![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(96, 46%, 19%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ELP%3C/text%3E%3C/svg%3E)
Microsoft Security | Microsoft Entra | Microsoft Entra ID
A cloud-based identity and access management service for securing user authentication and resource access
AADSTS53003 means authentication succeeded, but Microsoft Entra refused to issue a token because Conditional Access blocked the request. Changing Chrome, clearing cookies, or correcting NTP will not alter that decision.
Ask an Entra administrator to open Sign-in logs and find the event by timestamp, request ID, or correlation ID. In the Conditional Access tab, identify the applied policy and failed grant control. Reproduce the user, Microsoft 365 resource, Linux platform, browser, and network in the What If tool.
Fix the control shown by the logs: register and enroll the Linux device and use a supported browser if device compliance is required; complete MFA if required; or correct an unintended user, location, platform, or application assignment. Test changes in report-only mode first. If the VM runs unattended automation, replace interactive user sign-in with an approved workload identity and application permissions. Only your tenant’s Entra administrator can change the blocking policy.