ESM Not working - Error The signed in user is not assigned to a role for the application (4378158)

ESM Not working - Error The signed in user is not assigned to a role for the application

The Archive Manager Exchange Store Manager (ESM) service or a related scheduled task fails to authenticate. When reviewing the service logs or the OAuth sign-in logs, the following error is observed:

Error AADSTS50105: The signed in user is not assigned to a role for the application.

This occurs in environments configured to use Microsoft Entra ID (formerly Azure AD) for identity management via SAML/OAuth.

The Archive Manager Proxy account (the service account running the ESM service) has not been granted access to the Archive Manager Enterprise Application in Microsoft Entra ID.

By default, the Enterprise Application may be configured to require explicit user assignment, and the service account is missing from the allowed list.

Method 1: Assign the Proxy Account (Recommended Best Practice)

This method maintains higher security by restricting access to specific accounts only.

1. Log in to the Microsoft Entra Admin Center https://entra.microsoft.com/

2. Navigate to Identity > Applications > Enterprise applications.

3. Search for and select the Archive Manager OAuth application.

4. Under the Manage menu on the left, select Users and groups.

5. Click + Add user/group.

6. Search for the Archive Manager Proxy account (or the specific service account running the ESM service).

7. Select the account and click Assign.

Method 2: Remove Assignment Requirement

This method allows all users in your tenant to authenticate against the application without individual assignment.

1. Log in to the Microsoft Entra Admin Center.

2. Navigate to Identity > Applications > Enterprise applications.

3. Search for and select the Archive Manager OAuth application.

4. Under the Manage menu on the left, select Properties.

5. Locate the setting Assignment required? and toggle it to No.

6. Click Save.

Propagation Time: Changes in Microsoft Entra ID can take a few minutes to propagate. If the error persists immediately after applying the fix, wait 5–10 minutes and restart the Archive Manager ESM service. Service Account: Ensure you are assigning the correct account (the one configured in the Proxy Credentials & Azure AD Directory Connector).