Official documentation checked October 14, 2026.
AADSTS50158 means an external security challenge is involved in the sign-in flow. It can appear when the user is redirected to terms of use or an external authentication provider. Importantly, the code alone does not prove that the overall sign-in failed.
Do not start by excluding Copilot from Conditional Access or disabling MFA. First determine whether the challenge completed and, if it did not, which requirement or redirect failed.
Check the final sign-in outcome
The Microsoft Entra error reference says AADSTS50158 can be followed by a successful or failed challenge. Capture the timestamp, correlation identifier, account, application, and visible message, then check the associated sign-in sequence.
If the user completed the challenge and Copilot opened, an intermediate event may not require a configuration change. If the browser loops, remains on the challenge page, or ends with an error, record that final result as well.
For a user-facing retry, open the organization’s approved sign-in route in a fresh session and complete the legitimate prompt. Do not accept an unexpected MFA request or enter credentials into an unfamiliar page; verify suspicious prompts with IT.
Identify the requirement from sign-in evidence
An authorized administrator can use Microsoft Entra’s sign-in logs and the Conditional Access troubleshooting guidance to review the matching event, authentication details, target resource, and evaluated policies.
Distinguish a policy that actually failed from one that did not apply. Inspect related events instead of treating the first visible error row as the entire authentication story.
- Terms of use: determine whether the user was shown the required terms and could complete the acceptance flow.
- External MFA provider: check the provider’s corresponding event, redirect, and completion status.
- Another access requirement: follow the specific failure details. Do not infer a device-compliance, password, or registration failure merely from 50158.
Use the documented resource identifiers from the event. Do not assume a universal enterprise application named “Microsoft Copilot Service” is the resource to exclude.
Repair the challenge path without bypassing security
If the required challenge was not presented, investigate the supported browser or app sign-in flow and the external provider configuration. Compare a fresh session with the affected session, changing one variable at a time. Preserve the original event details for correlation.
If a registered method is unavailable, use the organization’s approved identity recovery process. If terms must be accepted, the intended user should complete the legitimate terms flow; an administrator should not assume a click in the admin portal accepts them on that user’s behalf.
Any policy change should address a confirmed configuration problem, preserve the intended protection, and use the organization’s change controls. A transition from legacy per-user MFA to Conditional Access is a separate security project, not an automatic fix for Copilot.
Handle risk findings and escalation accurately
If Identity Protection identifies account risk, follow Microsoft’s risk remediation guidance and your incident process. “Confirm compromised” and “Dismiss risk” express different security judgments; they are not consecutive troubleshooting buttons for clearing a Copilot error.
After the underlying issue is repaired, repeat the original action and verify both the final authentication result and Copilot access. A successful login elsewhere does not prove access to the same target resource.
For unresolved cases, provide the identity team with the time, correlation identifier, target resource, final challenge result, and a sanitized reproduction. Do not send passwords, authentication codes, tokens, or complete browser session captures. Keep protective policies in place while the responsible team diagnoses the actual cause.