Azure Devops External Users can't access project after being added

JamesSeton 

The error you are encountering (53003 – "You don't have access to this") often indicates an Azure AD Conditional Access policy or tenant-level restriction is blocking the external B2B users, even though they have accepted the invite and appear in Entra ID.

1. Check Conditional Access Policies

- Go to Entra ID > Security > Conditional Access

- Ensure guests aren’t blocked or required to use compliant devices.

2. Update External Collaboration Settings

- Entra ID > External Identities

- Make sure guest users can access Microsoft 365 and Azure AD services.

3. Enable Guest Access in Azure DevOps

- Org Settings > Policies > Allow external guest access.

4. Assign Correct License

- Org Settings > Users > Assign Basic/Stakeholder license.

5. Use Sign-in Logs

- Entra ID > Monitoring > Sign-in logs

- See which Conditional Access policy is blocking access.

Please try to fix bye following:

1. Review Conditional Access Policies

• Go to the Azure Active Directory Admin Center.
• Navigate to Security > Conditional Access and review the policies applied to external users.
• Check if there are policies restricting access based on:
• Device compliance (e.g., requiring domain-joined devices).
• Location (e.g., only allowing access from specific IP ranges or regions).
• Application restrictions (e.g., blocking access to Azure DevOps for certain users).

2. Sign-In Logs

• In the Azure AD Admin Center, go to Users > Sign-in logs.
• Look for the failed sign-in attempt for the external user and review the Conditional Access tab to identify which policy is blocking access.

3. Adjust Conditional Access Policies

• If a policy is blocking access, you can:
• Add an exception for the external users or their organization.
• Temporarily relax the policy to allow their access.
• Ensure that the policy allows guest users to access Azure DevOps.

4. Verify External Access Settings in Azure DevOps

• In Azure DevOps, go to Organization Settings > Policies.
• Confirm that External guest access is enabled.

5. Check B2B User Configuration

• Ensure that the external users are properly added as B2B guest users in your Entra tenant.
• Verify that they have accepted the invitation and their accounts are active.

6. Device State

• The error mentions that the device state is "Unregistered." If your Conditional Access policy requires registered or compliant devices, this could be the issue. You may need to adjust the policy to allow unregistered devices for external users.