Azure AD is returning AADSTS50158 (External security challenge not satisfied)

Question

Azure AD is returning AADSTS50158 (External security challenge not satisfied)

Alan Meade 0

A Conditional Access policy is failing unexpectedly. The policy requirements are being met, but Azure AD is returning AADSTS50158 (External security challenge not satisfied). I need engineering to confirm whether the external challenge, authentication strength, or token binding is failing.PII

Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2026-02-05T17:01:48.44+00:00
Hello @Alan Meade

Neither Conditional Access nor an outside security issue is to blame for the sign-in failure. According to the logs, no new authentication or external challenge was initiated because the request made use of an already-existing Primary Refresh Token (PRT) with previously fulfilled MFA and first-factor claims. As a result, Conditional Access was not reassessed (notApplied).

In this case, the AADSTS50158 problem is not an authentication strength or MFA failure, but rather a generic token refresh/issuance error.

Hence, to resolve the error,

Sign out of all sessions and revoke the user's refresh tokens

Open a new InPrivate window to log in or clear browser sessions.

To enable CA and MFA to activate once more, reauthenticate again

Let me know if any further queries - feel free to reach out!
Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2026-02-06T09:15:46.6733333+00:00

Hello @Alan Meade Following up to see if the above provided information was helpful. If you have any further queries do let us know.
Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2026-02-12T10:35:59.55+00:00

Hello @Alan Meade, Following up to check if still you are facing the issue?

Your answer

Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2026-02-05T17:01:48.44+00:00

Hello @Alan Meade

Neither Conditional Access nor an outside security issue is to blame for the sign-in failure. According to the logs, no new authentication or external challenge was initiated because the request made use of an already-existing Primary Refresh Token (PRT) with previously fulfilled MFA and first-factor claims. As a result, Conditional Access was not reassessed (notApplied).

In this case, the AADSTS50158 problem is not an authentication strength or MFA failure, but rather a generic token refresh/issuance error.

Hence, to resolve the error,

Sign out of all sessions and revoke the user's refresh tokens

Open a new InPrivate window to log in or clear browser sessions.

To enable CA and MFA to activate once more, reauthenticate again

Let me know if any further queries - feel free to reach out!
Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2026-02-06T09:15:46.6733333+00:00

Hello @Alan Meade Following up to see if the above provided information was helpful. If you have any further queries do let us know.
Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2026-02-12T10:35:59.55+00:00

Hello @Alan Meade, Following up to check if still you are facing the issue?