Additional Microsoft Entra services and features related to identity, access, and network security
Both error codes indicate that device-based authentication or the way the request is sent from mobile is failing, while desktop scenarios still work.
Use these steps to narrow down and resolve the issue:
- Check Conditional Access and device requirements
- If Conditional Access policies require compliant or hybrid-joined devices, verify that mobile devices are supported and properly enrolled.
- Review the sign-in logs for a failing user in Microsoft Entra ID:
- Go to the sign-in event that matches the Request Id / Correlation Id / Timestamp from the error.
- Under Device Info, check Join type to confirm whether a valid device claim is being sent from the mobile device.
- If the device claim is missing or incorrect, adjust Conditional Access (for example, exclude mobile devices temporarily or relax “require compliant device” conditions) and test again.
- Avoid unsupported or privacy modes on mobile
- Ensure users are not signing in from Incognito/InPrivate tabs in Chrome on mobile.
- Use a supported browser/app: the native Teams mobile app or a supported mobile browser.
- Confirm that browser cookies and local storage are enabled on the device; disabled cookies can break device authentication.
- Verify app support for device authentication
- Some native or embedded browsers do not support the Microsoft Authentication Broker or device authentication flows.
- Make sure the latest official Teams mobile app from the store is used and that it is not wrapped or modified by third‑party tools.
- Reinstall and re-register the device (if needed)
- Since reinstall and cache clear were already tried, focus on device registration:
- Remove the work account from the mobile OS account settings and any device management profile (if applicable).
- Re-add the work account and ensure the device is properly registered/enrolled so that a device claim can be sent.
- Since reinstall and cache clear were already tried, focus on device registration:
- If the issue persists
- Collect the following for at least one failing user:
- Exact Request Id, Correlation Id, and Timestamp from the error screen.
- Device type, OS version, Teams app version, and browser version (if using Chrome).
- Open a support request via the Microsoft 365 admin center or Teams admin center and include the sign-in logs and device details so support can trace the failing mobile requests and confirm whether the AADSTS90023 / AADSTS900561 errors are caused by Conditional Access, device registration, or a service-side issue.
- Collect the following for at least one failing user:
References: