AADSTS50057 — "The user account is disabled." The accountEnabled flag on the user object
is false, so all sign-ins fail regardless of credentials. In hybrid environments the disabled
state usually flows from on-prem AD via sync, so the fix may belong on-prem rather than in
the cloud.
AADSTS50057
User account is disabled
What it means
Common causes
The account was deliberately disabled (leaver process, security response) and someone is still trying to use it — including background apps and services signing in as that user.
Hybrid: the on-prem AD account is disabled and Entra Connect synced that state.
Automated lifecycle tooling (HR-driven provisioning) disabled the account by rule.
How to fix it
Check state:
Get-MgUser -UserId <upn> -Property accountEnabled | Select accountEnabled. Re-enable in Entra admin center > Users > (user) > Edit properties > Account enabled, orUpdate-MgUser -UserId <upn> -AccountEnabled:$true.For synced users, enable the account in on-prem AD instead and let sync propagate — cloud-side edits to synced attributes will be overwritten.
If the disable was intentional, treat the sign-in attempts as signal: find which app/device keeps trying (sign-in logs) and decommission it.