If Microsoft 365 shows “Your organization has deleted this device”, the sign-in failure usually is not caused by an incorrect password. The exact Microsoft Entra error is AADSTS700003: the device object is missing from the user’s home tenant. The right repair depends on whether the device is registered, joined, or hybrid joined.
What causes AADSTS700003?
The device object was deleted from the user’s home Microsoft Entra tenant. Microsoft records this as a Delete device activity in the tenant’s Microsoft Entra audit log.
This is a tenant-side change, so clearing a browser cache or repeatedly entering the password will not recreate the missing object. The home-tenant administrator should first check when and why the device was deleted. Then repair its local registration using the procedure for its device state.
| Device state | Typical repair |
|---|---|
| Microsoft Entra registered | Disconnect the work or school account, then register the device again. |
| Microsoft Entra joined | Run dsregcmd /forcerecovery and authenticate when prompted. |
| Microsoft Entra hybrid joined | Run dsregcmd /leave, restart, and sign in with domain credentials. |
Check the device state before choosing a repair. Being signed in to Microsoft 365 apps does not establish which state the device uses.
Free tools Windows power users keep installed
One-click scans. No signup required.
#1 Best Overall
- KEYBOARD: The keyboard works for Windows with hot keys that enable easy access to Media, My Computer, Mute, Volume up/down, and Calculator
- EASY SETUP: Experience simple installation with the USB wired connection
- VERSATILE COMPATIBILITY: This keyboard is designed to work with multiple Windows versions, including Vista, 7, 8, 10 offering broad compatibility across devices.
- SLEEK DESIGN: The elegant black color of the wired keyboard complements your tech and decor, adding a stylish and cohesive look to any setup without sacrificing function.
- FULL-SIZED CONVENIENCE: The standard QWERTY layout of this keyboard set offers a familiar typing experience, ideal for both professional tasks and personal use.
Step 1: Check the device state in Windows
Open Command Prompt or PowerShell in the logged-in user’s context and run:
dsregcmd /status
Microsoft says to run this diagnostic as a domain user account. Avoid an elevated console where possible: WamDefaultSet can show an error when the command runs from an elevated prompt, and the command must run in a user context to retrieve that user’s valid status.
Use the values under Device State and User State to identify the registration:
| Output | Meaning |
|---|---|
| AzureAdJoined : YES; DomainJoined : NO | Microsoft Entra joined |
| AzureAdJoined : YES; DomainJoined : YES | Microsoft Entra hybrid joined |
| AzureAdJoined : NO; DomainJoined : YES | On-premises domain joined, but not Microsoft Entra joined |
| WorkplaceJoined : YES under User State | Microsoft Entra registered for the user |
Also check DeviceAuthStatus, if available. SUCCESS means the device is present and enabled in Microsoft Entra ID. FAILED means the device is disabled or deleted. Microsoft added this field in the Windows 10 May 2021 update, version 21H1.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Fix a Microsoft Entra registered Windows 10 or Windows 11 device
This is a common state for a personal Windows computer where a work or school account was added without joining the PC to the organization’s Windows sign-in infrastructure.
Disconnect the deleted registration
- Open Settings.
- Go to Accounts > Access work or school.
- Select the affected work or school account.
- Select Disconnect, then confirm.
This removes the local connection to the deleted device object. It does not restore the object in the tenant.
Register the device again
- Return to Settings > Accounts > Access work or school.
- Select Connect.
- On Set up a work or school account, select Join this device to Azure Active Directory. Microsoft’s current support page still uses this button label, although the product name is now Microsoft Entra ID.
- Enter the work email address and select Next.
- Enter the password and select Sign in.
- Approve the device if prompted, including any multifactor authentication request.
- Review Make sure this is your organization and select Join.
- On You’re all set, select Done.
Verify the result at Settings > Accounts > Access work or school. The connection should show text similar to Connected to <your_organization> Entra ID.
Rank #2
- Reliable Plug and Play: The USB receiver provides a reliable wireless connection up to 33 ft (1), so you can forget about drop-outs and delays and you can take it wherever you use your computer
- Type in Comfort: The design of this keyboard creates a comfortable typing experience thanks to the low-profile, quiet keys and standard layout with full-size F-keys, number pad, and arrow keys
- Durable and Resilient: This full-size wireless keyboard features a spill-resistant design (2), durable keys and sturdy tilt legs with adjustable height
- Long Battery Life: MK270 combo features a 36-month keyboard and 12-month mouse battery life (3), along with on/off switches allowing you to go months without the hassle of changing batteries
- Easy to Use: This wireless keyboard and mouse combo features 8 multimedia hotkeys for instant access to the Internet, email, play/pause, and volume so you can easily check out your favorite sites
Choose the right registration option in Microsoft 365 apps
Microsoft began rolling out a modernized Entra account-registration experience during November and December 2025. During the rollout, some users may still see the earlier screens.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsWhen the registration page offers Yes and No, this app only, the options have different results:
- Yes adds the account to Windows, registers the device in the organization’s directory, and enables seamless sign-in for desktop and web applications using that work or school account.
- No, this app only signs the account into the current application only. It does not add the account to Windows Settings or register the device in the organization’s directory.
The page appears only once per account. To change the selection later, sign out and sign in again. If you selected Yes, remove the account through Settings > Accounts > Access work or school > [account] > Disconnect, then register it again as needed.
Fix a Microsoft Entra joined Windows device
Use this method when dsregcmd /status reports AzureAdJoined : YES and DomainJoined : NO.
- Open PowerShell as administrator.
- Run dsregcmd /forcerecovery.
- When Windows prompts you, select Sign in.
- Authenticate with the Microsoft Entra ID account.
The command starts recovery of the device relationship. If sign-in still fails or the device remains in a failed state, ask a tenant administrator to confirm that the old device was deleted and that the account is allowed to register or join devices. Do not delete additional device records unless you know which object belongs to the affected computer.
Recommended Free Tools
Fix a Microsoft Entra hybrid-joined Windows device
Use this procedure for a corporate computer joined to both on-premises Active Directory and Microsoft Entra ID. A hybrid-joined device must report DomainJoined : YES; a device with DomainJoined : NO cannot complete Microsoft Entra hybrid join.
- Open PowerShell as administrator.
- Run dsregcmd /leave.
- Restart the computer.
- Sign in with the user’s domain credential.
After the organization’s hybrid-join process runs, a successfully hybrid-joined computer should report both AzureAdJoined : YES and DomainJoined : YES.
Rank #3
- All-day Comfort: The design of this standard keyboard creates a comfortable typing experience thanks to the deep-profile keys and full-size standard layout with F-keys and number pad
- Easy to Set-up and Use: Set-up couldn't be easier, you simply plug in this corded keyboard via USB on your desktop or laptop and start using right away without any software installation
- Compatibility: This full-size keyboard is compatible with Windows 7, 8, 10 or later, plus it's a reliable and durable partner for your desk at home, or at work
- Spill-proof: This durable keyboard features a spill-resistant design (1), anti-fade keys and sturdy tilt legs with adjustable height, meaning this keyboard is built to last
- Plastic parts in K120 include 51% certified post-consumer recycled plastic*
For a domain-joined computer that is also hybrid joined, WorkplaceJoined : NO is expected. If it reports WorkplaceJoined : YES, a work or school account was added before hybrid join completed. On Windows 10 version 1607 or later, that account is ignored for hybrid-join operation.
Do not use Access work or school > Disconnect as a generic fix on a hybrid-joined corporate PC. The repair path is different, and removing the wrong connection can interfere with organizational management or remove the wrong registration.
Hybrid-join problems that look like a deleted-device error
If the device does not reappear after dsregcmd /leave, check the basics:
- The computer must remain joined to the on-premises domain.
- The device needs access to the required Microsoft cloud endpoints and the organization’s authentication infrastructure.
- The system context must be able to discover and silently authenticate to the outbound proxy.
A hybrid-join diagnostic can report E_INVALIDDATA (0x8007000d / -2147024883) when a proxy returns an HTTP 200 response containing an HTML authorization page instead of the expected JSON. A successful HTTP status does not prove the endpoint response is usable.
On a mobile hotspot or external Wi-Fi network, Access work or school can show two accounts for a hybrid-joined device—one for Microsoft Entra ID and one for on-premises Active Directory. Microsoft identifies this as a user-interface issue that does not affect functionality.
Collect a network trace for Microsoft support
If hybrid join continues to fail and your organization needs Microsoft Support to investigate, collect the documented trace:
netsh trace start scenario=internetClient_dbg capture=yes persistent=yes
Rank #4
- Fluid Typing Experience: Laptop-like profile with spherically-dished keys shaped for your fingertips delivers a fast, fluid, precise and quieter typing experience
- Automate Repetitive Tasks: Easily create and share time-saving Smart Actions shortcuts to perform multiple actions with a single keystroke with the Logi Options+ app (1)
- Smarter Illumination: Backlit keyboard keys light up as your hands approach and adapt to the environment; Now with more lighting customizations on Logi Options+ (1)
- More Comfort, Deeper Focus: Work for longer with a solid build, low-profile design and an optimum keyboard angle that is better for your wrist posture
- Multi-Device, Multi OS Bluetooth Keyboard: Pair with up to 3 devices on nearly any operating system (Windows, macOS, Linux, Googlebook OS) via Bluetooth Low Energy or included Logi Bolt USB receiver (2)
Lock and unlock the device, then wait at least one minute so the hybrid-join device task can attempt to acquire a primary refresh token. Stop the trace with:
netsh trace stop
Provide the resulting nettrace.cab file to Microsoft Support or your organization’s administrator.
Fix the error on iPhone or Android
For a Microsoft Entra registered mobile device:
- Open Microsoft Authenticator.
- Open Settings > Device Registration.
- Select Unregister device.
- Register the device again when prompted by your organization’s sign-in or management process.
If the device is managed by Intune, the administrator may need to verify or remove the old device record and confirm that the user is allowed to enroll again.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Fix the error on macOS
On a Mac, use the Microsoft Intune Company Portal application to unenroll the device from management and remove its registration. Then register the Mac again through Company Portal and complete any required compliance or management steps.
Do not remove management from a company-owned Mac without checking with the organization first. Unenrollment can affect access policies, configuration profiles, certificates, and application deployment.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.When the error does not clear
Escalate to the Microsoft Entra administrator if any of these conditions apply:
- The device object was deleted unexpectedly or as part of an automated cleanup job.
- The user cannot register or join devices because of tenant restrictions or enrollment limits.
- DeviceAuthStatus remains FAILED after the documented repair.
- The computer is hybrid joined but cannot contact the domain, proxy, or Microsoft authentication endpoints.
- The device is company-owned and you are unsure whether disconnecting or unenrolling it will affect management.
The administrator should search the Microsoft Entra audit log for the Delete device activity, identify the deleted object and deletion time, and confirm the correct recovery path. Re-registering locally creates a new device relationship; it does not explain or reverse the administrative deletion.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteBest Value
- All-day Comfort: This USB keyboard creates a comfortable and familiar typing experience thanks to the deep-profile keys and standard full-size layout with all F-keys, number pad and arrow keys
- Built to Last: The spill-proof (2) design and durable print characters keep you on track for years to come despite any on-the-job mishaps; it’s a reliable partner for your desk at home, or at work
- Long-lasting Battery Life: A 24-month battery life (4) means you can go for 2 years without the hassle of changing batteries of your wireless full-size keyboard
- Simply plug the USB receiver into a USB port on your desktop, laptop or netbook computer and start using the keyboard right away without any software installation
- Simply Wireless: Forget about drop-outs and delays thanks to a strong, reliable wireless connection with up to 33 ft range (5); K270 is compatible with Windows 7, 8, 10 or later
Common mistakes
| Mistake | Why it causes trouble |
|---|---|
| Searching for error 70003 only | The precise Microsoft Entra code is AADSTS700003. |
| Using Disconnect on every Windows device | Registered, joined, and hybrid-joined devices require different procedures. |
| Running dsregcmd /status only from an elevated console | User-specific fields such as WAM status may be misleading or unavailable. |
| Choosing No, this app only when full device registration is required | The account is used by the current app but is not added to Windows or registered in the tenant. |
| Assuming a successful web sign-in proves the device is healthy | The tenant may still have a missing, disabled, or deleted device object. |
FAQ
Is Microsoft 365 error 70003 the same as AADSTS700003?
Yes. The precise Microsoft Entra error code is AADSTS700003. Its messages include “Device object was not found in the tenant” and “Your organization has deleted this device.”
Will changing my Microsoft 365 password fix this error?
Usually not. AADSTS700003 indicates that the device object was deleted from the user’s home Microsoft Entra tenant. The device must be recovered or registered again using the procedure for its registration state.
How do I know whether my Windows PC is registered, joined, or hybrid joined?
Run dsregcmd /status in the logged-in user context, as a domain user account. AzureAdJoined : YES with DomainJoined : NO indicates Microsoft Entra joined; both values set to YES indicate hybrid joined; WorkplaceJoined : YES under User State indicates Microsoft Entra registered.
Can I just remove the account under Access work or school?
Only for the Microsoft Entra registered procedure. Do not treat Disconnect as a universal fix, especially on a hybrid-joined corporate computer. Hybrid-joined devices should use dsregcmd /leave, a restart, and domain-credential sign-in.
What does DeviceAuthStatus FAILED mean?
It means the device is disabled or deleted in Microsoft Entra ID. The tenant administrator should check the audit log and confirm the correct recovery or re-registration path.
What should I do if the device was deleted by my organization?
Contact the Microsoft Entra or Microsoft 365 administrator. They should identify the Delete device activity, determine why it occurred, and help register or recover the device without disrupting organizational management.
The Bottom Line
AADSTS700003 means Microsoft Entra cannot find the device object for the account. Run dsregcmd /status in the user context, as a domain user account, and identify the device state. Disconnect and re-register a Microsoft Entra registered Windows device, run dsregcmd /forcerecovery for a Microsoft Entra joined device, or run dsregcmd /leave, restart, and sign in with domain credentials for a hybrid-joined device. For iPhone, Android, and macOS, unregister or unenroll through Authenticator or Company Portal before registering again.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
