Guest sign-in errors in Microsoft Entra ID: AADSTS90072, AADSTS50020 and cross-tenant blocks

A partner accepts your invitation, or thinks they did, and then can't open the Teams channel, SharePoint site or app you shared. The error says the account doesn't exist in your tenant, even though you can see the guest in the directory. In this post I'll show how to work out which account, invitation or policy is at fault, on your side or the guest's, and how to fix it.

Symptoms#

The guest signs in and gets one of these on the Microsoft sign-in page:

AADSTS90072: User account '...' from identity provider '...' does not exist in tenant '...' and cannot access the application '...' in that tenant. The account needs to be added as an external user in the tenant first.

AADSTS50020: User account '...' from identity provider '...' does not exist in tenant '...' and cannot access the application '...' in that tenant. This account needs to be added as an external user in the tenant first.

Your network administrator has restricted what organizations can be accessed. Contact your IT department to unblock access.

Inviting can fail too, with "This invitation is blocked by cross-tenant access settings." Teams shared channel users (B2B direct connect) can see "AADSTS90071: An admin from ... must update their access settings to accept inbound multifactor authentication."

Why it happens#

An invitation creates a guest user in your tenant tied to an email address. On redemption, Microsoft Entra ID looks for the guest's home identity (a work account in their own tenant, a configured identity provider or a personal Microsoft account) and links it to the guest object. Errors follow when that link is missing or wrong:

• Wrong account. The guest is signed in with a personal account or a second work account, not the one that was invited. The error names the identity provider, such as live.com, which gives this away.
• Not invited, or invitation pending. The guest object doesn't exist, or hasn't been redeemed.
• Home identity changed. The guest's account was deleted and re-created, or they moved company or want to use a different email.
• Policy. Cross-tenant access settings block the user or app on either side, or the guest's network uses tenant restrictions.
• Home organization rules. The guest's admin may prevent email-verified users from being created, or a federated user may not be synced to Microsoft Entra ID yet.

How to fix it#

1. Read the sign-in log#

In your tenant, open Entra ID › Monitoring & health › Sign-in logs, filter on the guest and add the Cross tenant access type filter. The entry shows the error code, the application and the home and resource tenants, which tells you which account the guest really used.

2. Check the guest object#

Connect-MgGraph -Scopes "User.Read.All"
Get-MgUser -Filter "mail eq 'alex@fabrikam.com'" `
    -Property DisplayName, UserPrincipalName, UserType, ExternalUserState, ExternalUserStateChangeDateTime |
    Select-Object DisplayName, UserPrincipalName, UserType, ExternalUserState, ExternalUserStateChangeDateTime

No result means there's no guest to sign in to: invite them. PendingAcceptance means the invitation was never redeemed; resend it or send a tenant-specific link such as https://myapps.microsoft.com?tenantId= followed by your tenant ID.

3. Fix the account mix-up#

Ask the guest to sign out of every Microsoft account or use a private window, then sign in with the exact invited address. Apps that send users to a generic sign-in endpoint can authenticate the guest against their home tenant instead of yours, so give guests tenant-specific links.

4. Reset redemption status#

If the guest redeemed with the wrong identity, or their home account changed, reset the redemption instead of deleting the user. Object ID, group memberships and app assignments are kept. With the Helpdesk Administrator or User Administrator role, open Entra ID › Users › the guest › Overview, select Reset redemption status in the B2B collaboration tile, then Reset. To change the sign-in email, update Email and Other emails first. With PowerShell:

Connect-MgGraph -Scopes "User.Invite.All","User.ReadWrite.All"
$user = Get-MgUser -Filter "startsWith(mail, 'alex@fabrikam.com')"
New-MgInvitation -InvitedUserEmailAddress $user.Mail `
    -InviteRedirectUrl "https://myapps.microsoft.com" `
    -ResetRedemption -SendInvitationMessage -InvitedUser $user

5. Check cross-tenant access on both sides#

AADSTS500213 is your side: review Entra ID › External Identities › Cross-tenant access settings, the default and any organizational settings, and their Inbound access › B2B collaboration users, groups and applications. AADSTS500212 is the guest's side: their admin must allow your tenant in their outbound settings. A blocked invitation can be either side. Also check the allow or deny domain list in External collaboration settings. The cross-tenant access settings guide explains each setting.

6. Problems in the guest's organization#

• Network restriction message or AADSTS500021: the guest's IT must add your tenant to their tenant restrictions policy.
• "Invitee's Admin has disallowed EmailVerified Users from being created in their tenant": their admin must allow email-verified users, or provide a proper account.
• Federated domain, user not in Microsoft Entra ID: their admin must sync the account before it can be invited.
• No invitation email: allow Invites@microsoft.com in their spam filtering.
• AADSTS90071 in a Teams shared channel: the host organization must trust inbound MFA in its cross-tenant access settings.

Verify the fix#

• The guest's ExternalUserState is Accepted.
• The guest opens a tenant-specific link and reaches the resource without an error.
• Your sign-in log shows Success with the right home tenant, and the Conditional Access tab shows which policies applied. If MFA is now the blocker, see AADSTS50076, AADSTS50079 and AADSTS50158; for policy blocks, AADSTS53000 vs AADSTS53003.

Prevent it next time#

• Invite the address the guest will actually sign in with, and send tenant-specific links rather than generic portal URLs.
• Configure organizational cross-tenant settings for regular partners, and agree on inbound and outbound rules with their admins before a project starts.
• Trust partner MFA where appropriate, so guests don't register a second set of methods in your tenant.
• Review guests stuck in PendingAcceptance regularly. More codes are in the AADSTS error codes quick reference.

References#

• Troubleshoot common issues with Microsoft Entra B2B collaboration
• Reset the redemption status for a guest user
• Microsoft Entra authentication and authorization error codes