What you’re seeing
- An error page reading "AADSTS50105: Your administrator has configured the application to block users unless they are specifically granted access".
- Some employees open the business app through Microsoft sign-in without trouble, while others are turned away at the same step.
- A newly hired staff member is blocked even though their password and MFA work everywhere else.
- The app tile appears in My Apps for some people and is missing for others.
Common causes
Every environment is different, but these are the causes our engineers find most often:
- The enterprise application requires explicit user assignment, and the affected users or their group were never added to it.
- Access is granted through a nested group, which many enterprise apps do not honor for assignment.
- Group-based assignment needs a Microsoft Entra ID P1 or P2 license, and the tenant only has free-tier licensing.
- The user was assigned to a different copy of the app, such as a test or duplicate enterprise application.
- A recent group cleanup or offboarding script removed members from the group the app depends on.
Why it matters
Single sign-on is meant to make access simpler and safer, but when assignments are wrong it locks out the very people who need the tool. New hires lose their first days waiting on access, and existing staff get blocked mid-project from payroll, ticketing or line-of-business apps. Workarounds like shared logins quickly creep in, which undermines the security that SSO was supposed to provide and leaves no clear record of who did what.
How AskTechGurus fixes it
Skip the trial and error. A certified engineer works on your actual system, finds the root cause, and fixes it properly.
Tell us what’s happening
Submit a ticket in about two minutes. Paste the error, describe what changed, and pick your tier. No charge to submit.
A certified engineer diagnoses it
A vetted, US-based systems engineer claims your ticket, usually within minutes during business hours, and investigates over a secure remote session you can watch and end at any time.
Fixed and verified with you
The engineer resolves the root cause and confirms with you that it’s working. You don’t just get a workaround, and you get a plain-English summary of what was wrong.
Pay only when it’s resolved
Fixed price from $99, invoiced only after you approve the fix. If it isn’t resolved, you don’t pay.
Frequently asked questions
Why does it work for some users and not others?
The app is set to let in only assigned users or groups. Anyone not on that list, directly or through a supported group, gets AADSTS50105.
They are in the right group. Why are they still blocked?
Nested groups and licensing limits are the usual reasons. Many apps only recognize direct group membership, and group assignment itself requires premium Entra licensing.
How long does it usually take to fix?
Assignment problems are often resolved in a single remote session with one of our certified US engineers, and you pay only when access is working.