---
key: microsoft-inbox-conditional-access
title: Fix a Microsoft sign-in blocked by security rules
audience: staff
section: communications/email
routes: ["/settings/communications/email-accounts"]
permissions: ["communications.email.provider_connection.manage"]
features: ["communications.email"]
since: 0.0.1
updated: 0.0.1
status: published
summary: What to do when Microsoft blocks the sign-in for a mailbox connection because of your company's conditional access, device or location rules.
keywords: [conditional access, blocked sign-in, AADSTS53003, compliance policy, managed device, security policy]
related: [connect-a-microsoft-inbox, microsoft-inbox-mfa-required, microsoft-inbox-admin-consent]
---

In the sidebar, open **Settings**, then choose **Email Accounts** under **Communications** (`/settings/communications/email-accounts`). This screen appears after the Microsoft sign-in step of [[connect-a-microsoft-inbox]], when Nova shows **Your company's Microsoft security rules blocked this sign-in**.

Your company's Microsoft 365 account has rules about who may sign in, from where, and on which devices. One of those rules stopped this sign-in before Microsoft could ask you to approve Nova. Microsoft usually shows a code starting with AADSTS53 on its own page first. Personal Outlook.com, Hotmail, Live and MSN addresses do not have these company rules.

## Before you start

Only your company's Microsoft administrator can change these rules. Have the exact message ready for them: open **Error details** at the bottom of the error screen and select **Copy details**.

## Steps

1. Ask the Microsoft administrator to check that the mailbox account is allowed to sign in to connected apps.
2. Ask them to review the sign-in rules that apply to email access. Location, device and app rules are the usual causes.
3. Have them add an exception for this mailbox, or relax the rule, and save the change.
4. If the rule requires a company-managed device, sign in from one.
5. Close the browser window, open a new private window, and start [[connect-a-microsoft-inbox]] again. **Start mailbox setup again** on the error screen opens the **Connect mailbox** panel.

## What you see

When the rule no longer blocks the account, Microsoft's sign-in goes through to the permissions step and Nova finishes with **Connected**.

## If something looks different

- The screen now says **Microsoft needs an extra sign-in check**: the rule asks for two-step verification rather than blocking you. See [[microsoft-inbox-mfa-required]].
- The screen says **Ask your Microsoft administrator**: the sign-in worked, but an administrator has to approve Nova. See [[microsoft-inbox-admin-consent]].
- The block comes back after the administrator changed the rule: Microsoft can take a few minutes to apply changes. Wait, then try again from a new private window.