AADSTS530032: Blocked by a tenant security policy

What does AADSTS530032 mean?

BlockedByConditionalAccessOnSecurityPolicy: The tenant admin has configured a security policy that blocks this request. Check the security policies that are defined on the tenant level to determine if your request meets the policy requirements.

Microsoft’s description does not say which tenant-level policy this refers to. It only separates it from a named Conditional Access policy, which returns 53003.

Its sibling is 530035:

BlockedBySecurityDefaults: Access has been blocked by security defaults. This is due to the request using legacy auth or being deemed unsafe by security defaults policies.

If your tenant uses security defaults instead of Conditional Access, 530035 is the code to hunt as well.

Is it an attack?

Microsoft’s password spray playbook lists “530032 - Blocked by Conditional Access on Security Policy” among the sign-in events to review in a spray investigation. The block itself is a control working. What matters is who triggered it and from where.

Pattern	Likely meaning
One user, known device and location, right after a tenant security setting changed	The new setting catching a real user. Configuration, not attack.
Many different users from one IP or range	In practice, an automated attempt your tenant-level policy is stopping. Check the same IP for 50126 and 50053.
530035 on legacy clients (ClientAppUsed IMAP, POP, SMTP, Exchange ActiveSync)	Security defaults blocking legacy auth, as Microsoft’s description says. Across many users from one IP, this is usually a legacy-auth spray.
530032 or 530035 from an IP that also got a success for any user	Something got through by another path. Investigate that success first.

This page does not claim whether the first factor had succeeded on a 530032 row. Microsoft’s description doesn’t say, and the answer may depend on the policy. Check ConditionalAccessStatus and AuthenticationRequirement on your own rows before drawing that conclusion.

How do I find it in my logs (KQL)?

Both codes, grouped by source, with the clients used:

SigninLogs
| where TimeGenerated > ago(7d)
| where ResultType in ("530032", "530035")
| summarize Attempts = count(),
            Users = dcount(UserPrincipalName),
            Clients = make_set(ClientAppUsed, 10),
            Apps = make_set(AppDisplayName, 10),
            Reasons = make_set(ResultDescription, 5)
          by IPAddress, ResultType
| sort by Users desc

Did any IP that hit these blocks also get further somewhere else?

let blockedIPs =
    union SigninLogs, AADNonInteractiveUserSignInLogs
    | where TimeGenerated > ago(1d)
    | where ResultType in ("530032", "530035")
    | distinct IPAddress;
SigninLogs
| where TimeGenerated > ago(1d)
| where IPAddress in (blockedIPs)
| where ResultType in ("0", "50076", "50074", "50079", "53003", "50055")
| project TimeGenerated, UserPrincipalName, IPAddress, ResultType, ResultDescription,
          ConditionalAccessStatus, AppDisplayName, ClientAppUsed
| sort by TimeGenerated asc

ResultType is a string column, so compare with "530032". Legacy clients that replay a stored password can show up in AADNonInteractiveUserSignInLogs, which is why the second query reads both tables.

How do Conditional Access and MFA affect it?

• 530032 is not a named Conditional Access policy result. If you search the Conditional Access tab for the policy, you may not find one. Microsoft points you at the tenant-level security policies instead.
• 530035 comes from security defaults, not from a Conditional Access policy. If you later replace security defaults with your own Conditional Access policies, make sure one of them blocks legacy authentication too.
• Neither code proves MFA is working for the accounts involved. They show that one specific request was refused.

How do I fix AADSTS530032?

For the user: use a modern app (a browser, current Outlook or Teams) instead of an old mail client. If the block continues, give your admin the time and the correlation ID from the error page.

For admins:

1. For 530032, review the tenant-level security settings Microsoft’s description refers to, and find which one matched this request.
2. For 530035, find the client in ClientAppUsed. Move real users and devices off legacy authentication rather than turning security defaults off.
3. If the first query shows many users from one IP, treat it as a spray. Use the second query to find any account that got past the password, then reset and revoke sessions for it.