Something went wrong.

Question

I am starting up a new computer and trying to login to Microsoft. When I try to login, I get a error: invalid_client with description: failed%20to%authenticate%20user. How do I fix this?

Answer 1

Hi Leif Kindberg,

This error is often tied to Azure AD authentication flows. It's typically not a problem with your credentials but rather a mismatch in tenant configurations, like enabled Mobile Device Management (MDM) enrollment via Microsoft Intune without the proper licensing or scope settings for your user account. This can block the device join or initial login prompt, forcing the auth to fail as if the "client" (your PC) isn't valid.

First, verify basics on the new PC: Ensure your system clock and time zone are accurate (Settings > Time & Language > Date & time > Sync now), as even a 5-minute skew can break auth. Also, confirm you're using a stable internet connection without VPNs or proxies that might block login.microsoftonline.com—try a wired Ethernet if possible. If you're behind a corporate firewall, whitelist Microsoft endpoints like graph.microsoft.com and device.login.microsoftonline.com.

The core fix usually requires admin access to your Microsoft 365/Entra ID tenant (if this is a work/school account; for personal, skip to the local account workaround below):

1. Log in to the Microsoft Endpoint Manager admin center (endpoint.microsoft.com) or Azure portal (portal.azure.com) with a Global Admin account.
2. Navigate to Devices > Enroll devices > Windows enrollment > Automatic Enrollment (under MDM user scope).
3. Set "MDM user scope" to "None" (or "Some" if targeting specific groups, ensuring your user is excluded). Do the same for MAM user scope if visible.
4. Save changes—this disables mandatory Intune enrollment, which often causes the error if your license (e.g., Business Standard) lacks Intune but auto-enrollment is on.
5. Also, check Azure AD > Mobility (MDM and MAM) > Microsoft Intune > Ensure scopes are "None" if not using Intune.
6. Assign an Intune-compatible license (like Microsoft 365 Business Premium or E3) to your user if needed: Azure AD > Users > Your user > Licenses > Add assignments.
7. Wait 5-15 minutes for propagation, then retry login on the PC.

If it's a personal Microsoft account (not tied to a work tenant), the error might stem from recent Windows 11 24H2 changes enforcing online auth—bypass by disconnecting from the internet during OOBE (unplug Ethernet/disable Wi-Fi via airplane mode), then at the network screen, press Shift+F10 to open Command Prompt, type oobe\bypassnro, and hit Enter. This restarts OOBE offline, letting you create a local admin account first. Once in Windows, connect to the internet, go to Settings > Accounts > Your info > "Sign in with a Microsoft account instead," and link it—avoiding the initial forced join.

To diagnose further, after a failed attempt, check the Event Viewer on the PC (Win+R > eventvwr > Windows Logs > System/Application) for AAD-related errors, or review Azure AD sign-in logs (Azure portal > Entra ID > Sign-in logs > Filter by your user and failure reason). If the account is new or unused, complete any pending MFA setup or terms acceptance at account.microsoft.com.

If these don't resolve it (e.g., no tenant access), contact Microsoft Support via support.microsoft.com (chat for faster help) with the exact error code and your Windows build (Win+R > winver).

If you find this information useful, please hit "accept answer" so that others can benefit too.

Best regards,

VP

Answer 2

Hi Leif Kindberg,

Has your issue been solved? If it has, please accept the answer so that others can benefit too. If not, is there anything I can help you with? Please let me know.

Vivian