AADSTS530035 blocks Azure Resource Manager for Global Administrator and Subscription Owner

Question

Hello Microsoft Team,

I need this issue escalated to the Microsoft Entra / Azure Resource Manager authentication team.

Environment:

• Account: ******@medsalgroup.com
• Microsoft Entra Global Administrator
• Azure Subscription Owner
• Azure Developer Support active

Issue:

Azure Resource Manager authentication consistently fails with:

AADSTS530035

Browser sign-in succeeds.

MFA succeeds.

Microsoft Entra is accessible.

Azure Portal is accessible.

Security Defaults currently show Disabled.

Conditional Access for the failed sign-in shows Not Applied.

However:

• Azure CLI ARM operations fail.
• ARM resource operations fail.
• ARM deployment validation cannot be executed.

Extensive troubleshooting has already been completed, including:

• verifying tenant and subscription;
• verifying Global Administrator and Owner roles;
• clearing Azure CLI authentication;
• fresh browser authentication;
• reviewing sign-in logs;
• collecting request IDs and correlation IDs.

This appears to require Microsoft investigation because ARM authentication remains blocked even though authentication succeeds.

Please escalate this issue to the Microsoft Entra / Azure Resource Manager authentication engineering team.

I can provide:

• Tenant ID
• Subscription ID
• Request IDs
• Correlation IDs
• Complete sanitized investigation package

if required.

Thank you.

Answer 1

Hello Ehab Ismail,

Greetings! Thanks for raising this question in Q&A forum.

I understand this is preventing you from performing Azure Resource Manager operations even though portal sign-in and MFA are successful. Based on the information provided, AADSTS530035 is typically related to an authentication or access policy evaluation issue that is occurring during Azure Resource Manager token acquisition, and since you have already completed the common troubleshooting steps, this likely requires a Microsoft-side investigation.

1. Review the failed sign-in entry in Microsoft Entra sign-in logs and capture the Request ID, Correlation ID, and Timestamp associated with the AADSTS530035 failure.
2. Confirm whether the failure occurs across multiple clients (Azure CLI, PowerShell, ARM templates, and REST API calls) to help isolate whether the issue is specific to a client or to ARM authentication itself.
3. Validate that no tenant-wide authentication policies, cross-tenant access settings, or security restrictions are being applied outside of Conditional Access, since the sign-in logs indicate Conditional Access is not applied.
4. Since you have already verified roles, subscriptions, authentication resets, and sign-in behavior, open a support case through your active Azure support plan and provide the collected diagnostic details.
5. Request escalation to the Microsoft Entra ID / Azure Resource Manager authentication team for backend analysis of the ARM token issuance process.

At this point, the next action is with Microsoft Support. The engineering team will need to review backend authentication logs and policy evaluation details that are not available through the Azure portal to determine why ARM authentication is being blocked while interactive sign-in succeeds.

If this answer helps you kindly accept the answer which will help others who have similar questions

Best Regards,

Jerald Felix.