What you’re seeing
- Sign-in to Microsoft 365, Outlook on the web or SharePoint fails with error AADSTS500192.
- The failure happens right after choosing a certificate from the smart card or CAC prompt.
- Signing in works on one computer but not another with the same card.
- The certificate picker shows more than one certificate for the same card.
Common causes
Every environment is different, but these are the causes our engineers find most often:
- The card holds several certificates, such as authentication, signing and encryption, and the wrong one is being presented.
- The certificate presented does not match the user binding configured for certificate-based authentication in Microsoft Entra ID.
- The user's UPN or alternate identifier in the directory does not match the value stored on the certificate.
- Middleware or card reader drivers on that PC expose certificates differently than on working machines.
- The issuing certificate authority or its revocation list is not trusted or reachable by the tenant.
Why it matters
Organizations that use smart cards or CACs usually do so because of government or regulatory requirements, so there is no easy password fallback. A failing certificate sign-in locks the user out of email, files and Teams entirely. Contractors serving federal agencies can miss deliverables, and repeated failures may lead staff to request policy exceptions that weaken the security model the cards exist to enforce.
How AskTechGurus fixes it
Skip the trial and error. A certified engineer works on your actual system, finds the root cause, and fixes it properly.
Tell us what’s happening
Submit a ticket in about two minutes. Paste the error, describe what changed, and pick your tier. No charge to submit.
A certified engineer diagnoses it
A vetted, US-based systems engineer claims your ticket, usually within minutes during business hours, and investigates over a secure remote session you can watch and end at any time.
Fixed and verified with you
The engineer resolves the root cause and confirms with you that it’s working. You don’t just get a workaround, and you get a plain-English summary of what was wrong.
Pay only when it’s resolved
Fixed price from $99, invoiced only after you approve the fix. If it isn’t resolved, you don’t pay.
Frequently asked questions
Does the user need a new smart card?
Usually not. The card is typically fine; the issue is which certificate is chosen or how the tenant maps it to the account.
Will a fix change how everyone else signs in?
We look at the specific user, device and certificate first, and only adjust tenant-wide settings if the evidence shows they are the cause.