Azure DevOps

Question

Azure DevOps

Dr. O'Halloran 0

Issue:

Consistent AADSTS50020 when signing into Azure DevOps as ******@mdsoft.com to access org https://dev.azure.com/md-soft/. Authentication keeps evaluating in the fairfaxent.com tenant, so my MD SOFT user “does not exist in tenant 'fairfaxent.com'”.

Error instances:

2025-09-03T01:17:55Z — Request Id: fc1ce735-a99a-4211-b01c-7f580217cd55
2025-09-03T01:23:35Z — Request Id: 28725951-d933-4cc4-bebc-34f9794c9b00, Correlation Id: 52e8a468-c140-4e67-a89a-4600709701d6
2025-09-03T01:51:45Z — Request Id: 87d84a7f-cf3e-4905-a0a3-a21df6430a01, Correlation Id: 54944ac0-bdfb-405f-bb7e-27052e11fd6c

App/tenant details:

Azure DevOps app ID: 499b84ac-1321-427f-aa17-267ca6975798
MD SOFT tenant (where I belong): 33e603b6-3929-405d-b099-d8f43b76f476
Accounts:
- Desired sign-in: ******@mdsoft.com (MD SOFT)
- Other tenant involved: fairfaxent.com (I can sign in there as ******@fairfaxent.com)

Symptoms:

https://aex.dev.azure.com/me shows “Get started with Azure DevOps” for ******@mdsoft.com (no orgs listed).
https://dev.azure.com/md-soft/ throws AADSTS50020 referencing fairfaxent.com.
Even with tenant-scoped auth URLs, clean Guest/InPrivate profiles, and different networks, signin still evaluates in fairfaxent.com.

What I need:

Confirm which tenant the Azure DevOps org “md-soft” is currently bound to.
If it’s bound to fairfaxent.com, help either: a) complete/repair the B2B guest for ******@mdsoft.com (provide/verify redemption link) and add me to the org, then b) switch the org directory to MD SOFT (Organization settings → Microsoft Entra ID → Switch directory), OR c) rebind the org directly to MD SOFT.
Verify if tenant restrictions / HRD policies are forcing DevOps sign-ins into fairfaxent.com and advise remediation.

Business impact:

Blocked from accessing company DevOps org and repos.

Durga Reshma Malthi 11,600 Reputation points Microsoft External Staff Moderator

2025-09-03T15:34:23.4833333+00:00
Hi Dr. O'Halloran

Sign in to Azure DevOps with an admin account -> Navigate to Organization Settings -> Microsoft Entra ID -> Verify which Azure AD tenant the organization md-soft is currently bound to.

Use Azure CLI or PowerShell commands to query the organization’s directory binding.

az devops organization show --organization https://dev.azure.com/md-soft/

If it shows fairfaxent.com, then Go to Azure Portal -> Microsoft Entra ID -> Users -> External users -> Check if ******@mdsoft.com exists and has redeemed the invitation. If not, re-invite the user via Azure AD B2B and ensure redemption is completed.

In Azure DevOps -> Organization Settings -> Microsoft Entra ID -> Switch directory -> Switch the directory from fairfaxent.com to MD SOFT tenant.

Also check if there are any tenant restrictions or Conditional Access policies in either tenant that force sign-ins to fairfaxent.com.

Review Azure AD sign-in logs and Conditional Access policies in both tenants. If HRD policies are forcing sign-in to fairfaxent.com, update or remove these policies to allow sign-in to MD SOFT tenant. Ensure that the user ******@mdsoft.com is not being redirected or forced to authenticate in the wrong tenant due to domain hints or policy

Additional References:

https://learn.microsoft.com/en-us/troubleshoot/entra/entra-id/app-integration/error-code-aadsts50020-user-account-identity-provider-does-not-exist

Hope this helps!

Please Let me know if you have any queries.
Durga Reshma Malthi 11,600 Reputation points Microsoft External Staff Moderator

2025-09-04T15:30:37.5833333+00:00

Hi Dr. O'Halloran

Just checking in to see if you had a chance to review the response provided to your question.

Feel free to reach out if you have any further queries.
Durga Reshma Malthi 11,600 Reputation points Microsoft External Staff Moderator

2025-09-05T15:43:26.0833333+00:00

Hi Dr. O'Halloran

Just checking in to see if you had a chance to review the response provided to your question.

Feel free to reach out if you have any further queries.