Other Companies Subscriptions Appear on my Account?

Question

Other Companies Subscriptions Appear on my Account?

Thestrius 20

I'm facing this strange issue where I log into Microsoft Azure Portal with my personal email account and get caught in this constant loop. So I sign in "***@outlook.com" and I'm presented with a subscription "EOXOPD - Privacy and Diagnostics" as well as another Foundry resource.

When I try to do anything I'm constantly looped by the sign-in process and therefore unable to even raise a support request. It's really bizarre!

There's two problems here, one is that I can't do anything but secondly another companies subscription is visible to me?

{
  "sessionId": "",
  "errors": [
    {
      "errorMessage": "invalid_grant: AADSTS53003: Access has been blocked by Conditional Access policies. The access policy does not allow token issuance. Trace ID:  Correlation ID:Timestamp: 2026-04-15 11:06:54Z",
      "clientId": "
      "scopes": [
        "/.default"
      ]
    }
  ]
}

0 comments

Answer accepted by question author

VEMULA SRISAI 14,075 Microsoft External Staff Moderator

Hello Thestrius,

This behavior can occur when a personal Microsoft account (@outlook.com) becomes associated with an external Microsoft Entra ID tenant (typically as a guest user).

Why you see another company’s subscription

Your account has likely been invited to another organization’s tenant in the past.
Azure Portal is redirecting you into that tenant.
You are not actually granted access — access is blocked by that tenant’s Conditional Access policy, which is why you see the error:
```
  AADSTS53003: Access has been blocked by Conditional Access policies.
  
  
```
Why you are stuck in a sign‑in loop
- The external tenant’s Conditional Access policy does not allow token issuance for your account.
- Because the token cannot be issued, Azure Portal keeps retrying authentication, resulting in a loop. How to fix the sign‑in loop

Sign in to https://myaccount.microsoft.com
Go to Organizations
Locate the external organization and select Leave organization
Sign out completely and sign back in to https://portal.azure.com

If the Leave option is not available, the external tenant’s administrator must remove your account from their directory.

Regarding AADSTS53003

This error simply means Conditional Access is blocking the token, and the resolution depends on the sign‑in flow being used.

Non‑Interactive flows (background service / automation):

The account or service principal must be excluded from the Conditional Access policy, OR
Switch to Client Credentials (app‑only) authentication
Alternatively, redesign the flow to require interactive sign‑in

Interactive flows (user sign‑in):

The application must prompt the user to sign in interactively
The tenant administrator should review Sign‑in Logs → Conditional Access to identify which policy is blocking access

Thestrius 20 Reputation points

2026-04-15T16:09:58.7166667+00:00

Thanks @VEMULA SRISAI that makes a lot of sense. Unfortunately I'm not able to log into "https://myaccount.microsoft.com" because the account is a personal account.

It's funny because I always thought I couldn't get an Azure subscription with a personal account so used my personal business account. When I had access I thought Microsoft might have lifted the restriction or some such.

If I'm not able to remove myself from the organisation is the only option to reach out to the company to remove myself?
VEMULA SRISAI 14,075 Reputation points Microsoft External Staff Moderator

2026-04-16T12:24:23.1733333+00:00
Hello Thestrius,

Good question — and your understanding is correct.

Why you can’t leave the org yourself

For personal Microsoft accounts (MSA) like @outlook.com, the full Organizations experience at myaccount.microsoft.com is limited. That means:

You can’t always self‑remove from external Microsoft Entra ID tenants.

If the tenant admin disabled self‑service leave, only their administrator can remove your account. What options you have

If you’re unable to leave the organization yourself, the supported paths are:

Contact the tenant owner / company

Ask them to remove your account from Microsoft Entra ID → Users (Guest users).

Once removed, the Azure portal sign‑in loop will stop.

Try the organizations selector (sometimes works with MSAs)

https://portal.azure.com/#settings/directory

If you see the external tenant listed and a Leave option appears, you can remove it there. About Azure subscriptions and personal accounts

You can sign in to Azure with a personal account, but:

Any business subscription you see belongs to the tenant, not your account.

Your account is merely a guest, and access is correctly blocked by the tenant’s Conditional Access, which is why you’re seeing:

AADSTS53003: Access has been blocked by Conditional Access policies
VEMULA SRISAI 14,075 Reputation points Microsoft External Staff Moderator

2026-04-17T13:24:37.4666667+00:00

Thestrius If the resolution was helpful, kindly take a moment to click on and click on Yes for was this answer helpful. And, if you have any further query do let us know.
Thestrius 20 Reputation points

2026-04-20T08:36:13.1666667+00:00

Thank you Vemula, I was not able to remove myself from the account, perhaps something Microsoft could look into further but for now I understand what's happened. Thanks so much for your help!

1 additional answer

Your answer

Thestrius 20 Reputation points

2026-04-15T16:09:58.7166667+00:00

Thanks @VEMULA SRISAI that makes a lot of sense. Unfortunately I'm not able to log into "https://myaccount.microsoft.com" because the account is a personal account.

It's funny because I always thought I couldn't get an Azure subscription with a personal account so used my personal business account. When I had access I thought Microsoft might have lifted the restriction or some such.

If I'm not able to remove myself from the organisation is the only option to reach out to the company to remove myself?
VEMULA SRISAI 14,075 Reputation points Microsoft External Staff Moderator

2026-04-16T12:24:23.1733333+00:00

Hello Thestrius,

Good question — and your understanding is correct.

Why you can’t leave the org yourself

For personal Microsoft accounts (MSA) like @outlook.com, the full Organizations experience at myaccount.microsoft.com is limited. That means:

You can’t always self‑remove from external Microsoft Entra ID tenants.

If the tenant admin disabled self‑service leave, only their administrator can remove your account. What options you have

If you’re unable to leave the organization yourself, the supported paths are:

Contact the tenant owner / company

Ask them to remove your account from Microsoft Entra ID → Users (Guest users).

Once removed, the Azure portal sign‑in loop will stop.

Try the organizations selector (sometimes works with MSAs)

https://portal.azure.com/#settings/directory

If you see the external tenant listed and a Leave option appears, you can remove it there. About Azure subscriptions and personal accounts

You can sign in to Azure with a personal account, but:

Any business subscription you see belongs to the tenant, not your account.

Your account is merely a guest, and access is correctly blocked by the tenant’s Conditional Access, which is why you’re seeing:

AADSTS53003: Access has been blocked by Conditional Access policies
VEMULA SRISAI 14,075 Reputation points Microsoft External Staff Moderator

2026-04-17T13:24:37.4666667+00:00

Thestrius If the resolution was helpful, kindly take a moment to click on and click on Yes for was this answer helpful. And, if you have any further query do let us know.
Thestrius 20 Reputation points

2026-04-20T08:36:13.1666667+00:00

Thank you Vemula, I was not able to remove myself from the account, perhaps something Microsoft could look into further but for now I understand what's happened. Thanks so much for your help!

Answer 1

The visible “other company’s” subscriptions and the sign‑in loop are both explained by how Microsoft accounts and Azure directories work, and by Conditional Access blocking the sign‑in.

Why another company’s subscription appears

When signing in with a personal Microsoft account (for example, ***@outlook.com), that same email address can also exist as a work or school account in another organization’s Microsoft Entra ID tenant.
In that case, Microsoft shows a “Which account do you want to use?” experience because there are effectively two identities with the same email: a personal account and a work/school account.
The work/school account may have been created by that other organization’s IT department or, in rare cases, accidentally by another organization whose domain matches the personal account address.
If that work/school identity was granted access to their Azure subscription, the subscription (for example, “EOXOPD – Privacy and Diagnostics” and the Foundry resource) can appear when signing in.

Why the sign‑in loop and AADSTS53003 error occur

The error AADSTS53003: Access has been blocked by Conditional Access policies. The access policy does not allow token issuance indicates that the organization that owns the tenant has Conditional Access policies that block token issuance for this sign‑in.
Because the Conditional Access policy blocks the sign‑in, the portal keeps redirecting back to sign‑in, resulting in the loop described.
This is enforced by the tenant that owns the subscription; it is not controlled from the personal Microsoft account side.

What can be done

For the personal Microsoft account side:
- If the repeated “which account” or cross‑tenant confusion is happening, one option is to rename the personal Microsoft account by changing its primary alias so it no longer matches the work/school identity. This is done via the “Manage how you sign in” page for the Microsoft account, where a different email alias can be made primary.
For the work/school account in the other tenant and the Conditional Access block:
- Only the other organization’s IT/admins can change their Conditional Access policies or remove the work/school account from their tenant.
- If that organization created the work/school account, they need to adjust or remove it if access is not intended.

If sign‑in loops occur more generally

When sign‑in loops occur in Microsoft sites (including Azure and support portals), common mitigations include:
- Clearing browser cache and cookies.
- Using InPrivate/Incognito mode.
- Ensuring the Microsoft sign‑in domains (such as login.microsoftonline.com and login.live.com) are handled consistently in browser security/trusted sites so cookies can be shared correctly.

In summary, the “other company’s” subscriptions are visible because that company’s tenant has a work/school identity for the same email address, and Conditional Access in that tenant is blocking token issuance, causing the loop. Resolution requires either changing the personal account alias to avoid the collision and/or having the other organization’s IT remove or adjust the work/school identity and its access.

References: