Ctrl+Z Therapy
CasesQuick answersGuides10-minute checklistHow we testCartoonSend it in

Microsoft login error AADSTS50020? Your app only allows one organization

Ship ItChecked against the official source

Source checked 10 Oct 2026 · Published 23 Oct 2026 · Last reviewed 23 Oct 2026 · By Ctrl+Z Therapy (how we test)

The short answer

Microsoft's troubleshooting page lists four causes for AADSTS50020. A common one for app builders: if your app registration is set to a single-tenant account type, users from other directories or identity providers can't sign in to that application. You currently can't change signInAudience in the manifest, so Microsoft says to re-create the app registration with the correct account type selected.

What to do

  1. Check your app registration's supported account types. If it allows your organization only, customers from other organizations can't sign in.
  2. Re-create the app registration with the right account type: any organization, plus personal Microsoft accounts if you want them.
  3. Ask your AI tool: "Microsoft sign-in fails with AADSTS50020 for users outside my company. Check my Azure app registration's supported account types and the tenant URL my auth uses."

Good to know

  • If you use Supabase Auth, it uses Microsoft's common endpoint by default, which generally allows any Microsoft account to sign in, as long as your app registration allows those account types.
  • This answer covers the account type cause only. Microsoft's page lists the other causes.

Source

Checked on 10 Oct 2026. Prices, limits and settings change, so check the source before you rely on them.