AADSTS530035: why Security Defaults blocks the sign-in after the password is accepted

You sign in to a Microsoft 365 tenant as an administrator, often from a command-line tool or a setup script that gives you a code to enter at microsoft.com/devicelogin. The password is accepted. Then Microsoft shows You don’t have access to this, and the details carry this code:

AADSTS530035: Access has been blocked by security defaults. This is due to the request using legacy auth or being deemed unsafe by security defaults policies.

The account is fine and the password is right. The tenant’s Security Defaults policy refused to issue a token for the way you signed in.

What does AADSTS530035 mean?

It means Security Defaults blocked the sign-in. Security Defaults is the free baseline policy Microsoft turns on for new tenants: it requires MFA, and it blocks sign-in methods Microsoft considers unsafe. The password check passes first, which is why the error arrives after you have typed it correctly.

Two kinds of sign-in hit it in practice. Legacy authentication such as SMTP AUTH, which is the same block that shows up as a 535 error when a sequencer connects. And, since July 2026, device code flow: the sign-in where a tool shows a short code and you enter it in a browser.

What we measured

Our tenant setup used to sign in by device code. On 14 September 2026 a tenant with Security Defaults on failed that sign-in with AADSTS530035, after accepting the admin’s password. Tenants with Security Defaults off completed the same sign-in normally. The setup itself turns Security Defaults off, but it never got the chance, because the sign-in it needed to do that was the thing being blocked.

That is the trap worth knowing about: a tool that fixes Security Defaults for you cannot run if it signs in by device code on a tenant where Security Defaults is still on. The first change has to be made by hand.

How to fix it

1. Sign in to the Entra admin center in a browser as the Global Admin. Normal browser sign-in is not blocked; it asks for MFA instead.
2. Go to Overview, then Properties.
3. Select Manage security defaults.
4. Set Security defaults to Disabled, choose a reason, and save.
5. Run the device code sign-in again.

Turning it off took effect within a minute on our tenants. Turning it back on can take longer to apply, so if you are testing both directions, wait before concluding a change did nothing.

If the tool offers a browser sign-in instead of a device code, use that. Our own tenant setup moved to browser sign-in for this reason. It avoids the device code block, though anything that sends over SMTP still needs Security Defaults off for the mailboxes.

What turning Security Defaults off costs

Security Defaults is what enforces MFA on the tenant, administrators included. Turning it off removes that, so put something back. Enable per-user MFA on the Global Admin at minimum. If the tenant has Entra ID P1, Conditional Access can require MFA for admins while allowing what you need, which is the better long-term setup.

On a tenant used only for cold email inboxes, Security Defaults has to stay off anyway, because it blocks SMTP AUTH and the mailboxes cannot send with it on. The admin account is the one that matters, and it should never be left without MFA.

Is AADSTS530035 the same as Need admin approval?

No. AADSTS530035 refuses the sign-in itself. Need admin approval comes after a successful sign-in, when an app asks for permissions a user cannot grant. On a new tenant you may meet both, in that order: Security Defaults first, then admin consent for the sequencer.