> ## Documentation Index
> Fetch the complete documentation index at: https://docs.iru.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Passport troubleshooting with Microsoft Entra ID

> Troubleshoot Passport issues with Microsoft Entra ID in Iru Endpoint. Resolve login failures, token errors, password sync problems, and configuration issues.

<Callout icon="apple" color="#B84A7A" iconType="regular">This guide applies to Mac computers</Callout>

<Note>
  Note: Microsoft Entra ID [is the new name](https://learn.microsoft.com/en-us/entra/fundamentals/new-name) for Azure AD (Azure Active Directory)
</Note>

### About This Article

Use this article when Passport sign-in fails with Microsoft Entra ID (formerly Azure AD). It covers login checks, diagnostics, network requirements, and common Entra ID error codes. For setup, use [Configure Passport with Microsoft Entra ID - Mac Login](/en/endpoint/library/passport/microsoft-entra-id/configure-passport-with-microsoft-entra-id-mac-login) or [Configure Passport with Microsoft Entra ID - Web Login](/en/endpoint/library/passport/microsoft-entra-id/configure-passport-with-microsoft-entra-id-web-login), then [Configure the Passport Library Item](/en/endpoint/library/passport/configure-the-passport-library-item).

<Card title="Important Entra ID Passport Update" type="danger" icon="calendar-exclamation" iconType="solid">
  Starting **June 15, 2026**, Microsoft Entra ID handles Conditional Access for Passport sign-in differently.

  * **Mac Login:** See [Entra ID Passport Mac Login](/en/endpoint/library/passport/microsoft-entra-id/configure-passport-with-microsoft-entra-id-mac-login#june-2026-conditional-access-change) to confirm whether your tenant is affected and what to update before that date.
  * **Web Login:** Updates are required only if you use Web Login and want to exempt Passport from MFA in Conditional Access. See [Entra ID Passport Web Login](/en/endpoint/library/passport/microsoft-entra-id/configure-passport-with-microsoft-entra-id-web-login#june-2026-conditional-access-change).

  Microsoft explains the change in [this documentation](https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-enforcement-resource-exclusions).
</Card>

### Login, Diagnostics, and Network

<CardGroup cols={2}>
  <Card title="Sign in with the full email address" icon="user">
    At the Passport login window, always enter the user’s full email address in the username field so the session uses your IdP instead of local authentication. For how the login window and visibility settings interact with Passport, see [Passport Compatibility](/en/endpoint/library/passport/passport-compatibility-with-macos-and-iru-endpoint-features#login-window).
  </Card>

  <Card title="Use Passport Diagnostics" icon="display">
    If a user cannot sign in, open Iru Endpoint Passport Diagnostics with **Command-Shift-K-L** on the Mac. The panel shows useful detail, including error messages returned from your IdP.
  </Card>

  <Card title="Confirm network connectivity" icon="wifi">
    Passport must reach Microsoft Entra ID to validate credentials. When you customize the Passport login window, enable the network manager so users can join Wi-Fi if needed. The control respects AirPort security settings in macOS.
  </Card>

  <Card title="Wi-Fi limits and isolation testing" icon="triangle-exclamation">
    Passport shows a Wi-Fi icon at the upper-right of the login window; users can click it to join a password-protected network. Passport does not support captive portals, click-through acceptance pages, or enterprise 802.1X networks that require a separate username and password in that flow. To isolate network issues, try a mobile hotspot or wired Ethernet while testing at the Passport login window.
  </Card>
</CardGroup>

### Common Microsoft Entra ID Errors

To look up Microsoft Entra ID sign-in error codes (often prefixed with `AADSTS`), use [login.microsoftonline.com/error](https://login.microsoftonline.com/error).

<AccordionGroup>
  <Accordion title="AADSTS50076: MFA required">
    **What you see:**

    Microsoft Entra ID message: Due to a configuration change made by your administrator, or because you moved to a new location, you must use multi-factor authentication to access the resource named in the error.

    **What to do:**

    * The user needs to complete multi-factor authentication. Multiple policies or settings can require MFA (for example Conditional Access, per-user enforcement, or client-requested MFA).
  </Accordion>

  <Accordion title="AADSTS50020: User cannot access the application">
    **What you see:**

    Microsoft Entra ID message: User account \<user principal name> from identity provider \<your Microsoft Entra ID Active Directory Tenant ID> does not exist in tenant \<your tenant name> and cannot access the application \<your Passport Application (client) ID> in that tenant. The account needs to be added as an external user in the tenant first.

    **What to do:**

    * In the Microsoft Entra admin center, open **Users** > **All users** and confirm that the user exists.
  </Accordion>

  <Accordion title="AADSTS50034: User not in directory">
    **What you see:**

    Microsoft Entra ID message: The user account \<user principal name without the @ symbol and domain> does not exist in \<your tenant name> directory.

    **What to do:**

    * For Passport with MFA, each user in Microsoft Entra ID needs an **Email** value. Without it, the user may complete MFA in the web view but fail at the **Enter your Microsoft Entra ID password** verification step. In the Microsoft Entra admin center, open **Users** > **All users**, select the user, click **Edit properties**, enter an address in **Email**, and click **Save**. The value does not need to be a working mailbox; often it matches **User principal name**.
  </Accordion>

  <Accordion title="AADSTS50126: Invalid username or password">
    **What you see:**

    Microsoft Entra ID message: InvalidUserNameOrPassword: error validating credentials due to invalid username or password. The user did not enter the right credentials. Some of these errors in logs are expected when users mistype credentials.

    **What to do:**

    * Confirm the username and password with your IdP.
    * Microsoft Entra ID may be federated with AD FS or another identity provider, which can surface this error to Passport. See **Authentication Flow in a Federated Environment** in [Using Passport in a federated Microsoft Entra ID environment](/en/endpoint/library/passport/microsoft-entra-id/using-passport-in-a-federated-microsoft-entra-id-environment-formerly-azure-ad).
  </Accordion>

  <Accordion title="AADSTS700025: Public client must not send client secret">
    **What you see:**

    Microsoft Entra ID message: Client is public so neither ‘client\_assertion’ nor ‘client\_secret’ should be presented.

    **What to do:**

    * In the Entra admin center, open **Applications** > **App registrations** > **All applications** > \[your Passport app] > **Authentication** > **Platform configurations**, and align the platform and redirect URI with your Passport **Authentication mode** and with [Configure Passport with Microsoft Entra ID - Mac Login](/en/endpoint/library/passport/microsoft-entra-id/configure-passport-with-microsoft-entra-id-mac-login) or [Configure Passport with Microsoft Entra ID - Web Login](/en/endpoint/library/passport/microsoft-entra-id/configure-passport-with-microsoft-entra-id-web-login):
      * **Mac Login:** Use the **Web** platform and redirect URI **[https://localhost.redirect](https://localhost.redirect)**.
      * **Web Login:** Use **Public client/native (mobile & desktop)** and redirect URI **[https://localhost](https://localhost)**.
    * Open **Certificates & secrets** and remove any **Client secret** on the app if it should be public-client only.
    * In Iru Endpoint, confirm the Passport Library Item **Client secret (optional)** field is empty.
  </Accordion>

  <Accordion title="AADSTS7000215: Invalid client secret">
    **What you see:**

    Microsoft Entra ID message: Invalid client secret provided. Ensure the secret being sent in the request is the client secret value.

    **What to do:**

    * In the Entra admin center, open **Applications** > **App registrations** > **All applications** > \[your Passport app] > **Authentication** > **Platform configurations**, and align the platform and redirect URI with your Passport **Authentication mode** and with [Configure Passport with Microsoft Entra ID - Mac Login](/en/endpoint/library/passport/microsoft-entra-id/configure-passport-with-microsoft-entra-id-mac-login) or [Configure Passport with Microsoft Entra ID - Web Login](/en/endpoint/library/passport/microsoft-entra-id/configure-passport-with-microsoft-entra-id-web-login):
      * **Mac Login:** Use the **Web** platform and redirect URI **[https://localhost.redirect](https://localhost.redirect)**.
      * **Web Login:** Use **Public client/native (mobile & desktop)** and redirect URI **[https://localhost](https://localhost)**.
    * Open **Certificates & secrets** and remove the **Client secret** if the app is configured as a public client for Passport.
    * In Iru Endpoint, confirm the Passport Library Item **Client secret (optional)** field is empty.
  </Accordion>

  <Accordion title="AADSTS50079: Enroll in MFA">
    **What you see:**

    Microsoft Entra ID message: Due to a configuration change made by your administrator, or because you moved to a new location, you must enroll in multi-factor authentication to access the identifier shown in the error.

    **What to do:**

    * If you use **Mac Login**, the user may have legacy per-user MFA enabled. A managed user may need to register security info, or a federated user may need the MFA claim from the federated IdP.
    * Conditional Access, per-user enforcement, and other policies can also require MFA enrollment.
  </Accordion>

  <Accordion title="Ticket decode failed">
    **What you see:**

    * *Ticket decode failed*
    * *Failed to login with possible error: Unknown*

    **What to do:**

    * Remove the optional client secret from the Passport Library Item, let the device check in, sign out of the local user, and sign in again with Passport.
    * If it persists, rule out network issues (for example try a mobile hotspot).
  </Accordion>

  <Accordion title="No key was found matching &#x22;givenName&#x22;">
    **What you see:**

    An error occurred fetching user info: No key was found matching "givenName".

    **What to do:**

    * In the Microsoft Entra admin center, open **Identity** > **Users** > **All users**, open the user who is signing in, and confirm that **First name** is populated.
  </Accordion>
</AccordionGroup>

For Mac Login or Web Login setup, see [Configure Passport with Microsoft Entra ID - Mac Login](/en/endpoint/library/passport/microsoft-entra-id/configure-passport-with-microsoft-entra-id-mac-login) or [Configure Passport with Microsoft Entra ID - Web Login](/en/endpoint/library/passport/microsoft-entra-id/configure-passport-with-microsoft-entra-id-web-login).