Official documentation checked October 14, 2026.
AADSTS50173 means Microsoft Entra ID rejected a grant that is no longer valid after revocation and needs fresh authentication. In organizational Copilot, begin with the affected app’s sign-in flow. Do not disconnect a managed Windows device or erase all Microsoft credentials to address a single sign-in error.
1. Confirm the error and the affected account
Record the complete error code, timestamp and time zone, request or correlation ID, app name, and work account. Note a recent password change, password reset, or administrator-directed session revocation. Microsoft’s AADSTS50173 troubleshooting article identifies these authentication-state changes and recommends obtaining a fresh token through the app.
Check which service you opened. A personal Microsoft account in consumer Copilot is not the same identity as a work account in organizational Copilot. An error that changes to a different code after reauthentication is new diagnostic evidence, not necessarily the same loop.
2. Reauthenticate in the app that failed
- Save documents and any unsent work before signing out.
- Use the affected app’s reauthentication prompt or its account menu to sign out of the affected account, where available. Close that app or tab and reopen it.
- Select the correct work account and complete the organization’s required authentication, including MFA. Use only the sign-in flow initiated from the trusted app or your organization’s normal service address.
- Retry a harmless action, such as opening the same document and requesting a summary of non-sensitive test content.
App interfaces differ: there is no universal “Sign out of all accounts” command across Outlook, Teams, and the other Microsoft 365 apps. Signing out is also not a guarantee that every broker token or server session has been deleted. Microsoft’s refresh-token documentation distinguishes app authentication from server-side revocation.
If the browser repeatedly selects the wrong account, check the active browser profile and use the organization’s normal work profile. If IT identifies a browser-session problem, targeted removal of the affected site’s cookies can be appropriate after saving work; it signs you out and may affect related Microsoft sessions. Do not begin by clearing all browsing data or matching every credential containing “Microsoft.”
3. Separate a browser problem from a Windows sign-in problem
Compare the same work account in the approved web experience and the affected desktop app. If only one client fails, note its version and update status for IT. That difference narrows the investigation but does not prove its token cache is corrupt.
For a managed Microsoft Entra joined or hybrid-joined Windows device, IT can collect read-only sign-in evidence using dsregcmd /status under the affected user’s normal session. Microsoft’s field reference explains the device and user context. Do not run dsregcmd /leave, disconnect Access work or school, or delete broker storage as a generic reset. Those actions affect registration or authentication beyond Copilot and need a device-specific recovery plan.
4. Investigate repeated revocation with IT
If a new interactive sign-in succeeds but the loop returns, give IT the before-and-after timestamps and correlation IDs. An authorized administrator can use Entra ID → Monitoring & health → Sign-in logs to correlate the user, client, requested resource, failure details, and applied policies. Copilot’s dependent resources matter too; inspect the actual event instead of assuming a single policy named Copilot is responsible. See Microsoft’s sign-in investigation workflow.
Do not exclude Copilot from Conditional Access or weaken MFA simply to stop prompts. Microsoft retired configurable refresh/session-token lifetime policies in 2021; administrators now use supported authentication-session controls where appropriate. The token-lifetime reference explains this distinction.
If revocation was part of an account-security response, follow that response rather than undoing it. Close the case only after the original action works and the recurring failure has been checked over the relevant usage period. Keep tokens, passwords, and unredacted authentication traces out of public support posts.