How to resolve AADSTS51004 error

Question

How to resolve AADSTS51004 error

Paul Levett 15

After following the Configure Google Workspace as an IdP for Microsoft Entra ID guide here: https://learn.microsoft.com/en-us/education/windows/configure-aad-google-trust

When our users try to sign into Microsoft services they get redirected to Google and sign in without any issue, but when redirected back to Microsoft services they now get the following error message:

AADSTS51004: The user account does not exist in the f759966c-a7a4-4611-a73b-d33f385008df directory. To sign into this application, the account must be added to the directory.

When checking the users, there user principal name (email) is exactly the same within Entra ID. The directory ID is also correct too.

So ideally we are looking to find out how resolve this issue?

On a side note, we would also like to know how to roll back the change if we cannot resolve the above issue too.

Thanks for help in advance.

0 comments

3 answers

Your answer

Answer 1

Paul Levett 15

I have resolved the issue by

Going to Entra ID > Identity > All Users
Change the UPN domain for each affected user to their onmicrosoft.com UPN and save to confirm the domain change
Open Powershell and run this command: set-msolUser -userprincipalname name@<domain name> -immutableID name@<domain name>
Once the command has completed go back to Entra ID > Identity > All Users and change the affected users back to the federated domain.

All user can now access their Microsoft Services via Google Workspace.

Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Answer 2

Anonymous

Hi @Paul Levett , thank you for returning with your answer. Since you can't confirm your own answer, I'll repost it here for others to reference. Please select "Verify Answer" to do this.

The issue was resolved by:

Going to Entra ID > Identity > All Users
Change the UPN domain for each affected user to their onmicrosoft.com UPN and save to confirm the domain change
Open Powershell and run this command: set-msolUser -userprincipalname name@<domain name> -immutableID name@<domain name>
Once the command has completed go back to Entra ID > Identity > All Users and change the affected users back to the federated domain.

All users can now access their Microsoft Services via Google Workspace.

Romit 0

Hi James,

I tried the steps mentioned above and it worked couple of days ago.
Right now, it doesn't work. I have made no changes in permission or anything that could block this.
The error I am getting here is -

Can you help me to mitigate this?
Or if there is an equivalent Graph API to achieve this?

I think the MsOl scripts have been deprecated very recently.

Thanks,

Romit

PS C:\Users\administrator> Connect-MsolService
Connect-MsolService : Access Denied. You do not have permissions to call this cmdlet.
At line:1 char:1
+ Connect-MsolService
+ ~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : OperationStopped: (:) [Connect-MsolService], MicrosoftOnlineException
    + FullyQualifiedErrorId : Microsoft.Online.Administration.Automation.AccessDeniedException,Microsoft.Online.Admini
   stration.Automation.ConnectMsolService
Connect-MsolService : Exception of type 'Microsoft.Online.Administration.Automation.MicrosoftOnlineException' was
thrown.
At line:1 char:1
+ Connect-MsolService
+ ~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : OperationStopped: (:) [Connect-MsolService], MicrosoftOnlineException
    + FullyQualifiedErrorId : Microsoft.Online.Administration.Automation.MicrosoftOnlineException,Microsoft.Online.Adm
   inistration.Automation.ConnectMsolService

Answer 3

Hi @Paul Levett , please try the following steps for me:

Check that the user account exists in the Entra ID directory that is being used for authentication. You can do this by searching for the user in the Entra ID portal.
If the user account does not exist in the Entra ID directory, you will need to add the user to the directory. You can do this by creating a new user account in the Entra ID portal and assigning the appropriate licenses and permissions.
If the user account does exist in the Entra ID directory, check that the user principal name (email) is exactly the same in both Google Workspace and Entra ID. If there are any differences, you will need to update the user principal name in one of the systems to match the other.
Check that the Google Workspace domain is added as a verified domain in the Entra ID portal. You can do this by going to the Entra ID portal, selecting "Domains" from the left-hand menu, and verifying that the Google Workspace domain is listed and marked as "Verified".
If none of the above steps resolve the issue, you can try removing and re-adding the Google Workspace identity provider in the Entra ID portal.

To roll back the change, you can simply remove the Google Workspace identity provider from the Entra ID portal. This will revert the authentication method back to the previous configuration.

Please let me know if you have any questions and I can help you further.

If this answer helps you please mark "Accept Answer" so other users can reference it.

Thank you,

James

Paul Levett 15 Reputation points

2024-08-29T21:30:02.9033333+00:00

@James Hamil duplicate post, please ignore.
Paul Levett 15 Reputation points

2024-08-29T21:40:36.7533333+00:00

@James Hamil thanks for your response. I can confirm all the users are exactly the same within Google Workspace and Microsoft 365. They also have the same UPN too.

Upon further investigation and based on the information in this Google Support Article hereI have found the problem is related to the ImmutableID for each user. All the users a part from 4 users never had any information in the ImmutableID field.

So I ran the following PowerShell command Set-MsolUser -UserPrincipalName name@domain -FederatedUser @{SourceAnchor="Object ID"}. To add the UPN to the ImmutableID field. All these users then were able to access Microsoft Services via Google Workspace federation as expected.

However the 4 users that cannot still access Microsoft Services, I found that their ImmutableID field was populated with random numbers. I cannot seem to change these numbers.

Is there a way to either clear the ImmutableID field numbers or add the UPN?

Thanks in Advance.

Share via

How to resolve AADSTS51004 error

3 answers

Your answer