Microsoft Entra Enterprise Application with “Assignment required = Yes” still allows unassigned users to authenticate via OIDC

Question

Hi,

I have an application integrated with Microsoft Entra ID using OIDC through oauth2-proxy.

The Enterprise Application has:

Assignment required? = Yes

My expectation is that only users or groups explicitly assigned under:

Enterprise applications → <application> → Users and groups

should be able to authenticate. However, users who are not assigned to the Enterprise Application are still able to complete the OIDC login successfully.

The flow is:

User → Microsoft Entra ID → successful authentication → redirect to /oauth2/callback → oauth2-proxy creates a valid session

The sign-in log in Entra shows the login as successful. I was expecting Entra to block the user before the callback, with an error such as: AADSTS50105 - The signed in user is not assigned to a role for the application

Relevant sanitized configuration:

OAUTH2_PROXY_PROVIDER=oidc

OAUTH2_PROXY_OIDC_ISSUER_URL=https://login.microsoftonline.com/<tenant-id>/v2.0

OAUTH2_PROXY_REDIRECT_URL=https://<app-domain>/oauth2/callback

OAUTH2_PROXY_OIDC_EMAIL_CLAIM=preferred_username

OAUTH2_PROXY_SCOPE=openid profile email

The proxy is also configured to allow specific email domains, but no per-user allowlist is configured. The user is authenticated successfully even after being removed from the Enterprise Application assignment list.

Things already checked:

• Assignment required is enabled on the Enterprise Application.
• The user is not directly assigned to the application.
• The test was done in an incognito/private browser session.
• The OIDC client ID matches the Enterprise Application being reviewed.
• The user is successfully redirected back to the callback URL.

Question:

Should “Assignment required = Yes” block unassigned users in this OIDC flow before tokens are issued?

If yes, what additional configuration is required to make Entra enforce assignment for this type of OIDC application?

Any guidance would be appreciated.

Answer 1

Are the allowed users Global Admins? The assignment restrictions dont apply to them

Answer 2

Yes. When Assignment required is set to Yes on an enterprise application that uses OpenID Connect, Microsoft Entra ID must block unassigned users from obtaining tokens for that application and return an error like AADSTS50105. No additional “special” configuration is required beyond correctly targeting the right enterprise application and having Assignment required enabled on that service principal.

From the documented behavior of the Assignment required setting:

• Assignment required controls who or what in the directory can obtain an access token for the application.
• If set to Yes, then users and other applications or services must first be assigned this application before being able to access it.
• If set to No, then all users are able to sign in, and other applications and services are able to obtain an access token to the application.
• This option applies to OIDC/OAuth2 apps.
• Global Administrators are exempt and can sign in regardless of the setting.

Given that unassigned users are still getting tokens, the behavior indicates that at least one of the following is true in the actual configuration:

1. Assignment required is not being enforced on the service principal that is actually issuing tokens
   • Assignment required is a property of the enterprise application (service principal), not the app registration. The client ID used by oauth2-proxy must correspond to the enterprise application where Assignment required = Yes.
   • If oauth2-proxy is using a different app registration / service principal (for example, a multi-tenant app or another enterprise app instance), that instance might have Assignment required = No, so tokens are still issued.
2. The user has a role that bypasses assignment
   • Users with the Global Administrator role can sign in to applications regardless of Assignment required.
   • If testing with a Global Administrator, Entra will not block sign-in even when Assignment required = Yes.
3. The scenario is actually an app-to-app (client credentials) flow
   • Assignment required also applies to “applications or services for which other applications or service are requesting access tokens.”
   • If the token being used by oauth2-proxy is obtained via client credentials (app-only) rather than delegated user sign-in, the enforcement is on the app/service principal assignment, not on the end user.

To have Entra enforce assignment for this OIDC flow:

1. Confirm the correct enterprise application
   • In Microsoft Entra admin center, go to Identity → Enterprise applications → All applications.
   • Locate the enterprise application whose Application ID matches the client ID configured in oauth2-proxy.
   • On that enterprise application’s Properties page, verify Assignment required = Yes.
2. Ensure the test user is not a Global Administrator
   • Test with a standard user account that has no privileged directory roles.
3. Verify that the flow is user-delegated OIDC sign-in
   • Ensure oauth2-proxy is using an authorization code (or hybrid) flow with the user present, not only client credentials.

When these conditions are met, Entra ID should deny token issuance to unassigned users and return an error such as AADSTS50105, preventing oauth2-proxy from establishing a session.

---

References:

• Properties of an enterprise application
• Manage access to an application
• Restrict a Microsoft Entra app to a set of users