External guest users error AADSTS90023 Teams mobile app on Android

Capture a failed Android sign-in in Microsoft Entra and open a Microsoft 365 support request with its correlation details, because the same guest-only AADSTS90023 pattern has required backend investigation after reinstall and account-side troubleshooting failed.^1^

AADSTS90023 officially means InvalidRequest — the authentication service request isn't valid; the code alone does not identify the underlying cause.^2^ Browser success confirms that the guests can access the tenant, while the Android failure occurs during the separate mobile tenant-switching authentication flow.

1. Correlate a fresh Android failure

1. Ask one affected guest to reproduce the error and record:
   • Exact UTC timestamp
   • Request ID
   • Correlation ID
   • Android version, device model, and Teams app version
   • Screenshot of the complete error
2. Within 48 hours, sign in to the Microsoft Entra admin center with at least the Reports Reader role.
3. Go to Entra ID → Monitoring & health → Sign-in logs.
4. Filter by:
   • User: affected guest
   • Status: Failure
   • Application: Microsoft Teams
   • Date/time: reproduction time
5. Open the matching event and save:
   • Sign-in error code
   • Failure reason and additional details
   • Correlation ID and request ID
   • Application, resource, client app, and device details
   • Authentication Details
   • Conditional Access result

Microsoft documents these fields as the primary evidence for isolating Entra sign-in failures.^3^

If the event is difficult to locate, go to Diagnose & solve problems → Sign-in Diagnostic → Troubleshoot → All Sign-In Events, then search using the user, application, correlation/request ID, and timestamp.^4^

2. Act only on the result shown in the log

• Conditional Access shows Failure: Open the event’s Conditional Access tab, select the failed policy, and inspect its grant controls and device/client conditions. Change or exclude the policy only if the log identifies it as the blocker; do not broadly disable Conditional Access.^5^
• AADSTS90023 appears without a failed Conditional Access policy: Treat this as an invalid mobile authentication request requiring Microsoft investigation. A closely matching accepted Q&A case—Android guest tenant selection, browser access working, and reinstall unsuccessful—directs administrators to escalate for backend analysis.^1^
• Guest identity changed after invitation redemption: Only in that condition, reset redemption rather than deleting the guest. Go to Entra ID → Users → guest user → Overview → B2B collaboration → Reset redemption status → Reset, then have the user accept the new invitation with the intended Gmail identity. This preserves the object ID, memberships, and application assignments and requires at least Helpdesk Administrator or User Administrator.^6^ Because browser and desktop access already work for all affected guests, do not apply this tenant-wide unless the logs or identity history indicate a redemption mismatch.

3. Escalate with complete evidence

In the Microsoft 365 admin center, select Help & support. Enter the issue description; if the suggested results do not resolve it, select Contact Support and choose phone or email.^7^

Include:

• Tenant domain, without posting it publicly
• “All external Gmail B2B guests affected”
• “Teams browser/desktop succeeds; Teams Android fails when selecting the resource organization”
• AADSTS90023
• UTC timestamp, request ID, correlation ID, and exported sign-in event
• Conditional Access result
• Android/Teams versions and device models
• Confirmation that cache/data clearing, reinstalling Teams, and Microsoft Authenticator were already tested

Continue using Teams web or desktop as the temporary workaround; repeating app cache clearing, reinstallation, or Authenticator setup is unlikely to add diagnostic value here.

References

1. Teams: Sign-in fails: AADSTS90023 "An arror occurred while processing incoming message" - Microsoft Q&A
2. Microsoft Entra authentication and authorization error codes
3. How to troubleshoot Microsoft Entra sign-in errors
4. What is the Sign-in diagnostic in Microsoft Entra ID?
5. Troubleshoot sign-in problems with Conditional Access
6. Reset the redemption status for a guest user in Microsoft Entra External ID
7. Get support for Microsoft 365 for business