When I try to open the APIM developer portal administration site, I get error 53003 - Your sign-in was successful but you don't have permission to access this resource.

Hello Mark Morrall ,

Thank you for sharing the details. The error 53003 indicates that access is being blocked by a Conditional Access policy, even though your policies appear to be in report-only mode. This usually happens when a policy targeting “All users” or “All cloud apps” enforces conditions like device compliance or MFA.

Please try the following steps:

1. Enable flagging on the error page and reproduce the issue within 20 minutes. Then check the Sign-in logs → Conditional Access tab using the Correlation ID to identify the exact policy causing the block.
2. Review all CA policies, including report-only ones, for conditions such as “Require compliant device” or “Require hybrid Azure AD join.”
3. Confirm that your admin account and device meet compliance requirements or temporarily exclude them from the policy to test.
4. Validate that the API Management Developer Portal app is not inadvertently blocked by policy scope.

Once you identify the policy, adjust its conditions or exclusions to allow access. Let me know if you need help interpreting the sign-in logs or modifying the policy.

For your reference:

https://learn.microsoft.com/en-us/entra/identity/conditional-access/troubleshoot-conditional-access

Thanks for getting back to me so quickly. I have tried your suggestions and I still only get 'Not Applied' in the Conditional Access column.

I ran the sign-in diagnostic, and this is what I got:

A sign-in attempt made by admin**** from their home tenant, Removed PII*, to API Management Developer Portal PROD in tenant* Removed PII failed with the error code 53003. This error is emitted because the user was not granted access to the tenant Removed PII*, and was subsequently blocked by a Conditional Access policy in the resource tenant. By design, we do not show policy details for the resource tenant in the home tenant. For this reason, the conditional access policy details are not captured in the troubleshooting details.*

Solution

An admin in the resource tenant, Removed PII*, should review the CA policies applied for this sign-in attempt and add the user as a guest of the tenant, if they aren't a member.*

The resource tenant Removed PII does not appear to be one of mine.

Mark Morrall Thank you for running the diagnostic and sharing the results. Based on the output, the sign-in attempt is failing because the account admin** belongs to the home tenant (042**), but the API Management Developer Portal resides in a different resource tenant (72f**). Conditional Access policies in the resource tenant are blocking token issuance, and by design, policy details from that tenant are not visible in your logs.

Next Steps:

• Confirm whether you have access to the resource tenant (72f988** ). If not, this indicates the portal belongs to another organization.
• An administrator in that resource tenant must:
  • Add your account as a guest user in their tenant.
    • Review and adjust Conditional Access policies to allow guest access.
    • If this tenant is unexpected, verify the API Management instance you are trying to access and ensure you are using the correct subscription and tenant.

Here’s the official Microsoft guidance for this scenario: https://learn.microsoft.com/entra/identity/conditional-access/troubleshoot https://learn.microsoft.com/entra/external-id/add-users

Please confirm if the API Management instance belongs to your organization or a partner tenant. Let me know if you need help checking the tenant association or adding guest access.

I cannot find any record of that TenantId.

Mark Morrall Thank you for confirming. Since you cannot find any record of the tenant ID 72f988bf-********, this indicates that the API Management Developer Portal you’re trying to access belongs to a different Azure AD tenant most likely Microsoft’s default tenant or a partner organization.

Will connect offline with you to assist your further.