AADSTS50076 — "Due to a configuration change made by your administrator, or because you moved to a new location, you must use multi-factor authentication to access." A Conditional Access policy or other MFA requirement applies to this sign-in, and the presented session or credential has not completed MFA. Interactively, the user just completes the prompt; the error matters when it hits clients that cannot do MFA.
AADSTS50076
Multi-factor authentication required
What it means
Common causes
A Conditional Access policy requiring MFA now covers this user/app/location — often after policy rollout or the user appearing from a new IP/location.
Legacy authentication clients (older Office, SMTP/IMAP/POP, basic-auth scripts) that cannot perform MFA are being challenged.
Scripts or services running with user credentials (instead of an app identity) hitting MFA-protected resources.
The existing token predates the policy and a fresh MFA-satisfying token is required.
How to fix it
Interactive users: complete the MFA prompt; if none appears, register methods at aka.ms/mfasetup.
Automation hitting this error should move to an application identity: app registration with client credentials or certificate, or a managed identity — not a user account with MFA exemptions.
Diagnose which policy fired: Entra admin center > Sign-in logs > (entry) > Conditional Access tab shows each policy and its result.
Avoid carving out MFA exclusions for service accounts; if unavoidable short-term, scope tightly and time-box it.