Low severityauthentication
Power BI Error:
AADSTS50002, Restricted Tenant Policy Blocks Sign-In
What does this error mean?
Sign-in is blocked because the user's tenant is not on the resource tenant's allowed (cross-tenant access) list.
Common causes
- 1Tenant Restrictions v1/v2 policy on the network or proxy blocks authentication to non-allowed tenants
- 2Cross-tenant access settings (External Identities) deny inbound or outbound access to the user's home tenant
- 3Conditional Access or a location-based policy restricts sign-ins from the current network
- 4B2B guest user's home tenant is not in the resource tenant's allowed partner list
- 5Corporate proxy injects Restrict-Access-To-Tenants header that excludes the target tenant
How to fix it
- 1Identify the user's home tenant ID and the resource tenant ID from the sign-in log in Entra ID > Sign-in logs (filter on Correlation ID)
- 2In Entra ID > External Identities > Cross-tenant access settings, add the user's home tenant to Organizational settings and allow inbound B2B collaboration
- 3If a proxy enforces Tenant Restrictions, update the Restrict-Access-To-Tenants HTTP header (or TRv2 policy) to include the required tenant ID
- 4Review Conditional Access policies for location/network conditions that exclude the sign-in's IP and grant an exception or trusted-location entry
- 5For Power BI / Fabric scheduled refresh or ADF linked services, ensure the service principal or gateway account belongs to a tenant that is allowed by both sides