Low severityauthentication
Power BI Error:
AADSTS51004, User Account Not in Directory: Causes & Fix
What does this error mean?
The signing-in user does not exist in the Microsoft Entra ID (Azure AD) tenant the application is authenticating against.
Common causes
- 1Application is registered as single-tenant (authority login.microsoftonline.com/<tenant-id>) while the user belongs to a different Entra ID tenant
- 2External user was expected to access the tenant but was never invited as a B2B guest, or never accepted the invitation
- 3User signs in with a personal Microsoft account (MSA) on a tenant that only accepts work/school accounts (signInAudience mismatch)
- 4User was recently deleted, soft-deleted, or migrated between tenants and no longer exists in the target directory
- 5Power BI / Fabric / ADF data source or service principal is configured against the wrong tenant in a cross-tenant sharing scenario
How to fix it
- 1Verify in the Entra admin center → Users that the UPN actually exists in the target tenant — if it isn't there, that is the root cause and no app-side fix will help
- 2Check the authority URL in the app registration: if the app must accept users from multiple tenants, change it to /organizations or /common and set signInAudience to AzureADMultipleOrgs
- 3If the user is external, invite them via Entra ID → External Identities → Invite user as a B2B guest and have them accept the invitation email before retrying sign-in
- 4For Power BI / Fabric cross-tenant data sharing, open Entra ID → External Identities → Cross-tenant access settings and confirm inbound access from the user's home tenant is allowed for the relevant apps
- 5If the user signed in with a personal Microsoft account, have them sign out completely and re-authenticate with the work/school account that belongs to the target tenant
Beyond the docs
Common practitioner solutions not covered in the official documentation.
- 1PowerShell: Check if the user exists in the tenant — Get-MgUser -Filter "userPrincipalName eq 'user@domain.com'" | Select-Object Id, DisplayName, UserType, AccountEnabled
- 2PowerShell: Check B2B guest invitation status for an external user — Get-MgUser -Filter "mail eq 'external@otherdomain.com'" | Select-Object UserPrincipalName, UserType, ExternalUserState
- 3Multi-tenant app: If your app is registered as single-tenant (authority contains a specific tenant ID), users from other tenants get AADSTS51004. Change Supported account types to 'Accounts in any organizational directory' in App registrations → Authentication
- 4Tenant mismatch: Confirm the user is authenticating against the correct tenant. In the Entra sign-in log, compare the 'Home tenant ID' field with the tenant where the app is registered — a mismatch means the user is in the wrong directory
- 5Guest invitation: If the user is external, they must be invited as a B2B guest first. Entra ID → Users → Invite external user — then the user must redeem the invitation before sign-in is possible
Example log output
# MSAL / Azure SDK error:
AADSTS51004: The user account <user@domain.com> does not exist in the tenant '<tenant-id>'.
To sign into this application, the account must be added to the tenant.
# Power BI embed token request failure (REST API):
{
"error": "invalid_grant",
"error_description": "AADSTS51004: The user account does not exist in the tenant."
}