Low severityauthentication
Power BI Error:
AADSTS901012
What does this error mean?
Sign-in via external OIDC identity provider failed because the ID token does not contain a verified email claim.
Common causes
- 1External OIDC identity provider (e.g. Google, Okta, custom IdP) returned an ID token without the `email_verified` claim, or with `email_verified: false`
- 2The user's email address at the external IdP has never been confirmed (no verification link clicked)
- 3External IdP is misconfigured and does not include email verification status in its OIDC claims mapping
- 4Federation/SAML-to-OIDC bridge strips or omits the `email_verified` claim during token transformation
- 5Guest/B2B invitation flow where the inviting tenant requires verified email but the home IdP does not enforce verification
How to fix it
- 1At the external OIDC identity provider, verify the user's email address (resend verification mail and have the user click the confirmation link)
- 2In the external IdP's OIDC configuration, ensure the `email_verified` claim is included in issued ID tokens and set to `true` for verified accounts
- 3Decode a sample ID token at jwt.ms and confirm both `email` and `email_verified: true` claims are present before it reaches Entra ID
- 4In the Entra ID admin center, review the External Identities federation settings for the OIDC provider and confirm claim mappings are correct
- 5If using B2B collaboration, re-send the guest invitation after the user verifies their email at their home IdP