Skip to content
Bram Brinkmeier

KQL lookup table for Entra sign-in error codes (copy and paste)

Paste this let statement above any query that has a ResultType column. It maps each AADSTS code that has a page on this site to its name, attack signal and page URL. It is generated from the same data as the AADSTS code map at build time, so it never drifts from the pages.

The lookup table

Section titled “The lookup table”
AadstsInfo lookup table
// AADSTS lookup from https://brambrinkmeier.com/aadsts-kql-lookup/ (CC BY 4.0, Bram Brinkmeier). Keep the URL comments when you copy.
let AadstsInfo = datatable(ResultType:string, Name:string, AttackSignal:string, Page:string)
[
    "16000", "InteractionRequired", "low", "https://brambrinkmeier.com/entra/aadsts/16000/", // AADSTS16000: https://brambrinkmeier.com/entra/aadsts/16000/
    "50001", "InvalidResource", "low", "https://brambrinkmeier.com/entra/aadsts/50001/", // AADSTS50001: https://brambrinkmeier.com/entra/aadsts/50001/
    "50011", "InvalidReplyTo", "low", "https://brambrinkmeier.com/entra/aadsts/50011/", // AADSTS50011: https://brambrinkmeier.com/entra/aadsts/50011/
    "50013", "InvalidAssertion", "low", "https://brambrinkmeier.com/entra/aadsts/50013/", // AADSTS50013: https://brambrinkmeier.com/entra/aadsts/50013/
    "50020", "UserUnauthorized", "low", "https://brambrinkmeier.com/entra/aadsts/50020/", // AADSTS50020: https://brambrinkmeier.com/entra/aadsts/50020/
    "50027", "InvalidJwtToken", "medium", "https://brambrinkmeier.com/entra/aadsts/50027/", // AADSTS50027: https://brambrinkmeier.com/entra/aadsts/50027/
    "50034", "UserAccountNotFound", "medium", "https://brambrinkmeier.com/entra/aadsts/50034/", // AADSTS50034: https://brambrinkmeier.com/entra/aadsts/50034/
    "50052", "InvalidPasswordExceedsMaxLength", "low", "https://brambrinkmeier.com/entra/aadsts/50052/", // AADSTS50052: https://brambrinkmeier.com/entra/aadsts/50052/
    "50053", "IdsLocked", "high", "https://brambrinkmeier.com/entra/aadsts/50053/", // AADSTS50053: https://brambrinkmeier.com/entra/aadsts/50053/
    "50054", "", "medium", "https://brambrinkmeier.com/entra/aadsts/50054/", // AADSTS50054: https://brambrinkmeier.com/entra/aadsts/50054/
    "50055", "InvalidPasswordExpiredPassword", "medium", "https://brambrinkmeier.com/entra/aadsts/50055/", // AADSTS50055: https://brambrinkmeier.com/entra/aadsts/50055/
    "50057", "UserDisabled", "medium", "https://brambrinkmeier.com/entra/aadsts/50057/", // AADSTS50057: https://brambrinkmeier.com/entra/aadsts/50057/
    "50058", "UserInformationNotProvided", "low", "https://brambrinkmeier.com/entra/aadsts/50058/", // AADSTS50058: https://brambrinkmeier.com/entra/aadsts/50058/
    "50059", "MissingTenantRealmAndNoUserInformationProvided", "low", "https://brambrinkmeier.com/entra/aadsts/50059/", // AADSTS50059: https://brambrinkmeier.com/entra/aadsts/50059/
    "50072", "UserStrongAuthEnrollmentRequiredInterrupt", "medium", "https://brambrinkmeier.com/entra/aadsts/50072/", // AADSTS50072: https://brambrinkmeier.com/entra/aadsts/50072/
    "50074", "UserStrongAuthClientAuthNRequiredInterrupt", "medium", "https://brambrinkmeier.com/entra/aadsts/50074/", // AADSTS50074: https://brambrinkmeier.com/entra/aadsts/50074/
    "50076", "UserStrongAuthClientAuthNRequired", "medium", "https://brambrinkmeier.com/entra/aadsts/50076/", // AADSTS50076: https://brambrinkmeier.com/entra/aadsts/50076/
    "50079", "UserStrongAuthEnrollmentRequired", "high", "https://brambrinkmeier.com/entra/aadsts/50079/", // AADSTS50079: https://brambrinkmeier.com/entra/aadsts/50079/
    "50089", "", "low", "https://brambrinkmeier.com/entra/aadsts/50089/", // AADSTS50089: https://brambrinkmeier.com/entra/aadsts/50089/
    "50097", "DeviceAuthenticationRequired", "medium", "https://brambrinkmeier.com/entra/aadsts/50097/", // AADSTS50097: https://brambrinkmeier.com/entra/aadsts/50097/
    "50105", "EntitlementGrantsNotFound", "low", "https://brambrinkmeier.com/entra/aadsts/50105/", // AADSTS50105: https://brambrinkmeier.com/entra/aadsts/50105/
    "50125", "PasswordResetRegistrationRequiredInterrupt", "medium", "https://brambrinkmeier.com/entra/aadsts/50125/", // AADSTS50125: https://brambrinkmeier.com/entra/aadsts/50125/
    "50126", "InvalidUserNameOrPassword", "high", "https://brambrinkmeier.com/entra/aadsts/50126/", // AADSTS50126: https://brambrinkmeier.com/entra/aadsts/50126/
    "50133", "SsoArtifactRevoked", "low", "https://brambrinkmeier.com/entra/aadsts/50133/", // AADSTS50133: https://brambrinkmeier.com/entra/aadsts/50133/
    "50140", "KmsiInterrupt", "low", "https://brambrinkmeier.com/entra/aadsts/50140/", // AADSTS50140: https://brambrinkmeier.com/entra/aadsts/50140/
    "50146", "MissingCustomSigningKey", "low", "https://brambrinkmeier.com/entra/aadsts/50146/", // AADSTS50146: https://brambrinkmeier.com/entra/aadsts/50146/
    "50155", "DeviceAuthenticationFailed", "low", "https://brambrinkmeier.com/entra/aadsts/50155/", // AADSTS50155: https://brambrinkmeier.com/entra/aadsts/50155/
    "50158", "External security challenge not satisfied", "low", "https://brambrinkmeier.com/entra/aadsts/50158/", // AADSTS50158: https://brambrinkmeier.com/entra/aadsts/50158/
    "50173", "Grant expired due to revocation", "medium", "https://brambrinkmeier.com/entra/aadsts/50173/", // AADSTS50173: https://brambrinkmeier.com/entra/aadsts/50173/
    "50194", "", "low", "https://brambrinkmeier.com/entra/aadsts/50194/", // AADSTS50194: https://brambrinkmeier.com/entra/aadsts/50194/
    "50196", "LoopDetected", "low", "https://brambrinkmeier.com/entra/aadsts/50196/", // AADSTS50196: https://brambrinkmeier.com/entra/aadsts/50196/
    "51004", "UserAccountNotInDirectory", "low", "https://brambrinkmeier.com/entra/aadsts/51004/", // AADSTS51004: https://brambrinkmeier.com/entra/aadsts/51004/
    "53000", "DeviceNotCompliant", "medium", "https://brambrinkmeier.com/entra/aadsts/53000/", // AADSTS53000: https://brambrinkmeier.com/entra/aadsts/53000/
    "53001", "DeviceNotDomainJoined", "medium", "https://brambrinkmeier.com/entra/aadsts/53001/", // AADSTS53001: https://brambrinkmeier.com/entra/aadsts/53001/
    "53003", "BlockedByConditionalAccess", "medium", "https://brambrinkmeier.com/entra/aadsts/53003/", // AADSTS53003: https://brambrinkmeier.com/entra/aadsts/53003/
    "54005", "", "low", "https://brambrinkmeier.com/entra/aadsts/54005/", // AADSTS54005: https://brambrinkmeier.com/entra/aadsts/54005/
    "65001", "DelegationDoesNotExist", "medium", "https://brambrinkmeier.com/entra/aadsts/65001/", // AADSTS65001: https://brambrinkmeier.com/entra/aadsts/65001/
    "65002", "", "low", "https://brambrinkmeier.com/entra/aadsts/65002/", // AADSTS65002: https://brambrinkmeier.com/entra/aadsts/65002/
    "65004", "UserDeclinedConsent", "low", "https://brambrinkmeier.com/entra/aadsts/65004/", // AADSTS65004: https://brambrinkmeier.com/entra/aadsts/65004/
    "65005", "MisconfiguredApplication", "low", "https://brambrinkmeier.com/entra/aadsts/65005/", // AADSTS65005: https://brambrinkmeier.com/entra/aadsts/65005/
    "70002", "InvalidClient", "medium", "https://brambrinkmeier.com/entra/aadsts/70002/", // AADSTS70002: https://brambrinkmeier.com/entra/aadsts/70002/
    "70008", "ExpiredOrRevokedGrant", "low", "https://brambrinkmeier.com/entra/aadsts/70008/", // AADSTS70008: https://brambrinkmeier.com/entra/aadsts/70008/
    "70016", "AuthorizationPending", "medium", "https://brambrinkmeier.com/entra/aadsts/70016/", // AADSTS70016: https://brambrinkmeier.com/entra/aadsts/70016/
    "70021", "", "low", "https://brambrinkmeier.com/entra/aadsts/70021/", // AADSTS70021: https://brambrinkmeier.com/entra/aadsts/70021/
    "70025", "", "low", "https://brambrinkmeier.com/entra/aadsts/70025/", // AADSTS70025: https://brambrinkmeier.com/entra/aadsts/70025/
    "70043", "BadTokenDueToSignInFrequency", "low", "https://brambrinkmeier.com/entra/aadsts/70043/", // AADSTS70043: https://brambrinkmeier.com/entra/aadsts/70043/
    "70044", "", "low", "https://brambrinkmeier.com/entra/aadsts/70044/", // AADSTS70044: https://brambrinkmeier.com/entra/aadsts/70044/
    "75011", "NoMatchedAuthnContextInOutputClaims", "low", "https://brambrinkmeier.com/entra/aadsts/75011/", // AADSTS75011: https://brambrinkmeier.com/entra/aadsts/75011/
    "76021", "ApplicationRequiresSignedRequests", "low", "https://brambrinkmeier.com/entra/aadsts/76021/", // AADSTS76021: https://brambrinkmeier.com/entra/aadsts/76021/
    "90002", "InvalidTenantName", "low", "https://brambrinkmeier.com/entra/aadsts/90002/", // AADSTS90002: https://brambrinkmeier.com/entra/aadsts/90002/
    "90009", "TokenForItselfMissingIdenticalAppIdentifier", "low", "https://brambrinkmeier.com/entra/aadsts/90009/", // AADSTS90009: https://brambrinkmeier.com/entra/aadsts/90009/
    "90014", "MissingRequiredField", "low", "https://brambrinkmeier.com/entra/aadsts/90014/", // AADSTS90014: https://brambrinkmeier.com/entra/aadsts/90014/
    "90015", "QueryStringTooLong", "low", "https://brambrinkmeier.com/entra/aadsts/90015/", // AADSTS90015: https://brambrinkmeier.com/entra/aadsts/90015/
    "90019", "MissingTenantRealm", "low", "https://brambrinkmeier.com/entra/aadsts/90019/", // AADSTS90019: https://brambrinkmeier.com/entra/aadsts/90019/
    "90023", "InvalidRequest", "low", "https://brambrinkmeier.com/entra/aadsts/90023/", // AADSTS90023: https://brambrinkmeier.com/entra/aadsts/90023/
    "90072", "PassThroughUserMfaError", "low", "https://brambrinkmeier.com/entra/aadsts/90072/", // AADSTS90072: https://brambrinkmeier.com/entra/aadsts/90072/
    "90094", "AdminConsentRequired", "medium", "https://brambrinkmeier.com/entra/aadsts/90094/", // AADSTS90094: https://brambrinkmeier.com/entra/aadsts/90094/
    "90095", "AdminConsentRequiredRequestAccess", "low", "https://brambrinkmeier.com/entra/aadsts/90095/", // AADSTS90095: https://brambrinkmeier.com/entra/aadsts/90095/
    "90133", "", "low", "https://brambrinkmeier.com/entra/aadsts/90133/", // AADSTS90133: https://brambrinkmeier.com/entra/aadsts/90133/
    "135011", "Device disabled", "low", "https://brambrinkmeier.com/entra/aadsts/135011/", // AADSTS135011: https://brambrinkmeier.com/entra/aadsts/135011/
    "165000", "", "low", "https://brambrinkmeier.com/entra/aadsts/165000/", // AADSTS165000: https://brambrinkmeier.com/entra/aadsts/165000/
    "500011", "InvalidResourceServicePrincipalNotFound", "low", "https://brambrinkmeier.com/entra/aadsts/500011/", // AADSTS500011: https://brambrinkmeier.com/entra/aadsts/500011/
    "500014", "InvalidResourceServicePrincipalDisabled", "low", "https://brambrinkmeier.com/entra/aadsts/500014/", // AADSTS500014: https://brambrinkmeier.com/entra/aadsts/500014/
    "500021", "", "low", "https://brambrinkmeier.com/entra/aadsts/500021/", // AADSTS500021: https://brambrinkmeier.com/entra/aadsts/500021/
    "500031", "", "low", "https://brambrinkmeier.com/entra/aadsts/500031/", // AADSTS500031: https://brambrinkmeier.com/entra/aadsts/500031/
    "500113", "", "low", "https://brambrinkmeier.com/entra/aadsts/500113/", // AADSTS500113: https://brambrinkmeier.com/entra/aadsts/500113/
    "500121", "MFA prompt not completed", "medium", "https://brambrinkmeier.com/entra/aadsts/500121/", // AADSTS500121: https://brambrinkmeier.com/entra/aadsts/500121/
    "500200", "", "low", "https://brambrinkmeier.com/entra/aadsts/500200/", // AADSTS500200: https://brambrinkmeier.com/entra/aadsts/500200/
    "500341", "", "low", "https://brambrinkmeier.com/entra/aadsts/500341/", // AADSTS500341: https://brambrinkmeier.com/entra/aadsts/500341/
    "500571", "", "low", "https://brambrinkmeier.com/entra/aadsts/500571/", // AADSTS500571: https://brambrinkmeier.com/entra/aadsts/500571/
    "501051", "", "low", "https://brambrinkmeier.com/entra/aadsts/501051/", // AADSTS501051: https://brambrinkmeier.com/entra/aadsts/501051/
    "530002", "", "medium", "https://brambrinkmeier.com/entra/aadsts/530002/", // AADSTS530002: https://brambrinkmeier.com/entra/aadsts/530002/
    "530003", "", "medium", "https://brambrinkmeier.com/entra/aadsts/530003/", // AADSTS530003: https://brambrinkmeier.com/entra/aadsts/530003/
    "530004", "", "low", "https://brambrinkmeier.com/entra/aadsts/530004/", // AADSTS530004: https://brambrinkmeier.com/entra/aadsts/530004/
    "530031", "", "medium", "https://brambrinkmeier.com/entra/aadsts/530031/", // AADSTS530031: https://brambrinkmeier.com/entra/aadsts/530031/
    "530032", "BlockedByConditionalAccessOnSecurityPolicy", "medium", "https://brambrinkmeier.com/entra/aadsts/530032/", // AADSTS530032: https://brambrinkmeier.com/entra/aadsts/530032/
    "650052", "", "low", "https://brambrinkmeier.com/entra/aadsts/650052/", // AADSTS650052: https://brambrinkmeier.com/entra/aadsts/650052/
    "650056", "", "low", "https://brambrinkmeier.com/entra/aadsts/650056/", // AADSTS650056: https://brambrinkmeier.com/entra/aadsts/650056/
    "700003", "", "low", "https://brambrinkmeier.com/entra/aadsts/700003/", // AADSTS700003: https://brambrinkmeier.com/entra/aadsts/700003/
    "700016", "UnauthorizedClient_DoesNotMatchRequest", "low", "https://brambrinkmeier.com/entra/aadsts/700016/", // AADSTS700016: https://brambrinkmeier.com/entra/aadsts/700016/
    "700024", "", "low", "https://brambrinkmeier.com/entra/aadsts/700024/", // AADSTS700024: https://brambrinkmeier.com/entra/aadsts/700024/
    "700051", "", "low", "https://brambrinkmeier.com/entra/aadsts/700051/", // AADSTS700051: https://brambrinkmeier.com/entra/aadsts/700051/
    "700054", "", "low", "https://brambrinkmeier.com/entra/aadsts/700054/", // AADSTS700054: https://brambrinkmeier.com/entra/aadsts/700054/
    "700081", "", "low", "https://brambrinkmeier.com/entra/aadsts/700081/", // AADSTS700081: https://brambrinkmeier.com/entra/aadsts/700081/
    "700082", "ExpiredOrRevokedGrantInactiveToken", "low", "https://brambrinkmeier.com/entra/aadsts/700082/", // AADSTS700082: https://brambrinkmeier.com/entra/aadsts/700082/
    "700211", "", "low", "https://brambrinkmeier.com/entra/aadsts/700211/", // AADSTS700211: https://brambrinkmeier.com/entra/aadsts/700211/
    "700212", "", "low", "https://brambrinkmeier.com/entra/aadsts/700212/", // AADSTS700212: https://brambrinkmeier.com/entra/aadsts/700212/
    "700213", "", "low", "https://brambrinkmeier.com/entra/aadsts/700213/", // AADSTS700213: https://brambrinkmeier.com/entra/aadsts/700213/
    "700226", "", "low", "https://brambrinkmeier.com/entra/aadsts/700226/", // AADSTS700226: https://brambrinkmeier.com/entra/aadsts/700226/
    "750054", "", "low", "https://brambrinkmeier.com/entra/aadsts/750054/", // AADSTS750054: https://brambrinkmeier.com/entra/aadsts/750054/
    "900023", "", "low", "https://brambrinkmeier.com/entra/aadsts/900023/", // AADSTS900023: https://brambrinkmeier.com/entra/aadsts/900023/
    "900144", "", "low", "https://brambrinkmeier.com/entra/aadsts/900144/", // AADSTS900144: https://brambrinkmeier.com/entra/aadsts/900144/
    "900439", "USGClientNotSupportedOnPublicEndpoint", "low", "https://brambrinkmeier.com/entra/aadsts/900439/", // AADSTS900439: https://brambrinkmeier.com/entra/aadsts/900439/
    "900561", "BadResourceRequestInvalidRequest", "low", "https://brambrinkmeier.com/entra/aadsts/900561/", // AADSTS900561: https://brambrinkmeier.com/entra/aadsts/900561/
    "901002", "", "low", "https://brambrinkmeier.com/entra/aadsts/901002/", // AADSTS901002: https://brambrinkmeier.com/entra/aadsts/901002/
    "1002016", "", "low", "https://brambrinkmeier.com/entra/aadsts/1002016/", // AADSTS1002016: https://brambrinkmeier.com/entra/aadsts/1002016/
    "1003031", "", "low", "https://brambrinkmeier.com/entra/aadsts/1003031/", // AADSTS1003031: https://brambrinkmeier.com/entra/aadsts/1003031/
    "5000211", "", "low", "https://brambrinkmeier.com/entra/aadsts/5000211/", // AADSTS5000211: https://brambrinkmeier.com/entra/aadsts/5000211/
    "5000224", "NotAllowedTenantBlockedTenantFraud", "medium", "https://brambrinkmeier.com/entra/aadsts/5000224/", // AADSTS5000224: https://brambrinkmeier.com/entra/aadsts/5000224/
    "5000225", "", "low", "https://brambrinkmeier.com/entra/aadsts/5000225/", // AADSTS5000225: https://brambrinkmeier.com/entra/aadsts/5000225/
    "5000611", "", "low", "https://brambrinkmeier.com/entra/aadsts/5000611/", // AADSTS5000611: https://brambrinkmeier.com/entra/aadsts/5000611/
    "5002730", "", "low", "https://brambrinkmeier.com/entra/aadsts/5002730/", // AADSTS5002730: https://brambrinkmeier.com/entra/aadsts/5002730/
    "7000014", "", "low", "https://brambrinkmeier.com/entra/aadsts/7000014/", // AADSTS7000014: https://brambrinkmeier.com/entra/aadsts/7000014/
    "7000110", "", "low", "https://brambrinkmeier.com/entra/aadsts/7000110/", // AADSTS7000110: https://brambrinkmeier.com/entra/aadsts/7000110/
    "7000112", "UnauthorizedClientApplicationDisabled", "low", "https://brambrinkmeier.com/entra/aadsts/7000112/", // AADSTS7000112: https://brambrinkmeier.com/entra/aadsts/7000112/
    "7000215", "Invalid client secret", "medium", "https://brambrinkmeier.com/entra/aadsts/7000215/", // AADSTS7000215: https://brambrinkmeier.com/entra/aadsts/7000215/
    "7000216", "", "low", "https://brambrinkmeier.com/entra/aadsts/7000216/", // AADSTS7000216: https://brambrinkmeier.com/entra/aadsts/7000216/
    "7000218", "", "low", "https://brambrinkmeier.com/entra/aadsts/7000218/", // AADSTS7000218: https://brambrinkmeier.com/entra/aadsts/7000218/
    "7000222", "InvalidClientSecretExpiredKeysProvided", "low", "https://brambrinkmeier.com/entra/aadsts/7000222/", // AADSTS7000222: https://brambrinkmeier.com/entra/aadsts/7000222/
    "7002121", "", "low", "https://brambrinkmeier.com/entra/aadsts/7002121/", // AADSTS7002121: https://brambrinkmeier.com/entra/aadsts/7002121/
    "7002138", "", "low", "https://brambrinkmeier.com/entra/aadsts/7002138/", // AADSTS7002138: https://brambrinkmeier.com/entra/aadsts/7002138/
    "9002313", "InvalidRequest", "low", "https://brambrinkmeier.com/entra/aadsts/9002313/", // AADSTS9002313: https://brambrinkmeier.com/entra/aadsts/9002313/
    "9002326", "", "low", "https://brambrinkmeier.com/entra/aadsts/9002326/", // AADSTS9002326: https://brambrinkmeier.com/entra/aadsts/9002326/
    "9002327", "", "low", "https://brambrinkmeier.com/entra/aadsts/9002327/", // AADSTS9002327: https://brambrinkmeier.com/entra/aadsts/9002327/
    "9002331", "", "low", "https://brambrinkmeier.com/entra/aadsts/9002331/", // AADSTS9002331: https://brambrinkmeier.com/entra/aadsts/9002331/
    "9002341", "", "low", "https://brambrinkmeier.com/entra/aadsts/9002341/", // AADSTS9002341: https://brambrinkmeier.com/entra/aadsts/9002341/
    "9002346", "", "low", "https://brambrinkmeier.com/entra/aadsts/9002346/", // AADSTS9002346: https://brambrinkmeier.com/entra/aadsts/9002346/
    "9010010", "", "low", "https://brambrinkmeier.com/entra/aadsts/9010010/" // AADSTS9010010: https://brambrinkmeier.com/entra/aadsts/9010010/
];

Every row ends with a comment holding the page URL, so attribution and the way back to the explanation travel with the code when you paste it into a workbook, analytics rule or runbook. Please keep those comments.

Example: failed sign-ins joined to the lookup

Section titled “Example: failed sign-ins joined to the lookup”

Put the example below after the let statement. Codes without a page here come back with empty Name, AttackSignal and Page.

Failures by code with attack signal and page, last 7 days
SigninLogs
| where TimeGenerated > ago(7d)
| where ResultType != "0"
| join kind=leftouter AadstsInfo on ResultType
| summarize Events = count(), Users = dcount(UserPrincipalName) by ResultType, Name, AttackSignal, Page
| sort by Events desc

Page is a plain URL column. In a Sentinel workbook, set the column renderer to link to make it clickable. For more queries, see KQL for sign-in hunting. Two code pages to start with are AADSTS50034 (unknown username) and AADSTS50053 (account locked).

What is and is not checked

Section titled “What is and is not checked”
  • The queries are not tested in a lab. Treat them as a starting point and run them on a small time range first.
  • Column names come from Microsoft’s SigninLogs schema. ResultType is a string column there, which is why the lookup declares it as string and the codes are quoted. Check the reference page again if your workspace behaves differently.
  • Attack signal and names are this site’s own classification. In the dataset, verification says how far each page has been checked: documentation (based on Microsoft documentation only), lab-reproduced (an automated lab run returned the code; sign-in log row and KQL not yet checked) or lab-verified. See how pages are written and checked.
  • Microsoft’s error descriptions are deliberately not part of the table. Use Microsoft’s error code reference for the official wording.

Download the dataset

Section titled “Download the dataset”

The same data is available as JSON at /aadsts.json under CC BY 4.0. It holds code, name, category, kind, attack signal, MITRE techniques, tables, related codes, status, verification state, lab reproduction date, update date and page URL.

To cite it: Bram Brinkmeier, “AADSTS sign-in error codes: attack signal, MITRE technique and category”, Zenodo, doi:10.5281/zenodo.23641385. Versioned JSON and CSV releases, a CITATION.cff and an externaldata KQL example are in the aadsts-dataset repository.