AB#3195: Private version of PR#1739

Author: AmandaAZ

support/entra/entra-id/app-integration/error-code-aadsts700003-device-object-not-found.md

@@ -0,0 +1,50 @@
+---
+title: Error AADSTS700003 - Device object was not found in the tenant '{tenantName}' directory
+description: Provides a solution to an issue where users experience the AADSTS700003 error when they try to sign in to an Azure application that can be used with Microsoft Entra ID.
+ms.service: entra-id
+ms.date: 02/12/2025
+ms.reviewer: jutakata, willfid, bachoang, joaos, modawud, v-weizhu
+ms.custom: sap:Issues Signing In to Applications
+---
+
+# Error AADSTS700003 - Device object was not found in the tenant '{tenantName}' directory
+
+This article discusses how to resolve the "AADSTS700003" error that occurs when a user tries to sign in to an application that's integrated into Microsoft Entra ID.
+
+## Symptoms
+
+When users try to sign in to an application that's integrated into Microsoft Entra ID, they receive an "AADSTS700003" error with one of the following error messages:
+
+> Device object was not found in the tenant '{tenantName}' directory.
+
+Or
+
+> Your organization has deleted this device.
+
+## Cause
+
+This issues occurs because the device object is deleted on the user's home tenant. When a device is deleted, the "Delete device" activity type is recorded in [Microsoft Entra audit log](/entra/identity/monitoring-health/concept-audit-logs). In Microsoft Entra ID, there are three ways to register or join user devices:
+
+- Microsoft Entra registered
+- Microsoft Entra joined
+- Microsoft Entra hybrid joined
+
+Device registration or join creates a [device identity](/entra/identity/devices/overview). This device identity is used in scenarios such as [device-based Conditional Access policies](/entra/identity/conditional-access/concept-conditional-access-grant) and [Mobile Device Management with the Microsoft Intune](/mem/endpoint-manager-overview). When users get the AADSTS700003 error, the device object isn't found in the tenant.
+
+## Solution
+
+Engage the home tenant administrators to determine when and why your device object is deleted. Then, take the corresponding action depending on the device registration/join types, as shown in the following table: 
+
+| Device join type | Action |
+|--|--|
+| Microsoft Entra registered | For Windows 10/11 Microsoft Entra registered devices, Go to **Settings** > **Accounts** > **Access Work or School**. Select your work or school account on the screen. Select **Disconnect** to disconnect the device. Then, register the device to Microsoft Entra ID again.<br/><br/>For iOS and Android, you can use the Microsoft Authenticator application **Settings** > **Device Registration** and select **Unregister device**. Then, register the device to Microsoft Entra ID again.<br/><br/>For macOS, you can use the Microsoft Intune Company Portal application to unenroll the device from management and remove any registration. Then, register the device to Microsoft Entra ID again.<br/><br/> For more information, see [Microsoft Entra register FAQ](/entra/identity/devices/faq#how-do-i-remove-a-microsoft-entra-registered-state-for-a-device-locally).|
+| Microsoft Entra joined | Open a PowerShell console with the administrative right on the Windows device, and run the `dsregcmd /forcerecovery` command. Select **Sign in** to sign in with your Microsoft Entra ID account. |
+| Microsoft Entra hybrid joined | Open a PowerShell console with the administrative right on the Windows device, and run the `dsregcmd /leave` command. Then, reboot the device and sign in to the device with your domain credential. |
+
+## More information
+
+For a full list of authentication and authorization error codes, see [Microsoft Entra authentication and authorization error codes](/azure/active-directory/develop/reference-error-codes).
+
+To investigate individual errors, go to [https://login.microsoftonline.com/error](https://login.microsoftonline.com/error).
+
+[!INCLUDE [Azure Help Support](../../../includes/azure-help-support.md)]

support/entra/entra-id/toc.yml

@@ -93,6 +93,8 @@
         href: app-integration/error-code-AADSTS75005-not-a-valid-saml-request.md
       - name: Error AADSTS750054 - SAML request or response not present
         href: app-integration/error-code-AADSTS750054-saml-request-not-present.md
+      - name: Error AADSTS700003 - Device object was not found in the tenant directory
+        href: app-integration/error-code-aadsts700003-device-object-not-foundmd
       - name: Error AADSTS7000110 - request is ambiguous, multiple application identifiers found
         href: app-integration/error-code-aadsts7000110-request-is-ambiguous.md
       - name: Error AADSTS7000112 - application is disabled