AADSTS50076: MFA required — fixing service and legacy sign-ins

Microsoft Entra ID returns AADSTS50076 when a sign-in needs multifactor authentication but the client cannot prompt for it. Common with scripts, legacy auth, and service accounts.

What the error means

AADSTS50076: Due to a configuration change made by your administrator,
or because you moved to a new location, you must use multi-factor
authentication to access '<resource>'.

A Conditional Access policy or per-user MFA requires a second factor, and the client is non-interactive (ROPC flow, basic auth, a scheduled script) so it cannot show the prompt.

Find the policy

Open Entra admin center → Monitoring → Sign-in logs.
Filter by the user and Status: Failure.
Open the event and check the Conditional Access tab to see which policy applied.

Fix

Scripts and automation

Don't exclude the account from MFA. Move to an identity that doesn't use passwords:

Managed identity for workloads in Azure.
App registration with certificate for everything else.

Connect-MgGraph -ClientId $appId -TenantId $tenantId `
  -CertificateThumbprint $thumb

Users on legacy clients

Update Office to a build that supports modern authentication, or switch the mail profile from IMAP/POP to Exchange.

Named locations

If MFA triggers from trusted offices, verify your egress IPs are listed under Conditional Access → Named locations.

Verify

Repeat the sign-in and confirm the log entry shows Success with the expected authentication method.