Menu AuthGuardHelp centre
Portuguêsauthguard.pt

Troubleshooting · Microsoft 365

Microsoft 365 sign-in errors (anchor, policy, import)

  • 1 min read
  • SaaS · Self-hosted

What does the user see?

MessageCauseWhat to do
«Your account is not enabled for Microsoft 365 sign-in. Ask your administrator for a Microsoft 365 anchor.»Your account has no anchor (UPN and ImmutableID)Ask your administrator to create it
«Your organisation's access policy denied this Microsoft 365 sign-in.»The policy does not allow this sign-inContact your administrator
«Microsoft 365 sign-in cancelled. You can close this window.»You cancelled the sign-inStart again from Microsoft 365

Refusals when importing anchors

When importing anchors, each refused line shows the reason:

ReasonWhat to do
«already has an anchor»The person already has an anchor; remove it first if you want to change it
«appears twice»Remove the duplicated line
«invalid ImmutableID» / «invalid UPN»Fix the value (the ImmutableID is Entra's base64 value)
«malformed line»Check the separator and number of columns
«UPN or ImmutableID used by another person»Fix the mapping
«unknown user»The person does not exist in the organization; create them first
«UPN outside the federated domain»The UPN must belong to the federated domain

Problems on the Microsoft 365 side

  • Microsoft 365 does not redirect: the domain is not federated, or the federation script was not run.
  • Refusal after sign-in: the anchor's ImmutableID does not match the user's in Entra.
  • After a certificate renewal: run the federation script again, as the console says.

When to escalate

If the anchor and federation are right and Microsoft 365 still refuses, collect the correlation identifier Microsoft shows and contact support.

Error codes in this article

Related articles

Article referencets-m365-errorsquote it to support to identify this article. Checked against the product at commit 5f6607a8.