AADSTS50105 — the signed-in user is not assigned to a role for the application. The enterprise application has "Assignment required" enabled, and the user is not in its Users and groups list (directly or via group membership), so Entra ID refuses to issue a token for the app even though authentication succeeded.
AADSTS50105
User not assigned to the application
What it means
Common causes
The user (or any group containing them) was never assigned to the app.
Assignment was done via a nested group — application assignment does not expand nested groups, only direct members of assigned groups count.
The user was removed from the assigned group during a re-organisation.
For apps using app roles: the user is assigned but without a role the app requires.
How to fix it
Assign the user: Entra admin center > Enterprise applications > (app) > Users and groups > Add user/group.
If assignment is via groups, verify the user is a direct member of the assigned group, or flatten the nesting.
If the app should be open to all users in the tenant, disable the requirement: Enterprise applications > (app) > Properties > Assignment required = No (consider access implications first).