Official documentation checked October 14, 2026.
If a Copilot sign-in screen shows AADSTS530005, save the complete error details before changing anything. We could not verify a definition for that exact number in Microsoft’s public Entra error reference when checking this article. The number alone does not establish that an application filter or device-compliance policy is responsible.
This guide explains how to investigate the actual sign-in event without removing MFA or device protections. It applies to organizational Microsoft 365 sign-ins; your IT administrator must investigate tenant policies.
Verify the Error and Application Before Troubleshooting
Copy the error code, full message, UTC timestamp, request ID and correlation ID from the failed sign-in. Record which Copilot product and app you opened, the account and organization selected, and whether the failure occurred before or after authentication. Share this information through your organization’s support channel, not a public forum.
Check every digit against the original screen. Do not silently substitute a similar error number: different Entra codes can have different causes. If the code remains undocumented, use the full message and sign-in record, and escalate to Microsoft support where necessary.
Important correction: d1ddf0e4-d672-4dae-b554-9d5bdfd93547 is identified by Microsoft as the legacy Intune PowerShell application ID, not a general Copilot app ID. Do not use it to create a Copilot exclusion. Obtain the actual application and resource identifiers from the affected event.
Find the Matching Sign-In Event
- Reproduce once using the intended account. Use an approved browser and device. Note the time and avoid repeatedly approving unexpected authentication prompts.
- Ask an authorized administrator to open Entra sign-in logs. Locate the event by user, time and correlation details. Interactive and non-interactive events can represent different parts of the same attempt.
- Read the failure reason and authentication details. Compare the application, resource, tenant, device information and final status. A failed intermediate event does not automatically explain the final user-visible outcome.
- Inspect the Conditional Access tab if applicable. Microsoft’s Conditional Access troubleshooting guide explains how to inspect the policies evaluated for that event. A policy that was not applied is not itself a blocking policy.
Reading policy configuration with Get-MgPolicyConditionalAccessPolicy is not a substitute for this event evidence. That command lists configuration; it does not prove which policy blocked one particular request.
Resolve the Verified Cause Without Bypassing Protection
If the log confirms a device-compliance requirement, have IT check the device’s enrollment, compliance result and supported browser sign-in configuration. Domain membership alone is not proof of compliance. Do not remove the compliance requirement simply because the user wants to open Copilot.
If an MFA or authentication-strength requirement was not satisfied, use the organization’s approved registration and recovery process. Do not disable MFA, dismiss a risk finding without investigation, or approve a prompt that you did not initiate.
If the application or resource is unexpected, investigate the launch link and authentication flow. Do not grant tenant-wide consent or register a replacement enterprise app on the assumption that every sign-in error means Copilot is missing.
For a genuinely mis-scoped Conditional Access policy, its owner should document the intended resource coverage and test a narrowly scoped correction. Conditional Access policies are evaluated together: adding a separate permissive policy does not override another applicable blocking policy. Report-only mode helps evaluate a proposed policy; it does not make an existing enforced block disappear.
Retest and Escalate With Useful Evidence
After an approved correction, repeat the same task with the same intended account and capture the new sign-in event. Confirm both that access succeeds and that the required security controls are still satisfied. Use a nonsensitive test prompt rather than a real confidential document.
If authentication succeeds but Copilot remains unavailable, investigate the exact product’s license and app requirements separately. An available chat window, a Microsoft 365 subscription and a particular Copilot feature are not interchangeable entitlements.
For an unresolved case, provide support with the before-and-after timestamps, correlation IDs, actual application and resource IDs, final status, relevant policy results and client version. State explicitly that the meaning of the exact AADSTS530005 code has not been independently confirmed. That is more useful than changing security settings to fit an assumed diagnosis.