AADSTS53003 — "Access has been blocked by Conditional Access policies. The access policy does not allow token issuance." Authentication succeeded; authorisation did not. One or more Conditional Access policies with a Block grant (or unmet grant requirements) applied to this combination of user, app, device, platform and location.
AADSTS53003
Access blocked by Conditional Access policies
What it means
Common causes
The sign-in matches a Block policy: unmanaged/non-compliant device, disallowed platform, untrusted location or excluded app scenario.
A grant requirement the client cannot meet (compliant device, hybrid join, approved client app) effectively blocks the flow.
The device lost compliance or its hybrid-join/registration state broke, dropping it into the blocked population.
Newly rolled-out policies caught legitimate scenarios that were never tested (service accounts, guests, legacy clients).
How to fix it
Identify the exact policy: Entra admin center > Sign-in logs > (failing entry) > Conditional Access tab — each policy shows Success/Failure/Not applied.
Model changes safely with the What If tool (Entra admin center > Conditional Access > Policy > What If) before editing policies.
If device compliance is the failed grant, check the device in Intune (compliance state) and
dsregcmd /statuson Windows for join/registration health.Use report-only mode for new policies so blocks like this are visible in logs before they hit users.
Frequently asked
How do I find which Conditional Access policy is blocking?
Open the failing entry in Entra sign-in logs and select the Conditional Access tab: every policy is listed with its result. The one showing Failure is your blocker; its details show which condition and grant control matched.
Can users bypass AADSTS53003?
No — it is enforced at token issuance. The fix is policy- or device-side: make the device compliant/joined, come from an allowed location, or change the policy scope.