Azure error AADSTS500082 SAML assertion is not present in the token means the SAML response reached Microsoft Entra ID without a valid assertion.
What AADSTS500082 SAML Assertion Is Not Present In The Token Means
When a user signs in through single sign on, the identity provider sends a SAML response back to Microsoft Entra ID. Inside that response sits a SAML assertion, which carries who the user is, how they authenticated, and any claims the application needs. If that assertion section is missing or empty, Entra cannot build a token for the app, and you see the full message aadsts500082 saml assertion is not present in the token.
This error tells you that the trust between the identity provider and Entra is wired for SAML, yet the actual SAML payload is incomplete. The browser round trip often looks normal, but when you check the sign in logs you find that no usable assertion arrived, so the platform refuses to issue an access token or ID token.
In many tenants this appears when SAML based federation has been configured for Microsoft 365, Teams, or a third party SaaS, and a change on either side altered the format of the response. A claim that used to be present might now be empty, the SAML response might be filtered for some users, or conditional access might send the request through a path that no longer issues SAML at all.
Although the wording mentions the token, the root problem usually sits earlier in the flow. The token that apps want only exists after Entra accepts the SAML assertion. Once you repair the SAML side, fresh tokens follow without more changes to client software.
Common Scenarios That Trigger AADSTS500082
Most sightings of aadsts500082 cluster around a handful of patterns. Knowing which one matches your setup makes troubleshooting much faster and keeps you from chasing random settings.
| Scenario | Likely Cause | Where To Check |
|---|---|---|
| Federated Microsoft 365 domain | SAML response missing NameID or required claim | AD FS or other SAML identity provider |
| Guest user from partner tenant | Conditional access path that never issues SAML | Entra sign in logs and conditional access policies |
| Third party SAML app gallery entry | User not allowed for that app, so no assertion returned | App provisioning rules in identity provider and Entra |
Another pattern surfaces when a team switches from WS Federation or OpenID Connect to SAML without fully updating application settings. The application still expects an OAuth token, yet the user flows through a SAML based sign in, which creates confusion about what kind of message should be present at each step.
You also see aadsts500082 when attribute release rules change on an external identity provider such as AD FS, PingFederate, Okta or a university login service. If a rule now tries to send a claim based on an attribute that can be empty, the SAML engine might throw away the entire assertion rather than issue one with an invalid value.
Fixing AADSTS500082 When The SAML Assertion Is Missing From The Token
The fastest way to clear aadsts500082 is to treat it as a structured sign in investigation rather than a generic sign in failure. That means capturing a fresh sample, mapping the flow, and confirming whether a SAML assertion truly exists on the wire.
- Capture A Fresh Sign In Attempt — Ask an affected user to try again and record the full error details, including timestamp, request ID, and correlation ID that appear on the error page.
- Check The Entra Sign In Logs — Open the Entra admin center, go to the sign in logs, filter by the recorded time, and confirm that the entry shows a result linked to SAML and mentions the same request ID.
- Confirm The App Uses SAML — Open the enterprise application entry and check that the single sign on mode is SAML and not OpenID Connect or password based sign in.
- Inspect The SAML Response — Use browser developer tools, Fiddler, or a SAML tracer plug in to capture the response, decode it, and see whether an Assertion element exists under the Response node.
- Verify Required Claims Are Populated — Check that NameID and any mapped attributes the app expects have real values for the user, without blank or malformed entries.
- Check App Assignment Rules — In the identity provider, confirm that the user is allowed to reach this application so that a SAML response is actually created for the session.
- Repeat The Sign In After Changes — After each adjustment, have the user sign out completely, close browsers, and attempt sign in again to verify that the assertion now appears.
During these checks, many admins discover that no SAML assertion was created because the app never received permission to issue one for that user population. In other setups the assertion exists but omits values for claims the application expects, so Entra cannot convert the response into a token for downstream APIs.
Step By Step Checks In Azure Entra Id And Apps
Review Sign In Log Details
Start with the sign in entry that matches the error page. Under the authentication details view you can see whether the request used federation, which conditional access policies applied, and whether Entra asked for multi factor authentication. Pay close attention to the result code and inner status messages, since these show whether Entra reached a stage where it expected a SAML assertion but did not see one.
Confirm SAML Settings In The Enterprise Application
Next, open the enterprise application blade for the affected app. Under single sign on, confirm that the basic SAML configuration lines up with the metadata from the identity provider. That includes the identifier, reply URL, and the certificate thumbprint. Small mismatches here can cause the external identity provider to skip issuing an assertion or send it to another reply address.
While you are in this view, select the Test button if it is available. This launches a small test flow from the portal and lets you see whether your own account experiences the same aadsts500082 path or whether the fault only appears for certain users.
Inspect Claim Mapping Rules
In both Entra and external identity providers you should confirm the claim mapping rules. For many Microsoft 365 style integrations, Entra expects NameID in a specific format and also checks one or two extra attributes that map to user principal name or immutable ID. If a mapping rule pulls from an attribute that can be null, the SAML engine might reject the assertion.
To test this theory, temporarily switch the mapping for a single user to a known static value and capture a new sign in. If the assertion now appears and the error changes to a different code, you have found a claim that needs a safer mapping or a different source attribute.
Check Third Party Identity Provider Configuration
Many aadsts500082 cases trace back to changes on AD FS, PingFederate, Shibboleth, or other SAML identity providers. Review recent edits to relying party trust entries, certificate updates, and any new outbound claim rules. When you see a date match between those edits and the first waves of errors, that link gives you a strong lead.
Some services also allow per user or per group control of who can sign in to Microsoft 365 or other SAML relying parties. If a user is not in the allowed list, the service might stop issuing SAML responses for them altogether, which leads straight to this assertion missing message.
Avoiding Repeat AADSTS500082 Errors In Production
Once today’s incident is under control, it pays to add small guardrails so that the same aadsts500082 pattern does not return with the next change window. A few simple practices catch most regressions before users see them.
- Document SAML Dependencies — Keep a short record of which domains, apps, and tenants rely on SAML federation so that change owners know when they touch sign in paths.
- Add A Test Account Per Scenario — Maintain stable test identities for each SAML relying party and verify their sign in results after any configuration or certificate change.
- Automate A Basic SAML Health Check — Use a simple script or monitoring tool that signs in with a non production account and alerts your team when the response no longer contains a valid assertion.
- Review Attribute Mapping Before Deprovisioning Fields — When directory teams plan to remove or rename attributes, compare those plans against SAML claim rules so that no mapping points at a field that will soon be empty.
It also helps to store a few sample SAML responses from healthy periods. With those examples on hand you can compare current responses to a known good version and spot changes in NameID format, attributes, or audience values much faster.
When To Loop In Vendors Or Microsoft Help
Some aadsts500082 cases sit outside what a single admin can change. That is especially true in hosted university or enterprise setups where an external team controls the SAML identity provider. In those cases the fastest path is usually to open a ticket with the responsible team, include sample sign in logs, and attach decoded SAML traces that show which assertion pieces are missing.
For stubborn cases where Entra logs still feel unclear, a service request to Microsoft with request IDs and timestamps from several failed attempts lets their engineers trace the path on the backend. You can speed this process by noting the correlation ID from the browser error and confirming the timeline in your own sign in logs first.
Finally, if users from a partner tenant or guest domain hit aadsts500082 only when multi factor prompts appear, bring the partner into the conversation. They may have conditional access policies, trusted locations, or per user settings that alter how and when SAML responses are sent. Aligning those policies on both sides usually turns this from a repeating outage into a brief entry in your post incident notes.