Skip to content
Bram Brinkmeier

Entra ID sign-in errors, read for security

Every AADSTS error in your sign-in logs is either a typo, a misconfiguration or someone attacking your tenant. Microsoft documents what each code means. This reference adds what it means for security: whether it is an attack signal, how Conditional Access interacts with it, and the KQL to find it in SigninLogs.

By Bram Brinkmeier, identity security engineer. Every code page quotes its sources; many are reproduced in a lab tenant, and the pages say which.

Guides

Section titled “Guides”

Error codes by attack signal

Section titled “Error codes by attack signal”

Codes with a high or medium attack signal. Every code, by number.

CodeWhat it meansAttack signalATT&CK technique
50053Account locked or sign-in blockedHighT1110.003 Brute Force: Password Spraying
T1110.001 Brute Force: Password Guessing
50079User must register for MFAHighT1078.004 Valid Accounts: Cloud Accounts
T1098.005 Account Manipulation: Device Registration
50126Invalid username or passwordHighT1110.003 Brute Force: Password Spraying
T1110.001 Brute Force: Password Guessing
50027JWT token is invalid or malformedMedium-
50034user account not found in the tenantMediumT1087.004 Account Discovery: Cloud Account
T1110.003 Brute Force: Password Spraying
50054Old password used for sign-in (not in Microsoft's list)Medium-
50055Password expiredMediumT1110.003 Brute Force: Password Spraying
T1078.004 Valid Accounts: Cloud Accounts
50057the user account is disabledMediumT1110.003 Brute Force: Password Spraying
T1078.004 Valid Accounts: Cloud Accounts
50072User needs to enroll for second factor authenticationMediumT1078.004 Valid Accounts: Cloud Accounts
T1098.005 Account Manipulation: Device Registration
50074strong authentication is required (MFA)MediumT1621 Multi-Factor Authentication Request Generation
T1078.004 Valid Accounts: Cloud Accounts
50076MFA required to access the resourceMediumT1078.004 Valid Accounts: Cloud Accounts
T1110.003 Brute Force: Password Spraying
50097device authentication is requiredMediumT1078.004 Valid Accounts: Cloud Accounts
50125Password reset registration interruptMediumT1078.004 Valid Accounts: Cloud Accounts
50173Grant expired because it was revokedMediumT1550.001 Use Alternate Authentication Material: Application Access Token
53000Device not compliantMediumT1078.004 Valid Accounts: Cloud Accounts
T1557 Adversary-in-the-Middle
T1539 Steal Web Session Cookie
53001Device not domain joinedMediumT1078.004 Valid Accounts: Cloud Accounts
53003Access blocked by Conditional AccessMediumT1078.004 Valid Accounts: Cloud Accounts
65001User or admin has not consented to the appMediumT1528 Steal Application Access Token
T1566.002 Phishing: Spearphishing Link
70002error validating client credentialsMediumT1078.004 Valid Accounts: Cloud Accounts
70016Device code authorization is pendingMedium-
90094"Need admin approval" screenMediumT1566.002 Phishing: Spearphishing Link
T1528 Steal Application Access Token
500121User didn't complete the MFA promptMediumT1621 Multi-Factor Authentication Request Generation
530002Your device is required to be compliant (not in Microsoft's list)Medium-
530003Your device is required to be managed (not in Microsoft's list)Medium-
530031Access policy does not allow token issuance (not in Microsoft's list)Medium-
530032Blocked by a tenant security policyMediumT1078.004 Valid Accounts: Cloud Accounts
T1110.003 Brute Force: Password Spraying
5000224tenant blocked for suspected fraudMedium-
7000215Invalid client secret is providedMediumT1078.004 Valid Accounts: Cloud Accounts

Microsoft Graph error codes

Section titled “Microsoft Graph error codes”

Graph returns named error codes rather than AADSTS numbers, and Microsoft’s current error reference lists HTTP statuses and shows one example error body, but has no list of the codes themselves. Every Graph error code, with the exact message, the request that produces it, and what was measured in a lab tenant.

Recently updated

Section titled “Recently updated”

About this reference

Section titled “About this reference”

Written by Bram Brinkmeier, a cloud and identity security engineer. Every page quotes and links Microsoft’s documentation. Each page shows how far it has been checked: based on Microsoft’s documentation, reproduced in a lab tenant (with or without its sign-in log row and KQL checked), or lab-verified. Pages for codes Microsoft’s reference doesn’t list say so at the top. How pages are written and checked.