AADSTS50020 – User account does not exist in the tenant.

Hello Govind Sharan,

The AADSTS50020 error means that Microsoft Entra ID is not able to match the incoming login from Shibboleth with any user in the tenant, so JIT provisioning is not being triggered.

Since authentication at Shibboleth is successful and the failure happens only after redirecting back to Entra, this is usually related to how the external identity is being recognized.

In this scenario, the most common causes are:

• Missing or inconsistent unique identifier
  Entra uses attributes like Email, UPN, and NameID to identify and create the guest user. If these values are empty, duplicated, or changing between logins, Entra cannot link the account and returns this error.
• Issuer or identifier mismatch
  If the Issuer value in the SAML response does not exactly match what is configured in Entra, the identity is not trusted for JIT provisioning.
• Existing conflicting account
  If a user already exists in Entra with the same email/UPN but is not linked to this external IdP, Entra cannot associate the new login and fails.
• External identity linking not completed
  Even when federation and claims are configured, JIT provisioning requires the external identity to be correctly linked during first sign-in. If this fails once, future attempts will also fail until the conflict is resolved.

Recommended next step:
Please capture the SAML response from Shibboleth and verify that:

• Email, UPN, and NameID are present and consistent
• Issuer matches the Entra configuration
• The values match any existing user records (if present)

In most cases, correcting the unique identifier (especially email/UPN/NameID) or resolving an existing user conflict allows JIT provisioning to work and the guest account to be created successfully.

Hope this helps.