I have Entra federated with Okta. One of my users is getting this error: AADSTS50105: The signed in user is blocked because they are not a direct member of a group with access. My problem is that they are a member of a group with access and assigned app.

Question

Hi, One of my users is getting this error when trying to log in to the other IDP using Entra federation:

Message: AADSTS50105: Your administrator has configured the application to block users unless they are specifically granted ('assigned') access to the application. The signed in user is blocked because they are not a direct member of a group with access, nor had access directly assigned by an administrator. Please contact your administrator to assign access to this application.

The issue is that she is a group member and has the app assigned to her. None of my other users in this group are having this error.

I've checked everything I can think of unless there is a policy that may be blocking it for her. Could that be? Has anyone else run into this?

I'm new to this. Plz help.