This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(147.20000000000002, 45%, 24%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EJB%3C/text%3E%3C/svg%3E)
I'm having trouble authenticating a set of user accounts. I'm attempting to use accounts which are supposed to have MFA disabled to run automated tests in Azure DevOps against an application configured with the latest version of MSAL using the ROPC flow. If I run the tests locally on my desktop, I do not run into any problems, everything works as expected. Running the tests in DevOps on the default hosted agent results in the following error:
Body: {
"error": "invalid_grant",
"error_description": "AADSTS50076: Due to a configuration change made by your administrator, or because you moved to a new location, you must use multi-factor authentication to access '27d94bfb-5e0d-42e8-8602-86b12a54b4ca'.\r\nTrace ID: 02948260-4992-4278-a8da-0be26e7a8f00\r\nCorrelation ID: 31961951-fe16-44f1-9b9a-8ba230c5b7f8\r\nTimestamp: 2022-05-04 13:22:46Z",
"error_codes": [
50076
],
"timestamp": "2022-05-04 13:22:46Z",
"trace_id": "02948260-4992-4278-a8da-0be26e7a8f00",
"correlation_id": "31961951-fe16-44f1-9b9a-8ba230c5b7f8",
"error_uri": "https://login.microsoftonline.com/error?code=50076",
"suberror": "basic_action"
}
Could someone look up the correlation id and give me some more details?
Thanks,
James Blake
Planet Technologies
Excluding the account from from Sign In Risk and User Risk solved the problem
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(214.4, 81%, 30%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EMT%3C/text%3E%3C/svg%3E)
Thanks for confirming your solution! It sounds like the account was getting flagged as a risky user then due to a changed location.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(259.20000000000005, 77%, 35%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EDR%3C/text%3E%3C/svg%3E)
That can't be a viable solution though can it? You're just going to exclude a user from Risky Sign-Ins going forward?
Right, that is not a good solution. The real problem turned out to be fairly complex and nothing to do with Risky Signins.
The app registration we were using had delegated permissions setup for User.ReadAll and Group.ReadWriteAll. It turned out that sometime in the past year the tenant we were operating in turned on an "Acceptable Use" conditional access policy. Although we had granted tenant wide granted admin consent, our application layer was failing to authenticate non-interactively on behalf of the user when making calls to Graph due to this policy.
Turns out, after a long conversation with Microsoft, there is no way to bypass this conditional access policy with admin consent, it must be interactive.
The (less than ideal) solution was to convert the required permissions to application rather than delegated. This allowed our calls to graph to complete successfully without triggering the CA.
Totally understandable there, sounds like you did the best you can with the hand dealt! Glad to hear you got it figured out. I stumbled across this as I was fighting a weird issue I thought was caused by a CA policy. Turns out my lower tier was just... failing to be attentive to detail and once I took it over and was in the web app it was a simple App Consent situation that he totally overlooked and failed to tell me was blocked for him... smh...
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(198.4, 35%, 29%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EDR%3C/text%3E%3C/svg%3E)
where exactly do you set this configuration?
That is, from what Azure interface might I be able to set those exclusions?
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(166.4, 46%, 26%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EV%3C/text%3E%3C/svg%3E)
Partners can't convert to app permissions with GDAP, I wonder how that's going to work.
No I don't. It's broken.
I too have experienced this problem:
https://screenrec.com/share/LJ9jE7QZch
This code will expire in 15 minutes.
Authenticated.
AADSTS50076: Due to a configuration change made by your administrator, or because you moved to a new location, you must use multi-factor authentication to access 'xxx-xxx-xxx-xxx-xxx'.
Trace ID: 0b55f402-4f76-4b95-a7d3-99ce2be30800
Correlation ID: c682da51-2c42-4e01-b9df-15b78426efb6
Timestamp: 2022-09-23 03:23:01Z
[process exited with code 1 (0x00000001)]
I will follow-up if I am successful with logging in after some trials as mentioned above. I am quite disappointed however, as I'm pretty sure whatever "promo" for preview I had is long gone.