What causes AADSTS90006?

Transient outage or throttling in a downstream Entra ID dependency (token issuance backend, MFA service, or claims provider). Federated identity provider (ADFS, third-party SAML/OIDC IdP) momentarily unreachable or slow during token exchange. Brief Microsoft Entra ID regional incident — often visible on the Azure Service Health / status.azure.com page. Conditional Access policy evaluation timing out against an external signal source (e.g. device compliance, risk evaluation). High-volume burst of sign-ins from a single tenant hitting backend retry limits during a Power BI / Fabric refresh wave

How do I fix AADSTS90006?

Retry the sign-in or refresh after 30–60 seconds — AADSTS90006 is explicitly marked retryable by Microsoft and usually clears on its own. Check the Azure status page (status.azure.com) and the Microsoft 365 Service Health dashboard for an active Entra ID / Authentication incident in your region. If you use a federated IdP (ADFS, Okta, Ping), verify that IdP is healthy — failures there surface as AADSTS90006 in Entra ID. For Power BI scheduled refreshes or ADF pipelines: enable retry-on-failure (Power BI: configure retry; ADF: set retry count ≥ 2 with a 30-60s interval) so transient AADSTS90006 doesn't fail the whole run. If the error persists for more than ~15 minutes across multiple users, open a support ticket with Microsoft including the correlation ID and timestamp from the error — this is on Microsoft's side to fix

Low severityauthentication

Power BI Error:
AADSTS90006

What does this error mean?

Microsoft Entra ID (Azure AD) returned a transient downstream service failure during token issuance — retry usually succeeds.

Common causes

1Transient outage or throttling in a downstream Entra ID dependency (token issuance backend, MFA service, or claims provider)
2Federated identity provider (ADFS, third-party SAML/OIDC IdP) momentarily unreachable or slow during token exchange
3Brief Microsoft Entra ID regional incident — often visible on the Azure Service Health / status.azure.com page
4Conditional Access policy evaluation timing out against an external signal source (e.g. device compliance, risk evaluation)
5High-volume burst of sign-ins from a single tenant hitting backend retry limits during a Power BI / Fabric refresh wave

How to fix it

1Retry the sign-in or refresh after 30–60 seconds — AADSTS90006 is explicitly marked retryable by Microsoft and usually clears on its own
2Check the Azure status page (status.azure.com) and the Microsoft 365 Service Health dashboard for an active Entra ID / Authentication incident in your region
3If you use a federated IdP (ADFS, Okta, Ping), verify that IdP is healthy — failures there surface as AADSTS90006 in Entra ID
4For Power BI scheduled refreshes or ADF pipelines: enable retry-on-failure (Power BI: configure retry; ADF: set retry count ≥ 2 with a 30-60s interval) so transient AADSTS90006 doesn't fail the whole run
5If the error persists for more than ~15 minutes across multiple users, open a support ticket with Microsoft including the correlation ID and timestamp from the error — this is on Microsoft's side to fix

Frequently asked questions

What does AADSTS90006 mean?

The service is temporarily unavailable.

How do I fix this error?

Check your application registration, token configuration, and user permissions in the Azure portal. Review Conditional Access policies if the error is policy-related.

Source · learn.microsoft.com/en-us/entra/identity-platform/reference-error-codes#aadsts-error-codes