Hi all,
I’m hoping someone can help me troubleshoot a login issue affecting one of our bots when it signs in to our production environment.
What’s happening
The sign-in page loads normally, but it immediately redirects to a Microsoft sign-in error page. This happens frequently on the bot’s first login attempt of the day( Only on Monday). If I re-trigger the bot manually, or if it retries later in the day, it usually logs in fine.
Hi @Dinesh_Babu_S,
Root cause: AADSTS750054 means Entra ID’s SAML endpoint was hit directly, without a SAMLRequest in the query string. The service provider never generated the AuthnRequest — so the handshake never started. This is a session/URL problem, not a credential or SAML config problem.
Why only Monday: Your bot is relying on a leftover session cookie. Tue–Fri it inherits the previous day’s cookie and gets waved through. Over the weekend that cookie expires, the flow breaks, and you see the error. Manual re-trigger works because it happens to start clean.
Fix do these in order:
Step 1: Navigate to the app root, not a redirect URL
Check your Open Browser / Navigate To URL. If it contains saml2, wsfed, /adfs/ls, or login.microsoftonline.com, that’s your bug. Replace it with the application’s base URL (https://yourapp.company.com) and let the app initiate SAML. This alone fixes most cases.
Step 2: Start every run with a clean session
Use a fresh or incognito browser profile per run, or clear cookies and cache at workflow start. Do not reuse a persisted profile across days.
Step 3’ Kill leftover browser processes at run start
Add a Kill Process for chrome / msedge before launching. A lingering instance from Friday holding a locked profile will reproduce this every Monday.
Step 4’ Replace blind retries with cleanup retries
On failure: kill browser → clear cookies → relaunch from root URL → retry once. A plain Retry Scope reloading the same broken URL will not recover.
Step 5: Verify the Entra app config (admin task)
In Entra ID → Enterprise applications → your app → Single sign-on, confirm the Sign on URL is populated. If it’s blank, IdP-initiated flows have no valid entry point and throw exactly this error.
Step 6: Check Conditional Access sign-in frequency
Ask your admin whether a sign-in frequency policy (e.g. 24h) applies to the bot account. A 48–72 hour weekend gap forces a full re-auth path your workflow may not handle.
If it recurs after this
Give your Entra admin the Correlation ID from the error page (749fb7e0-2fbe-46b2-bb63-b0ed277654e4): they can pull the exact entry in Entra ID → Monitoring → Sign-in logs.
Click Enable flagging on the error page and reproduce within 20 minutes for full admin diagnostics.
In your workflow, log the final landing URL on failure. If it’s a login.microsoftonline.com URL with no SAMLRequest= parameter, Step 1 is confirmed as the cause.
Steps 1–3 resolve this in the large majority of cases. Happy to look closer if you can share the redacted navigation URL and whether you’re using a persistent browser profile.
