Unblocked me please

Hi @Zeda Perry

AADSTS500213: The resource tenant's cross-tenant access policy does not allow this user to access this tenant.

This error indicates that the resource (target) Microsoft Entra tenant is denying access through its cross-tenant access policy. Since you mentioned the account is synchronized through cross-tenant synchronization, I recommend your admin verifying both the synchronization status of the user and the cross-tenant access configuration on both tenants.

Verify the user is still within the synchronization scope

If your organization uses Microsoft Entra cross-tenant synchronization, the source tenant administrator should first confirm that your account is still included in the synchronization scope.

Navigate to:

Microsoft Entra admin center > Entra ID > External Identities > Cross-tenant synchronization

Please verify that:

• The synchronization configuration with the target tenant is still active.
• Your account is still included in the configured synchronization scope.
• If "Sync only assigned users and groups" is configured, your account is still directly assigned or remains a member of an assigned group.
• The synchronization job is completing successfully without errors.
• The synchronized B2B user object still exists in the target tenant and has not been deleted or disabled.

Microsoft Learn – Configure cross-tenant synchronization:

Review the target tenant's inbound cross-tenant access policy

Because the error returned is AADSTS500213, the most important area to check is the resource tenant's inbound policy.

Navigate to:

Microsoft Entra admin center > Entra ID > External Identities > Cross-tenant access settings

Review both:

• Default settings > Inbound access
• Organizational settings > [Source Tenant] > Inbound access

Under B2B collaboration, verify:

• External users and groups are allowed.
• Your account or the group containing your account is included if access is restricted to selected users or groups.
• The application you are attempting to access is allowed under Applications.
• There are no organization-specific rules overriding the default configuration.

Microsoft Learn – Configure cross-tenant access settings for B2B collaboration

Review the source tenant's outbound access policy

Although the error is being generated by the resource tenant, it is also important to verify the source tenant's outbound configuration.

Navigate to:

Microsoft Entra admin center > Entra ID > External Identities > Cross-tenant access settings > Organizational settings

Select the target tenant and review:

• Outbound access
• B2B collaboration > Users and groups
• B2B collaboration > Applications Confirm that:
• Your account is permitted to access the target tenant.
• The required application is not blocked by outbound policy restrictions.

Microsoft Learn – Cross-tenant access overview

Check External Collaboration settings

In addition to cross-tenant access settings, verify:

Microsoft Entra admin center > Entra ID > External Identities > External collaboration settings

Review any domain restrictions and ensure the relevant external domain is not blocked.

If this involves SharePoint Online or OneDrive sharing, also verify that the external sharing configuration allows access from the external organization.

Review the sign-in logs

If the configuration appears correct, review the failed sign-in event.

Navigate to:

Microsoft Entra admin center > Entra ID > Monitoring & health > Sign-in logs

Filter using:

• User
• Application
• Correlation ID
• Request ID
• Status = Failure

Please collect:

• Error code: AADSTS500213
• Correlation ID
• Request ID
• UTC timestamp
• User account
• Application name

The sign-in logs can help determine which tenant, application, and cross-tenant policy evaluation caused the access denial.

Microsoft Learn – Troubleshoot sign-in errors

If everything appears correctly configured. And if:

• The user remains within synchronization scope.
• The synchronized account exists in the target tenant.
• The source tenant outbound policy allows access.
• The target tenant inbound policy allows access.
• The application is in scope.

Then I recommend opening a Microsoft support request and providing:

• Error code: AADSTS500213
• Correlation ID
• Request ID
• UTC timestamp
• Source tenant ID
• Resource tenant ID
• Application being accessed
• Screenshot of the error
• Results of the synchronization scope review
• Results of the inbound and outbound policy review

Ask Microsoft Support to identify which specific cross-tenant policy evaluation resulted in the denial and whether the user and application were considered in scope during policy evaluation.

Microsoft Learn – Create an Azure support request

Thank you for your understanding.