Entra ID sign-in errors, read for security
Every AADSTS error in your sign-in logs is either a typo, a misconfiguration or someone attacking your tenant. Microsoft documents what each code means. This reference adds what it means for security: whether it is an attack signal, how Conditional Access interacts with it, and the KQL to find it in SigninLogs.
Guides
Section titled “Guides”- How to detect MFA fatigue (push bombing) in Microsoft Entra ID: Detect MFA fatigue in Entra ID: read 500121, 50074, 50076 and 50079, parse AuthenticationDetails with KQL, spot an approved prompt, and respond.
- How to detect password spraying in Microsoft Entra ID (with KQL): Find password spraying in Entra ID sign-in logs: which AADSTS codes to read, how smart lockout behaves, four KQL queries, and how to respond.
- How to investigate consent phishing (illicit consent grants) in Entra ID: Find the consent event, read the sign-in codes around it, and remove an attacker's app from Entra ID. Why a password reset and MFA don't fix it.
- After a compromise: revoke Entra ID sessions and prove it worked: Revoke a compromised user's Entra ID sessions, disable their devices, and use 50173, 50133 and 135011 sign-in rows to prove the attacker was cut off.
Error codes by attack signal
Section titled “Error codes by attack signal”| Code | Microsoft name | Attack signal | ATT&CK technique |
|---|---|---|---|
50053 | IdsLocked | High | T1110.003 Password Spraying T1110.001 Password Guessing |
50079 | UserStrongAuthEnrollmentRequired | High | T1078.004 Valid Accounts: Cloud Accounts T1098.005 Account Manipulation: Device Registration |
50126 | InvalidUserNameOrPassword | High | T1110.003 Password Spraying T1110.001 Password Guessing |
50034 | UserAccountNotFound | Medium | T1087.004 Account Discovery: Cloud Account T1110.003 Password Spraying |
50055 | InvalidPasswordExpiredPassword | Medium | T1110.003 Password Spraying T1078.004 Valid Accounts: Cloud Accounts |
50057 | UserDisabled | Medium | T1110.003 Password Spraying T1078.004 Valid Accounts: Cloud Accounts |
50074 | UserStrongAuthClientAuthNRequiredInterrupt | Medium | T1621 MFA Request Generation T1078.004 Valid Accounts: Cloud Accounts |
50076 | UserStrongAuthClientAuthNRequired | Medium | T1078.004 Valid Accounts: Cloud Accounts T1110.003 Password Spraying |
50097 | DeviceAuthenticationRequired | Medium | T1078.004 Valid Accounts: Cloud Accounts |
50125 | PasswordResetRegistrationRequiredInterrupt | Medium | T1078.004 Valid Accounts: Cloud Accounts |
50173 | Grant expired due to revocation | Medium | T1550.001 Use Alternate Authentication Material: Application Access Token |
53000 | DeviceNotCompliant | Medium | T1078.004 Valid Accounts: Cloud Accounts T1550.001 Use Alternate Authentication Material: Application Access Token |
53001 | DeviceNotDomainJoined | Medium | T1078.004 Valid Accounts: Cloud Accounts |
53003 | BlockedByConditionalAccess | Medium | T1078.004 Valid Accounts: Cloud Accounts |
65001 | DelegationDoesNotExist | Medium | T1528 Steal Application Access Token T1566.002 Phishing: Spearphishing Link |
90094 | AdminConsentRequired | Medium | T1566.002 Phishing: Spearphishing Link T1528 Steal Application Access Token |
500121 | MFA prompt not completed | Medium | T1621 MFA Request Generation |
530032 | BlockedByConditionalAccessOnSecurityPolicy | Medium | T1078.004 Valid Accounts: Cloud Accounts T1110.003 Password Spraying |
7000215 | Invalid client secret | Medium | T1078.004 Valid Accounts: Cloud Accounts |
50011 | InvalidReplyTo | Low | T1528 Steal Application Access Token |
50020 | UserUnauthorized | Low | - |
50105 | EntitlementGrantsNotFound | Low | T1078.004 Valid Accounts: Cloud Accounts |
50133 | SsoArtifactRevoked | Low | - |
50140 | KmsiInterrupt | Low | T1078.004 Valid Accounts: Cloud Accounts |
50158 | External security challenge not satisfied | Low | T1078.004 Valid Accounts: Cloud Accounts |
70043 | BadTokenDueToSignInFrequency | Low | - |
90095 | AdminConsentRequiredRequestAccess | Low | T1566.002 Phishing: Spearphishing Link T1528 Steal Application Access Token |
135011 | Device disabled | Low | - |
700016 | UnauthorizedClient_DoesNotMatchRequest | Low | - |
700082 | ExpiredOrRevokedGrantInactiveToken | Low | - |
Recently updated
Section titled “Recently updated”- : AADSTS135011: Device used during authentication is disabled
- : AADSTS50011: Reply URL does not match
- : AADSTS500121: User didn't complete the MFA prompt
- : AADSTS50020: Account from identity provider not in tenant
- : AADSTS50034: User account not found in the directory
- : AADSTS50053: Account locked or sign-in blocked
- : AADSTS50055: Password expired
- : AADSTS50057: User account is disabled
About this reference
Section titled “About this reference”Written and maintained by Bram Brinkmeier, a cloud and identity security engineer. Every page quotes and links Microsoft’s documentation. Pages are then reproduced in a lab tenant and marked as lab-verified with a date. How pages are verified.