Description
When attempting to update permissions for a Shield organization, an error message AADSTS50097 (Device authentication is required) may appear if device authentication is configured for the tenant.
Symptoms
When a Shield Admin clicks Action needed, update Shield permissions for an organization in Shield Ctrl, the Microsoft consent step fails and the permissions update does not complete. The behavior is consistent across these attempts:
- Clicking the button from the organization page in Shield Ctrl
- Starting the update from the tenant's own screen
- Copying the consent URL and opening it while signed in as the tenant's Global Administrator
- Using a different browser or a private window
The Microsoft sign-in page returns error AADSTS50097: Device authentication is required. In some cases the OAuth window opens inconsistently or closes before consent is granted.
Cause
A Conditional Access policy in the customer's Microsoft Entra ID tenant requires sign-ins to come from a registered or compliant device. Microsoft evaluates this policy when the administrator signs in to grant consent, and it rejects the sign-in with AADSTS50097 when the device does not meet the requirement.
Shield sends the consent request to Microsoft successfully, so the block happens entirely within the customer's tenant. The administrator's role, browser, cache, and cookies are all working as expected, which is why changing browsers or reusing the consent URL produces the same result. See Microsoft's description of AADSTS50097 for reference.
Resolution
The person who manages the customer's Entra ID tenant can complete consent using either of these options.
Option 1: Grant consent from a device that meets the policy (recommended)
- Sign in to a device that is Microsoft Entra joined, Microsoft Entra hybrid joined, or marked compliant in Intune for that tenant.
- On that device, sign in to Shield Ctrl and open the organization.
- Click Action needed, update Shield permissions.
- Sign in with the tenant's Global Administrator account and accept the requested permissions.
This option keeps the tenant's security policy fully in place.
Option 2: Temporarily exclude the administrator from the policy
- In the Microsoft Entra admin center, go to Protection > Conditional Access > Policies.
- Open the policy that requires a registered or compliant device.
- Under Users, add the Global Administrator account to Exclude, then save the policy.
- Return to Shield Ctrl and click Action needed, update Shield permissions, then complete consent.
- Remove the exclusion from the policy and save it again.
The tenant's sign-in logs (Monitoring & health > Sign-in logs) show the name of the policy that blocked each attempt, which helps identify the correct policy for step 2.
Verify the update
After consent succeeds, the Action needed prompt clears from the organization in Shield Ctrl. In the Entra admin center, the Shield enterprise application shows the updated permissions under Enterprise applications > Permissions, and the sign-in log records the consent attempt with a status of Success.
Notes
- Repeating the attempt from the same unregistered device returns the same error, so the fastest path is to switch to a compliant device or adjust the policy first.
- Device requirements are set by the customer's tenant administrator. If the Shield Admin does not manage the tenant, share this article with the person who does.
- If consent still fails from a compliant device, or the error code is something other than AADSTS50097, contact Microsoft.
Related to
Updated