This site is not affiliated with Microsoft; this is an independent explanation.
Error code 53003 appears when you try to sign in to a Microsoft work or school account and the sign-in is stopped before it finishes. The message often reads "Access has been blocked by Conditional Access policies", and in logs it shows as AADSTS53003. Your username and password were accepted; a rule set by your organisation then said no.
That is the key point: this is a decision, not a fault. An administrator has set conditions for signing in, such as only from approved devices, only from certain locations, or only with extra verification. You can sometimes fix the condition yourself, but often only your admin can change or explain the rule. This page tells you which is which.
Common causes
1Device is not enrolled or not marked compliant
How to tellYou sign in from a personal laptop or phone and the work app is blocked
What fixes itEnrol the device through your organisation's company app, or use the work device
2Sign-in from a blocked place or network
How to tellIt works in the office but not from home, a trip or a mobile hotspot
What fixes itUse the approved network or VPN, or ask the admin if remote access is allowed
3Multi-step verification is required but not set up
How to tellThe policy asks for a second proof and you have not registered one
What fixes itRegister the verification method on your account, then sign in again
4App or browser not approved
How to tellOne app is blocked while another works
What fixes itUse the approved app or the latest app version
5Legacy sign-in method
How to tellOld email clients or scripts fail with this code
What fixes itSwitch to a modern, supported app that signs in the current way
6Risk detection or a new policy
How to tellIt worked yesterday and nothing on your side changed
What fixes itContact the admin to check the sign-in log and the policy
7Account lacks the access the policy expects
How to tellOnly your account is blocked while colleagues are fine
What fixes itAdmin reviews group membership and licence
How to fix it, step by step
Read the full error text
Write down the exact message, the time, the app you used and the correlation or request ID if the page shows one. This small note saves your admin a lot of searching.
Try the approved device and network
If you have an office laptop, sign in from it. If you are on a personal phone or on public Wi-Fi, switch to your usual work network and try again. Policies often tie access to both.
Sign out fully and try a fresh private window
Try a private browsing tab and log in there. Old saved sessions sometimes keep sending outdated sign-in details.
Complete the extra verification
If you see a prompt to set up or approve a second step, finish it. A policy that needs verification fails when none is registered. Never share any code or approval prompt with another person.
Update the app or use the browser version
Install the latest version of the app from its official store. Older apps cannot always meet the sign-in rules, while the web version often can.
Join the device to your organisation if asked
On Windows, look under Settings, then Accounts, then Access work or school. Your organisation may ask you to install a company management app on a phone. Follow your IT team's steps only, and do not accept a profile from an unknown source.
Contact your IT admin with the details
Send the admin your note, the device type and where you were. They can read the sign-in log, see which rule blocked you, and either explain it or allow your case.
What error code 53003 really means
Microsoft sign-in works in stages. First your name and password are checked. Then the service checks any extra rules the organisation has made, called Conditional Access. If a rule's grant requirement is not met, or a rule is set to block, the sign-in ends with error code 53003. The code was returned on purpose, so reinstalling apps or resetting your password will not help unless the rule is about those things.
You open the work mail app on your own phone and see You cannot get there from here. Your sign-in was successful but does not meet the criteria to access this resource. This is the same block in friendlier words. The phone is not a device your organisation allows yet.
53003 error code for personal accounts
Personal Microsoft accounts for mail, games or storage do not use these organisation rules. If you see this code on a personal account, you are probably signing in with a work or school email by mistake. Check which account the sign-in screen is using. If it truly is a personal account and sign-in fails differently, our page on apps and websites not working covers general checks.
The same code is also seen with cloud admin tools and on the Azure portal sign-in screen, where the cause is identical. See also what an error message means for general reading of codes.
Which side can fix 53003
| Situation | You can fix | Admin must fix |
|---|---|---|
| Unregistered verification method | Yes, register it | Only if registration is blocked |
| Personal device not allowed | Use the work device | Change the device rule |
| Blocked location | Use the allowed network | Allow the place |
| Brand new policy affecting many people | No | Review and adjust the policy |
Do not try tricks to hide your location or device to get around the block. Those rules protect company data, and bypassing them can break your workplace's security policy.
For administrators: finding the policy that blocked the user
Open the sign-in logs for the affected user, find the failed entry with 53003, and check the Conditional Access tab. It lists which policies applied and which one failed. Common fixes are adding the device to a managed state, adjusting a named location, excluding a break-glass account, or testing a policy in report-only mode before enforcing it. Document any exception, and keep at least one emergency account that is not covered by blocking rules.
If the same user also sees errors tied to Windows sign-in, compare with other Windows error codes.
Frequently asked questions
What does error code: 53003 mean, including the 53003 error code in Azure?
It means a Conditional Access policy blocked your Microsoft work or school sign-in. Your password was correct, but the device, location, app or verification did not meet your organisation's rule.
How do I fix 53003 error code Microsoft login?
Try the approved device and network, finish any extra verification, and use the latest app. If it still fails, send the exact message and time to your IT admin, who can see which policy applied.
Can I fix error code 53003 by resetting my password?
Usually not. The password was already accepted. The block comes from a policy, so the fix is on the device, network, verification or admin side.
Why do I get 53003 only on my phone?
The policy may allow only enrolled or compliant devices. Ask your IT team whether personal phones are allowed and how to enrol yours.
Is error code 53003 a virus or hack?
No. It is a deliberate block from your organisation's own sign-in rules. If you did not try to sign in, tell your IT admin, since someone else may have used your details.