Personal account stuck referencing broken/inactive tenant "Microsoft Services" (AADSTS16000/50020) — blocks all interactive sign-in to Azure/Entra apps

Pedro Luis Gomes 0 Reputation points
2026-07-10T15:30:57.1233333+00:00

My personal Microsoft account (******@hotmail.com) is stuck being routed to a tenant called "Microsoft Services" that I am not a member of, whenever I try to sign in interactively to any Azure/Entra-related app. This happens consistently across:

  • Azure Portal (any admin blade, e.g. App registrations)
  • Device code flow (microsoft.com/devicelogin) using Microsoft's own public client apps
  • Azure Support Portal itself (Microsoft_Azure_SupportPortalExtension)

Reproduced across multiple browsers, Chrome profiles, and incognito/private windows — so it's not a local cache/cookie issue.

I checked account.microsoft.com/organizations — no "Microsoft Services" org listed there, and myaccount.microsoft.com refuses personal-account login directly, so I can't self-service "leave" whatever this stale association is.

Chatted with Microsoft support (Windows/Office queue) — they confirmed this isn't their area and couldn't escalate further.

I need this stale tenant association removed so I can register an Azure app and use Microsoft Graph API for my own OneDrive files.

Latest error captured:

Request Id: 638a2b5b-7d48-45d8-910f-7146df921200 Correlation Id: 451207cf-a238-455c-b225-03fcff4d976c Timestamp: 2026-07-10T14:34:11Z Message: AADSTS50020: User account '******@hotmail.com' from identity provider 'live.com' does not exist in tenant 'Microsoft Services' and cannot access the application 'e6694c91-1590-4e35-9bb7-b865c638b9c1'(Microsoft_Azure_SupportPortalExtension) in that tenant. The account needs to be added as an external user in the tenant first. Sign out and sign in again with a different Azure Active Directory user account.

Microsoft Security | Microsoft Identity Manager
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Jerald Felix 18,200 Reputation points Volunteer Moderator
    2026-07-10T17:01:19.4366667+00:00

    Hello Pedro Luis Gomes,

    Greetings! Thanks for raising this question in the Q&A forum.

    The tenant "Microsoft Services" is not a broken or stale association that needs to be removed. It is Azure's real, known default system tenant, ID f8cdef31-a31e-4b4a-93e4-5f571e91255a, that every personal Microsoft account gets transparently routed into whenever it touches an Azure or Entra app and does not already have a directory of its own. This tenant intentionally has no real directory behind it and grants only restricted, non-administrative access, which is why App registrations, the Support Portal extension, and every other admin blade reject you there with AADSTS50020. Since it's not something you're actually a stale guest member of, there is nothing to "leave" or unstick, and that's also why account.microsoft.com/organizations shows nothing and myaccount.microsoft.com won't let you self-service it.

    1. Stop trying to remove the Microsoft Services association

    This is expected default routing behavior for any personal account without its own tenant, not a corrupted membership record, so there is no cleanup action available and no support queue that will "fix" it by detaching you from it.

    1. Create your own Azure AD (Entra ID) tenant

    Sign up for a free Azure account at azure.microsoft.com/free using this same hotmail.com account. This automatically provisions a brand new directory/tenant with you as its Global Administrator, which is a real, fully functional tenant rather than the restricted Microsoft Services shell you're currently landing in.

    1. Do your App registration inside the new tenant

    Once signed into your new tenant, go to Microsoft Entra ID, then App registrations, then New registration, and register the app you need for Microsoft Graph API access to your OneDrive files. Since app registration is always tenant-scoped, this only works once you have a tenant where you are actually a member, which the Microsoft Services tenant deliberately is not.

    1. Set the correct supported account type on the app registration

    Since you are accessing your own personal OneDrive rather than organizational data, when registering the app choose the "Personal Microsoft accounts only" or "Accounts in any organizational directory and personal Microsoft accounts" supported account type, so your live.com identity is accepted as the signing-in principal for the Graph calls you intend to make.

    1. Use device code flow against your new tenant, not common or the old broken path

    When testing sign-in, point device code flow or your app's authority at your new tenant ID (or /organizations if appropriate for your account type) rather than the generic common endpoint, since that generic endpoint is what was routing you into Microsoft Services by default whenever no home tenant existed for your account.

    If this answer helps you kindly accept the answer which will help others who have similar questions.

    Best Regards,

    Jerald Felix

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.