Troubleshooting: AADSTS51004 Federating Office 365 with a Non-Synced Entra AD Account

Version Affected: All
 
 

Overview

When federating with Office 365 (O365) using WS-Federation, if there is no directory synchronization between on-premises Active Directory (AD) and Microsoft Entra ID, affected users see the following error when signing in:

AADSTS51004: The user account does not exist in the directory. To sign into this application, the account must be added to the directory.

Cause

SecureAuth's WS-Federation claim to Office 365 includes the OnPremisesImmutableID attribute, which is normally populated automatically by the AD Connect synchronization process between on-premises AD and Entra ID. If there is no sync between the two, OnPremisesImmutableID is blank in Entra ID, Office 365 cannot match the incoming claim to an account, and sign-in fails with the AADSTS51004 error above.

Resolution:

1. In Entra ID, populate each affected user's OnPremisesImmutableID attribute with a value that also exists on that user's on-premises AD account. Use a value that is unique and unlikely to ever change.
2. In the Admin Console, edit the realm's Datastore and set AuxID2 to the AD attribute that contains the same value you used in step 1.
3. Follow Microsoft 365 Application Integration to complete the rest of the federation setup.

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.