviewing the risky sign-in detection flags, CA policies, and Entra ID enforcement settings.

• Risky sign-in detection flags enforce MFA: Review the grant flow to confirm if it does not support MFA, which prevents flagged users from using MFA in the Azure AD authentication.
• CA policies enforce MFA on the account: Exclude the application from the conflicting CA rule. Create a new CA rule explicitly targeted to this application that requires MFA for all access without IP address exclusions. If the business use case allows, disable Microsoft Azure Security Defaults, as they conflict with granular CA policies.
• Microsoft Entra ID instance enforces MFA: If the business use case allows, disable MFA enforcement policies for the account used for the Azure AD sync under security management.

Examine the sign-in logs in Azure AD for more details by checking for failed login entries with the description "failed to obtain access token from the Azure AD connection" that experience the AADSTS50076 error. If consistent errors appear for specific users, the issue originates from the IdP MFA handling.