{
  "name": "AADSTS sign-in error codes: attack signal, MITRE technique and category",
  "license": "CC BY 4.0",
  "licenseUrl": "https://creativecommons.org/licenses/by/4.0/",
  "attribution": "Bram Brinkmeier, https://brambrinkmeier.com/ (AADSTS code map: https://brambrinkmeier.com/entra/aadsts/)",
  "generated": "2026-11-08",
  "count": 118,
  "note": "Only this site's own classification fields are included. Microsoft's error descriptions are not included; see Microsoft's error code reference: https://learn.microsoft.com/en-us/entra/identity-platform/reference-error-codes",
  "codes": [
    {
      "code": "16000",
      "name": "InteractionRequired",
      "category": "b2b-tenant",
      "kind": "failure",
      "attackSignal": "low",
      "mitre": [],
      "tables": [
        "SigninLogs",
        "AADNonInteractiveUserSignInLogs"
      ],
      "related": [
        "50020",
        "50034",
        "90072",
        "90002"
      ],
      "status": "draft",
      "verification": "documentation",
      "inMicrosoftReference": true,
      "updated": "2026-10-30",
      "url": "https://brambrinkmeier.com/entra/aadsts/16000/"
    },
    {
      "code": "50001",
      "name": "InvalidResource",
      "category": "app-config",
      "kind": "failure",
      "attackSignal": "low",
      "mitre": [],
      "tables": [],
      "related": [
        "500011",
        "500014",
        "700016",
        "7000112",
        "65005"
      ],
      "status": "draft",
      "verification": "documentation",
      "inMicrosoftReference": true,
      "updated": "2026-11-01",
      "url": "https://brambrinkmeier.com/entra/aadsts/50001/"
    },
    {
      "code": "50011",
      "name": "InvalidReplyTo",
      "category": "app-config",
      "kind": "failure",
      "attackSignal": "low",
      "mitre": [
        "T1528"
      ],
      "tables": [
        "SigninLogs"
      ],
      "related": [
        "700016",
        "50105",
        "65001",
        "50020"
      ],
      "status": "draft",
      "verification": "documentation",
      "inMicrosoftReference": true,
      "updated": "2026-10-11",
      "url": "https://brambrinkmeier.com/entra/aadsts/50011/"
    },
    {
      "code": "50013",
      "name": "InvalidAssertion",
      "category": "token",
      "kind": "failure",
      "attackSignal": "low",
      "mitre": [],
      "tables": [],
      "related": [
        "700024",
        "90023",
        "500011",
        "65001"
      ],
      "status": "draft",
      "verification": "documentation",
      "inMicrosoftReference": true,
      "updated": "2026-11-01",
      "url": "https://brambrinkmeier.com/entra/aadsts/50013/"
    },
    {
      "code": "50020",
      "name": "UserUnauthorized",
      "category": "b2b-tenant",
      "kind": "failure",
      "attackSignal": "low",
      "mitre": [],
      "tables": [
        "SigninLogs"
      ],
      "related": [
        "90072",
        "50034",
        "700016",
        "50105",
        "50011"
      ],
      "status": "draft",
      "verification": "documentation",
      "inMicrosoftReference": true,
      "updated": "2026-10-25",
      "url": "https://brambrinkmeier.com/entra/aadsts/50020/"
    },
    {
      "code": "50027",
      "name": "InvalidJwtToken",
      "category": "credentials",
      "kind": "failure",
      "attackSignal": "medium",
      "mitre": [],
      "tables": [
        "SigninLogs",
        "AADServicePrincipalSignInLogs"
      ],
      "related": [
        "90023",
        "700024",
        "7000216",
        "7000218"
      ],
      "status": "draft",
      "verification": "lab-reproduced",
      "labReproduced": "2026-10-30",
      "inMicrosoftReference": true,
      "updated": "2026-10-30",
      "url": "https://brambrinkmeier.com/entra/aadsts/50027/"
    },
    {
      "code": "50034",
      "name": "UserAccountNotFound",
      "category": "credentials",
      "kind": "failure",
      "attackSignal": "medium",
      "mitre": [
        "T1087.004",
        "T1110.003"
      ],
      "tables": [
        "SigninLogs"
      ],
      "related": [
        "50126",
        "50053",
        "50057",
        "50020",
        "16000"
      ],
      "status": "draft",
      "verification": "lab-reproduced",
      "labReproduced": "2026-10-25",
      "inMicrosoftReference": true,
      "updated": "2026-11-01",
      "url": "https://brambrinkmeier.com/entra/aadsts/50034/"
    },
    {
      "code": "50052",
      "name": "InvalidPasswordExceedsMaxLength",
      "category": "credentials",
      "kind": "failure",
      "attackSignal": "low",
      "mitre": [],
      "tables": [],
      "related": [
        "50126",
        "50055",
        "50053",
        "50034"
      ],
      "status": "draft",
      "verification": "lab-reproduced",
      "labReproduced": "2026-10-30",
      "logCaptured": "2026-10-30",
      "kqlTested": "2026-10-30",
      "inMicrosoftReference": false,
      "updated": "2026-10-30",
      "url": "https://brambrinkmeier.com/entra/aadsts/50052/"
    },
    {
      "code": "50053",
      "name": "IdsLocked",
      "category": "credentials",
      "kind": "failure",
      "attackSignal": "high",
      "mitre": [
        "T1110.003",
        "T1110.001"
      ],
      "tables": [
        "SigninLogs",
        "AADNonInteractiveUserSignInLogs"
      ],
      "related": [
        "50126",
        "50057",
        "50034",
        "53003",
        "530032"
      ],
      "status": "draft",
      "verification": "lab-reproduced",
      "labReproduced": "2026-10-30",
      "logCaptured": "2026-10-31",
      "inMicrosoftReference": true,
      "updated": "2026-10-30",
      "url": "https://brambrinkmeier.com/entra/aadsts/50053/"
    },
    {
      "code": "50054",
      "name": "",
      "category": "credentials",
      "kind": "failure",
      "attackSignal": "medium",
      "mitre": [],
      "tables": [],
      "related": [
        "50126",
        "50055",
        "50133",
        "50053"
      ],
      "status": "draft",
      "verification": "documentation",
      "inMicrosoftReference": false,
      "updated": "2026-10-30",
      "url": "https://brambrinkmeier.com/entra/aadsts/50054/"
    },
    {
      "code": "50055",
      "name": "InvalidPasswordExpiredPassword",
      "category": "credentials",
      "kind": "failure",
      "attackSignal": "medium",
      "mitre": [
        "T1110.003",
        "T1078.004"
      ],
      "tables": [
        "SigninLogs"
      ],
      "related": [
        "50126",
        "50053",
        "50057",
        "50076",
        "53003"
      ],
      "status": "draft",
      "verification": "lab-reproduced",
      "labReproduced": "2026-10-25",
      "logCaptured": "2026-10-30",
      "kqlTested": "2026-10-30",
      "inMicrosoftReference": true,
      "updated": "2026-10-30",
      "url": "https://brambrinkmeier.com/entra/aadsts/50055/"
    },
    {
      "code": "50057",
      "name": "UserDisabled",
      "category": "credentials",
      "kind": "failure",
      "attackSignal": "medium",
      "mitre": [
        "T1110.003",
        "T1078.004"
      ],
      "tables": [
        "SigninLogs",
        "AADNonInteractiveUserSignInLogs"
      ],
      "related": [
        "50126",
        "50053",
        "50034",
        "50055",
        "53003"
      ],
      "status": "draft",
      "verification": "lab-reproduced",
      "labReproduced": "2026-10-25",
      "logCaptured": "2026-10-30",
      "kqlTested": "2026-10-30",
      "inMicrosoftReference": true,
      "updated": "2026-11-01",
      "url": "https://brambrinkmeier.com/entra/aadsts/50057/"
    },
    {
      "code": "50058",
      "name": "UserInformationNotProvided",
      "category": "token",
      "kind": "interrupt",
      "attackSignal": "low",
      "mitre": [],
      "tables": [
        "SigninLogs",
        "AADNonInteractiveUserSignInLogs"
      ],
      "related": [
        "50140",
        "70043",
        "700082"
      ],
      "status": "draft",
      "verification": "documentation",
      "inMicrosoftReference": true,
      "updated": "2026-10-24",
      "url": "https://brambrinkmeier.com/entra/aadsts/50058/"
    },
    {
      "code": "50059",
      "name": "MissingTenantRealmAndNoUserInformationProvided",
      "category": "app-config",
      "kind": "config",
      "attackSignal": "low",
      "mitre": [],
      "tables": [],
      "related": [
        "90002",
        "900023",
        "50020",
        "700016"
      ],
      "status": "draft",
      "verification": "lab-reproduced",
      "labReproduced": "2026-10-30",
      "inMicrosoftReference": true,
      "updated": "2026-10-30",
      "url": "https://brambrinkmeier.com/entra/aadsts/50059/"
    },
    {
      "code": "50072",
      "name": "UserStrongAuthEnrollmentRequiredInterrupt",
      "category": "mfa",
      "kind": "interrupt",
      "attackSignal": "medium",
      "mitre": [
        "T1078.004",
        "T1098.005"
      ],
      "tables": [
        "SigninLogs"
      ],
      "related": [
        "50079",
        "50074",
        "50076",
        "53003"
      ],
      "status": "draft",
      "verification": "documentation",
      "inMicrosoftReference": true,
      "updated": "2026-10-25",
      "url": "https://brambrinkmeier.com/entra/aadsts/50072/"
    },
    {
      "code": "50074",
      "name": "UserStrongAuthClientAuthNRequiredInterrupt",
      "category": "mfa",
      "kind": "interrupt",
      "attackSignal": "medium",
      "mitre": [
        "T1621",
        "T1078.004"
      ],
      "tables": [
        "SigninLogs"
      ],
      "related": [
        "50076",
        "500121",
        "50126",
        "53003",
        "50079",
        "50072"
      ],
      "status": "draft",
      "verification": "documentation",
      "inMicrosoftReference": true,
      "updated": "2026-11-01",
      "url": "https://brambrinkmeier.com/entra/aadsts/50074/"
    },
    {
      "code": "50076",
      "name": "UserStrongAuthClientAuthNRequired",
      "category": "mfa",
      "kind": "interrupt",
      "attackSignal": "medium",
      "mitre": [
        "T1078.004",
        "T1110.003"
      ],
      "tables": [
        "SigninLogs",
        "AADNonInteractiveUserSignInLogs"
      ],
      "related": [
        "50126",
        "50074",
        "500121",
        "50079",
        "53003",
        "50158"
      ],
      "status": "draft",
      "verification": "documentation",
      "inMicrosoftReference": true,
      "updated": "2026-10-11",
      "url": "https://brambrinkmeier.com/entra/aadsts/50076/"
    },
    {
      "code": "50079",
      "name": "UserStrongAuthEnrollmentRequired",
      "category": "mfa",
      "kind": "interrupt",
      "attackSignal": "high",
      "mitre": [
        "T1078.004",
        "T1098.005"
      ],
      "tables": [
        "SigninLogs"
      ],
      "related": [
        "50076",
        "50072",
        "50125",
        "50126",
        "50074",
        "53003"
      ],
      "status": "draft",
      "verification": "documentation",
      "inMicrosoftReference": true,
      "updated": "2026-10-11",
      "url": "https://brambrinkmeier.com/entra/aadsts/50079/"
    },
    {
      "code": "50089",
      "name": "",
      "category": "token",
      "kind": "interrupt",
      "attackSignal": "low",
      "mitre": [],
      "tables": [],
      "related": [
        "50133",
        "50173",
        "70043",
        "700082",
        "50058"
      ],
      "status": "draft",
      "verification": "documentation",
      "inMicrosoftReference": true,
      "updated": "2026-10-30",
      "url": "https://brambrinkmeier.com/entra/aadsts/50089/"
    },
    {
      "code": "50097",
      "name": "DeviceAuthenticationRequired",
      "category": "device",
      "kind": "interrupt",
      "attackSignal": "medium",
      "mitre": [
        "T1078.004"
      ],
      "tables": [
        "SigninLogs",
        "AADNonInteractiveUserSignInLogs"
      ],
      "related": [
        "53000",
        "53001",
        "135011",
        "53003"
      ],
      "status": "draft",
      "verification": "documentation",
      "inMicrosoftReference": true,
      "updated": "2026-11-01",
      "url": "https://brambrinkmeier.com/entra/aadsts/50097/"
    },
    {
      "code": "50105",
      "name": "EntitlementGrantsNotFound",
      "category": "app-config",
      "kind": "failure",
      "attackSignal": "low",
      "mitre": [
        "T1078.004"
      ],
      "tables": [
        "SigninLogs"
      ],
      "related": [
        "53003",
        "50020",
        "50011",
        "700016",
        "65001"
      ],
      "status": "draft",
      "verification": "documentation",
      "inMicrosoftReference": true,
      "updated": "2026-10-25",
      "url": "https://brambrinkmeier.com/entra/aadsts/50105/"
    },
    {
      "code": "50125",
      "name": "PasswordResetRegistrationRequiredInterrupt",
      "category": "credentials",
      "kind": "interrupt",
      "attackSignal": "medium",
      "mitre": [
        "T1078.004"
      ],
      "tables": [
        "SigninLogs"
      ],
      "related": [
        "50079",
        "50126",
        "50055",
        "50076",
        "50140"
      ],
      "status": "draft",
      "verification": "documentation",
      "inMicrosoftReference": true,
      "updated": "2026-10-11",
      "url": "https://brambrinkmeier.com/entra/aadsts/50125/"
    },
    {
      "code": "50126",
      "name": "InvalidUserNameOrPassword",
      "category": "credentials",
      "kind": "failure",
      "attackSignal": "high",
      "mitre": [
        "T1110.003",
        "T1110.001"
      ],
      "tables": [
        "SigninLogs",
        "AADNonInteractiveUserSignInLogs"
      ],
      "related": [
        "50053",
        "50057",
        "50055",
        "50034",
        "53003",
        "50076"
      ],
      "status": "draft",
      "verification": "lab-reproduced",
      "labReproduced": "2026-10-25",
      "logCaptured": "2026-10-30",
      "kqlTested": "2026-10-30",
      "inMicrosoftReference": true,
      "updated": "2026-10-30",
      "url": "https://brambrinkmeier.com/entra/aadsts/50126/"
    },
    {
      "code": "50133",
      "name": "SsoArtifactRevoked",
      "category": "token",
      "kind": "failure",
      "attackSignal": "low",
      "mitre": [],
      "tables": [
        "SigninLogs",
        "AADNonInteractiveUserSignInLogs"
      ],
      "related": [
        "50173",
        "50055",
        "70043",
        "700082",
        "50126"
      ],
      "status": "draft",
      "verification": "documentation",
      "inMicrosoftReference": true,
      "updated": "2026-10-11",
      "url": "https://brambrinkmeier.com/entra/aadsts/50133/"
    },
    {
      "code": "50140",
      "name": "KmsiInterrupt",
      "category": "token",
      "kind": "interrupt",
      "attackSignal": "low",
      "mitre": [
        "T1078.004"
      ],
      "tables": [
        "SigninLogs"
      ],
      "related": [
        "50076",
        "50074",
        "50058",
        "50126",
        "50173",
        "50133"
      ],
      "status": "draft",
      "verification": "documentation",
      "inMicrosoftReference": true,
      "updated": "2026-10-11",
      "url": "https://brambrinkmeier.com/entra/aadsts/50140/"
    },
    {
      "code": "50146",
      "name": "MissingCustomSigningKey",
      "category": "app-config",
      "kind": "config",
      "attackSignal": "low",
      "mitre": [],
      "tables": [],
      "related": [],
      "status": "draft",
      "verification": "documentation",
      "inMicrosoftReference": true,
      "updated": "2026-11-01",
      "url": "https://brambrinkmeier.com/entra/aadsts/50146/"
    },
    {
      "code": "50155",
      "name": "DeviceAuthenticationFailed",
      "category": "device",
      "kind": "failure",
      "attackSignal": "low",
      "mitre": [],
      "tables": [
        "SigninLogs",
        "AADNonInteractiveUserSignInLogs"
      ],
      "related": [
        "50097",
        "53000",
        "53001",
        "135011"
      ],
      "status": "draft",
      "verification": "documentation",
      "inMicrosoftReference": true,
      "updated": "2026-10-30",
      "url": "https://brambrinkmeier.com/entra/aadsts/50155/"
    },
    {
      "code": "50158",
      "name": "External security challenge not satisfied",
      "category": "mfa",
      "kind": "interrupt",
      "attackSignal": "low",
      "mitre": [
        "T1078.004"
      ],
      "tables": [
        "SigninLogs"
      ],
      "related": [
        "50076",
        "50074",
        "50126",
        "53003",
        "50140"
      ],
      "status": "draft",
      "verification": "documentation",
      "inMicrosoftReference": true,
      "updated": "2026-10-11",
      "url": "https://brambrinkmeier.com/entra/aadsts/50158/"
    },
    {
      "code": "50173",
      "name": "Grant expired due to revocation",
      "category": "token",
      "kind": "failure",
      "attackSignal": "medium",
      "mitre": [
        "T1550.001"
      ],
      "tables": [
        "AADNonInteractiveUserSignInLogs",
        "SigninLogs"
      ],
      "related": [
        "50133",
        "70043",
        "700082",
        "135011",
        "50057"
      ],
      "status": "draft",
      "verification": "lab-reproduced",
      "labReproduced": "2026-10-30",
      "inMicrosoftReference": true,
      "updated": "2026-10-30",
      "url": "https://brambrinkmeier.com/entra/aadsts/50173/"
    },
    {
      "code": "50194",
      "name": "",
      "category": "app-config",
      "kind": "config",
      "attackSignal": "low",
      "mitre": [],
      "tables": [],
      "related": [
        "90133",
        "700016",
        "90002",
        "50020",
        "9002331"
      ],
      "status": "draft",
      "verification": "documentation",
      "inMicrosoftReference": true,
      "updated": "2026-11-01",
      "url": "https://brambrinkmeier.com/entra/aadsts/50194/"
    },
    {
      "code": "50196",
      "name": "LoopDetected",
      "category": "token",
      "kind": "failure",
      "attackSignal": "low",
      "mitre": [],
      "tables": [
        "SigninLogs",
        "AADNonInteractiveUserSignInLogs",
        "AADServicePrincipalSignInLogs"
      ],
      "related": [
        "50058",
        "70043",
        "700082"
      ],
      "status": "draft",
      "verification": "documentation",
      "inMicrosoftReference": true,
      "updated": "2026-10-30",
      "url": "https://brambrinkmeier.com/entra/aadsts/50196/"
    },
    {
      "code": "51004",
      "name": "UserAccountNotInDirectory",
      "category": "b2b-tenant",
      "kind": "failure",
      "attackSignal": "low",
      "mitre": [],
      "tables": [],
      "related": [
        "50034",
        "50020",
        "90072",
        "700016"
      ],
      "status": "draft",
      "verification": "documentation",
      "inMicrosoftReference": true,
      "updated": "2026-11-01",
      "url": "https://brambrinkmeier.com/entra/aadsts/51004/"
    },
    {
      "code": "53000",
      "name": "DeviceNotCompliant",
      "category": "device",
      "kind": "failure",
      "attackSignal": "medium",
      "mitre": [
        "T1078.004",
        "T1557",
        "T1539"
      ],
      "tables": [
        "SigninLogs",
        "AADNonInteractiveUserSignInLogs"
      ],
      "related": [
        "53001",
        "50097",
        "53003",
        "135011",
        "50126"
      ],
      "status": "draft",
      "verification": "documentation",
      "inMicrosoftReference": true,
      "updated": "2026-10-11",
      "url": "https://brambrinkmeier.com/entra/aadsts/53000/"
    },
    {
      "code": "53001",
      "name": "DeviceNotDomainJoined",
      "category": "device",
      "kind": "failure",
      "attackSignal": "medium",
      "mitre": [
        "T1078.004"
      ],
      "tables": [
        "SigninLogs",
        "AADNonInteractiveUserSignInLogs"
      ],
      "related": [
        "53000",
        "50097",
        "53003",
        "135011"
      ],
      "status": "draft",
      "verification": "documentation",
      "inMicrosoftReference": true,
      "updated": "2026-10-11",
      "url": "https://brambrinkmeier.com/entra/aadsts/53001/"
    },
    {
      "code": "53003",
      "name": "BlockedByConditionalAccess",
      "category": "conditional-access",
      "kind": "failure",
      "attackSignal": "medium",
      "mitre": [
        "T1078.004"
      ],
      "tables": [
        "SigninLogs",
        "AADNonInteractiveUserSignInLogs"
      ],
      "related": [
        "50126",
        "53000",
        "53001",
        "530032",
        "50076",
        "50053"
      ],
      "status": "draft",
      "verification": "documentation",
      "inMicrosoftReference": true,
      "updated": "2026-11-06",
      "url": "https://brambrinkmeier.com/entra/aadsts/53003/"
    },
    {
      "code": "54005",
      "name": "",
      "category": "token",
      "kind": "failure",
      "attackSignal": "low",
      "mitre": [],
      "tables": [
        "SigninLogs",
        "AADNonInteractiveUserSignInLogs"
      ],
      "related": [
        "50058",
        "700082",
        "700054",
        "50196"
      ],
      "status": "draft",
      "verification": "documentation",
      "inMicrosoftReference": true,
      "updated": "2026-10-30",
      "url": "https://brambrinkmeier.com/entra/aadsts/54005/"
    },
    {
      "code": "65001",
      "name": "DelegationDoesNotExist",
      "category": "consent",
      "kind": "failure",
      "attackSignal": "medium",
      "mitre": [
        "T1528",
        "T1566.002"
      ],
      "tables": [
        "SigninLogs",
        "AADNonInteractiveUserSignInLogs",
        "AADServicePrincipalSignInLogs"
      ],
      "related": [
        "90094",
        "90095",
        "65004",
        "700016",
        "500011"
      ],
      "status": "draft",
      "verification": "lab-reproduced",
      "labReproduced": "2026-10-25",
      "logCaptured": "2026-10-30",
      "inMicrosoftReference": true,
      "updated": "2026-10-30",
      "url": "https://brambrinkmeier.com/entra/aadsts/65001/"
    },
    {
      "code": "65002",
      "name": "",
      "category": "consent",
      "kind": "config",
      "attackSignal": "low",
      "mitre": [],
      "tables": [],
      "related": [
        "65001",
        "90094",
        "500011",
        "700016"
      ],
      "status": "draft",
      "verification": "documentation",
      "inMicrosoftReference": true,
      "updated": "2026-11-01",
      "url": "https://brambrinkmeier.com/entra/aadsts/65002/"
    },
    {
      "code": "65004",
      "name": "UserDeclinedConsent",
      "category": "consent",
      "kind": "failure",
      "attackSignal": "low",
      "mitre": [],
      "tables": [
        "SigninLogs"
      ],
      "related": [
        "65001",
        "90095",
        "90094"
      ],
      "status": "draft",
      "verification": "documentation",
      "inMicrosoftReference": true,
      "updated": "2026-10-25",
      "url": "https://brambrinkmeier.com/entra/aadsts/65004/"
    },
    {
      "code": "65005",
      "name": "MisconfiguredApplication",
      "category": "consent",
      "kind": "config",
      "attackSignal": "low",
      "mitre": [],
      "tables": [],
      "related": [
        "650056",
        "500011",
        "65001",
        "700016"
      ],
      "status": "draft",
      "verification": "documentation",
      "inMicrosoftReference": true,
      "updated": "2026-11-01",
      "url": "https://brambrinkmeier.com/entra/aadsts/65005/"
    },
    {
      "code": "70002",
      "name": "InvalidClient",
      "category": "app-config",
      "kind": "failure",
      "attackSignal": "medium",
      "mitre": [
        "T1078.004"
      ],
      "tables": [],
      "related": [
        "7000215",
        "7000222",
        "7000218",
        "50126",
        "700016"
      ],
      "status": "draft",
      "verification": "documentation",
      "inMicrosoftReference": true,
      "updated": "2026-11-01",
      "url": "https://brambrinkmeier.com/entra/aadsts/70002/"
    },
    {
      "code": "70008",
      "name": "ExpiredOrRevokedGrant",
      "category": "token",
      "kind": "failure",
      "attackSignal": "low",
      "mitre": [],
      "tables": [
        "AADNonInteractiveUserSignInLogs",
        "SigninLogs"
      ],
      "related": [
        "700082",
        "50173",
        "70043",
        "50133"
      ],
      "status": "draft",
      "verification": "documentation",
      "inMicrosoftReference": true,
      "updated": "2026-10-30",
      "url": "https://brambrinkmeier.com/entra/aadsts/70008/"
    },
    {
      "code": "70016",
      "name": "AuthorizationPending",
      "category": "token",
      "kind": "interrupt",
      "attackSignal": "medium",
      "mitre": [],
      "tables": [],
      "related": [
        "7000014",
        "90023",
        "50059",
        "90133"
      ],
      "status": "draft",
      "verification": "lab-reproduced",
      "labReproduced": "2026-10-31",
      "inMicrosoftReference": true,
      "updated": "2026-10-31",
      "url": "https://brambrinkmeier.com/entra/aadsts/70016/"
    },
    {
      "code": "70021",
      "name": "",
      "category": "app-config",
      "kind": "config",
      "attackSignal": "low",
      "mitre": [],
      "tables": [],
      "related": [
        "700211",
        "700212",
        "700213",
        "7002138",
        "70025",
        "700016"
      ],
      "status": "draft",
      "verification": "documentation",
      "inMicrosoftReference": false,
      "updated": "2026-10-30",
      "url": "https://brambrinkmeier.com/entra/aadsts/70021/"
    },
    {
      "code": "70025",
      "name": "",
      "category": "app-config",
      "kind": "config",
      "attackSignal": "low",
      "mitre": [],
      "tables": [],
      "related": [
        "70021",
        "700211",
        "700212",
        "700213",
        "7002138",
        "700016"
      ],
      "status": "draft",
      "verification": "lab-reproduced",
      "labReproduced": "2026-10-30",
      "inMicrosoftReference": false,
      "updated": "2026-10-30",
      "url": "https://brambrinkmeier.com/entra/aadsts/70025/"
    },
    {
      "code": "70043",
      "name": "BadTokenDueToSignInFrequency",
      "category": "token",
      "kind": "failure",
      "attackSignal": "low",
      "mitre": [],
      "tables": [
        "AADNonInteractiveUserSignInLogs"
      ],
      "related": [
        "700082",
        "50173",
        "50133",
        "50076",
        "53003"
      ],
      "status": "draft",
      "verification": "documentation",
      "inMicrosoftReference": true,
      "updated": "2026-10-25",
      "url": "https://brambrinkmeier.com/entra/aadsts/70043/"
    },
    {
      "code": "70044",
      "name": "",
      "category": "token",
      "kind": "failure",
      "attackSignal": "low",
      "mitre": [],
      "tables": [],
      "related": [
        "70043",
        "700082",
        "50058",
        "50133",
        "53003"
      ],
      "status": "draft",
      "verification": "documentation",
      "inMicrosoftReference": false,
      "updated": "2026-10-30",
      "url": "https://brambrinkmeier.com/entra/aadsts/70044/"
    },
    {
      "code": "75011",
      "name": "NoMatchedAuthnContextInOutputClaims",
      "category": "app-config",
      "kind": "config",
      "attackSignal": "low",
      "mitre": [],
      "tables": [
        "SigninLogs"
      ],
      "related": [
        "50076",
        "50074",
        "50058"
      ],
      "status": "draft",
      "verification": "documentation",
      "inMicrosoftReference": true,
      "updated": "2026-10-30",
      "url": "https://brambrinkmeier.com/entra/aadsts/75011/"
    },
    {
      "code": "76021",
      "name": "ApplicationRequiresSignedRequests",
      "category": "app-config",
      "kind": "config",
      "attackSignal": "low",
      "mitre": [],
      "tables": [],
      "related": [
        "650056",
        "75011"
      ],
      "status": "draft",
      "verification": "documentation",
      "inMicrosoftReference": true,
      "updated": "2026-11-01",
      "url": "https://brambrinkmeier.com/entra/aadsts/76021/"
    },
    {
      "code": "90002",
      "name": "InvalidTenantName",
      "category": "app-config",
      "kind": "config",
      "attackSignal": "low",
      "mitre": [],
      "tables": [],
      "related": [
        "700016",
        "500011",
        "16000",
        "50034"
      ],
      "status": "draft",
      "verification": "lab-reproduced",
      "labReproduced": "2026-10-25",
      "inMicrosoftReference": true,
      "updated": "2026-10-30",
      "url": "https://brambrinkmeier.com/entra/aadsts/90002/"
    },
    {
      "code": "90009",
      "name": "TokenForItselfMissingIdenticalAppIdentifier",
      "category": "app-config",
      "kind": "config",
      "attackSignal": "low",
      "mitre": [],
      "tables": [],
      "related": [
        "500011",
        "700016",
        "65001"
      ],
      "status": "draft",
      "verification": "documentation",
      "inMicrosoftReference": true,
      "updated": "2026-11-01",
      "url": "https://brambrinkmeier.com/entra/aadsts/90009/"
    },
    {
      "code": "90014",
      "name": "MissingRequiredField",
      "category": "app-config",
      "kind": "failure",
      "attackSignal": "low",
      "mitre": [],
      "tables": [],
      "related": [
        "900144",
        "9002313",
        "90023",
        "901002"
      ],
      "status": "draft",
      "verification": "documentation",
      "inMicrosoftReference": true,
      "updated": "2026-11-01",
      "url": "https://brambrinkmeier.com/entra/aadsts/90014/"
    },
    {
      "code": "90015",
      "name": "QueryStringTooLong",
      "category": "request",
      "kind": "failure",
      "attackSignal": "low",
      "mitre": [],
      "tables": [],
      "related": [
        "9002313",
        "900144"
      ],
      "status": "draft",
      "verification": "documentation",
      "inMicrosoftReference": true,
      "updated": "2026-11-01",
      "url": "https://brambrinkmeier.com/entra/aadsts/90015/"
    },
    {
      "code": "90019",
      "name": "MissingTenantRealm",
      "category": "request",
      "kind": "failure",
      "attackSignal": "low",
      "mitre": [],
      "tables": [],
      "related": [
        "90002",
        "900023",
        "50034",
        "700016"
      ],
      "status": "draft",
      "verification": "documentation",
      "inMicrosoftReference": true,
      "updated": "2026-11-01",
      "url": "https://brambrinkmeier.com/entra/aadsts/90019/"
    },
    {
      "code": "90023",
      "name": "InvalidRequest",
      "category": "credentials",
      "kind": "failure",
      "attackSignal": "low",
      "mitre": [],
      "tables": [
        "AADServicePrincipalSignInLogs"
      ],
      "related": [
        "50027",
        "700024",
        "7000216",
        "7000218",
        "70016",
        "7000014"
      ],
      "status": "draft",
      "verification": "lab-reproduced",
      "labReproduced": "2026-10-30",
      "inMicrosoftReference": true,
      "updated": "2026-10-31",
      "url": "https://brambrinkmeier.com/entra/aadsts/90023/"
    },
    {
      "code": "90072",
      "name": "PassThroughUserMfaError",
      "category": "b2b-tenant",
      "kind": "failure",
      "attackSignal": "low",
      "mitre": [],
      "tables": [
        "SigninLogs"
      ],
      "related": [
        "50020",
        "50076",
        "50079"
      ],
      "status": "draft",
      "verification": "documentation",
      "inMicrosoftReference": true,
      "updated": "2026-10-24",
      "url": "https://brambrinkmeier.com/entra/aadsts/90072/"
    },
    {
      "code": "90094",
      "name": "AdminConsentRequired",
      "category": "consent",
      "kind": "failure",
      "attackSignal": "medium",
      "mitre": [
        "T1566.002",
        "T1528"
      ],
      "tables": [
        "SigninLogs"
      ],
      "related": [
        "90095",
        "65001",
        "65004",
        "700016"
      ],
      "status": "draft",
      "verification": "documentation",
      "inMicrosoftReference": true,
      "updated": "2026-11-01",
      "url": "https://brambrinkmeier.com/entra/aadsts/90094/"
    },
    {
      "code": "90095",
      "name": "AdminConsentRequiredRequestAccess",
      "category": "consent",
      "kind": "interrupt",
      "attackSignal": "low",
      "mitre": [
        "T1566.002",
        "T1528"
      ],
      "tables": [
        "SigninLogs"
      ],
      "related": [
        "90094",
        "65001",
        "65004",
        "700016"
      ],
      "status": "draft",
      "verification": "documentation",
      "inMicrosoftReference": true,
      "updated": "2026-11-01",
      "url": "https://brambrinkmeier.com/entra/aadsts/90095/"
    },
    {
      "code": "90133",
      "name": "",
      "category": "app-config",
      "kind": "config",
      "attackSignal": "low",
      "mitre": [],
      "tables": [],
      "related": [
        "700016",
        "90002",
        "500011",
        "7000218"
      ],
      "status": "draft",
      "verification": "documentation",
      "inMicrosoftReference": false,
      "updated": "2026-10-30",
      "url": "https://brambrinkmeier.com/entra/aadsts/90133/"
    },
    {
      "code": "135011",
      "name": "Device disabled",
      "category": "device",
      "kind": "failure",
      "attackSignal": "low",
      "mitre": [],
      "tables": [
        "SigninLogs",
        "AADNonInteractiveUserSignInLogs"
      ],
      "related": [
        "50173",
        "50057",
        "53000",
        "53001",
        "50097"
      ],
      "status": "draft",
      "verification": "documentation",
      "inMicrosoftReference": true,
      "updated": "2026-10-11",
      "url": "https://brambrinkmeier.com/entra/aadsts/135011/"
    },
    {
      "code": "165000",
      "name": "",
      "category": "token",
      "kind": "failure",
      "attackSignal": "low",
      "mitre": [],
      "tables": [],
      "related": [
        "50058",
        "50140"
      ],
      "status": "draft",
      "verification": "documentation",
      "inMicrosoftReference": false,
      "updated": "2026-10-30",
      "url": "https://brambrinkmeier.com/entra/aadsts/165000/"
    },
    {
      "code": "500011",
      "name": "InvalidResourceServicePrincipalNotFound",
      "category": "app-config",
      "kind": "failure",
      "attackSignal": "low",
      "mitre": [],
      "tables": [
        "SigninLogs",
        "AADServicePrincipalSignInLogs"
      ],
      "related": [
        "700016",
        "65001",
        "7000222"
      ],
      "status": "draft",
      "verification": "lab-reproduced",
      "labReproduced": "2026-10-25",
      "logCaptured": "2026-10-30",
      "kqlTested": "2026-10-30",
      "inMicrosoftReference": true,
      "updated": "2026-10-30",
      "url": "https://brambrinkmeier.com/entra/aadsts/500011/"
    },
    {
      "code": "500014",
      "name": "InvalidResourceServicePrincipalDisabled",
      "category": "app-config",
      "kind": "config",
      "attackSignal": "low",
      "mitre": [],
      "tables": [],
      "related": [
        "7000112",
        "500011",
        "700016",
        "650052"
      ],
      "status": "draft",
      "verification": "documentation",
      "inMicrosoftReference": true,
      "updated": "2026-11-01",
      "url": "https://brambrinkmeier.com/entra/aadsts/500014/"
    },
    {
      "code": "500021",
      "name": "",
      "category": "b2b-tenant",
      "kind": "failure",
      "attackSignal": "low",
      "mitre": [],
      "tables": [],
      "related": [
        "5000211",
        "50020",
        "53003",
        "90072"
      ],
      "status": "draft",
      "verification": "documentation",
      "inMicrosoftReference": true,
      "updated": "2026-11-01",
      "url": "https://brambrinkmeier.com/entra/aadsts/500021/"
    },
    {
      "code": "500031",
      "name": "",
      "category": "app-config",
      "kind": "config",
      "attackSignal": "low",
      "mitre": [],
      "tables": [],
      "related": [
        "75011",
        "50011",
        "700016",
        "650056"
      ],
      "status": "draft",
      "verification": "documentation",
      "inMicrosoftReference": false,
      "updated": "2026-10-30",
      "url": "https://brambrinkmeier.com/entra/aadsts/500031/"
    },
    {
      "code": "500113",
      "name": "",
      "category": "app-config",
      "kind": "config",
      "attackSignal": "low",
      "mitre": [],
      "tables": [],
      "related": [
        "50011",
        "700051",
        "700054",
        "700016"
      ],
      "status": "draft",
      "verification": "lab-reproduced",
      "labReproduced": "2026-10-30",
      "logCaptured": "2026-10-30",
      "kqlTested": "2026-10-30",
      "inMicrosoftReference": false,
      "updated": "2026-10-30",
      "url": "https://brambrinkmeier.com/entra/aadsts/500113/"
    },
    {
      "code": "500121",
      "name": "MFA prompt not completed",
      "category": "mfa",
      "kind": "failure",
      "attackSignal": "medium",
      "mitre": [
        "T1621"
      ],
      "tables": [
        "SigninLogs"
      ],
      "related": [
        "50074",
        "50076",
        "50079",
        "50126",
        "53003"
      ],
      "status": "draft",
      "verification": "documentation",
      "inMicrosoftReference": true,
      "updated": "2026-10-11",
      "url": "https://brambrinkmeier.com/entra/aadsts/500121/"
    },
    {
      "code": "500200",
      "name": "",
      "category": "app-config",
      "kind": "config",
      "attackSignal": "low",
      "mitre": [],
      "tables": [],
      "related": [
        "50020",
        "90072",
        "50034",
        "700016"
      ],
      "status": "draft",
      "verification": "documentation",
      "inMicrosoftReference": false,
      "updated": "2026-10-30",
      "url": "https://brambrinkmeier.com/entra/aadsts/500200/"
    },
    {
      "code": "500341",
      "name": "",
      "category": "credentials",
      "kind": "failure",
      "attackSignal": "low",
      "mitre": [],
      "tables": [],
      "related": [
        "50034",
        "50057",
        "50173",
        "65001"
      ],
      "status": "draft",
      "verification": "documentation",
      "inMicrosoftReference": false,
      "updated": "2026-10-30",
      "url": "https://brambrinkmeier.com/entra/aadsts/500341/"
    },
    {
      "code": "500571",
      "name": "",
      "category": "b2b-tenant",
      "kind": "failure",
      "attackSignal": "low",
      "mitre": [],
      "tables": [],
      "related": [
        "50057",
        "50020",
        "90072",
        "50034"
      ],
      "status": "draft",
      "verification": "documentation",
      "inMicrosoftReference": false,
      "updated": "2026-10-30",
      "url": "https://brambrinkmeier.com/entra/aadsts/500571/"
    },
    {
      "code": "501051",
      "name": "",
      "category": "app-config",
      "kind": "config",
      "attackSignal": "low",
      "mitre": [],
      "tables": [],
      "related": [
        "50105",
        "500011",
        "700016",
        "65001",
        "7000112"
      ],
      "status": "draft",
      "verification": "lab-reproduced",
      "labReproduced": "2026-10-30",
      "inMicrosoftReference": false,
      "updated": "2026-10-30",
      "url": "https://brambrinkmeier.com/entra/aadsts/501051/"
    },
    {
      "code": "530002",
      "name": "",
      "category": "device",
      "kind": "failure",
      "attackSignal": "medium",
      "mitre": [],
      "tables": [],
      "related": [
        "53000",
        "50097",
        "53003",
        "530003",
        "530004"
      ],
      "status": "draft",
      "verification": "documentation",
      "inMicrosoftReference": false,
      "updated": "2026-10-30",
      "url": "https://brambrinkmeier.com/entra/aadsts/530002/"
    },
    {
      "code": "530003",
      "name": "",
      "category": "device",
      "kind": "failure",
      "attackSignal": "medium",
      "mitre": [],
      "tables": [],
      "related": [
        "53000",
        "53001",
        "50097",
        "53003",
        "530002"
      ],
      "status": "draft",
      "verification": "documentation",
      "inMicrosoftReference": false,
      "updated": "2026-10-30",
      "url": "https://brambrinkmeier.com/entra/aadsts/530003/"
    },
    {
      "code": "530004",
      "name": "",
      "category": "b2b-tenant",
      "kind": "failure",
      "attackSignal": "low",
      "mitre": [],
      "tables": [],
      "related": [
        "53000",
        "53001",
        "53003",
        "530002",
        "530003"
      ],
      "status": "draft",
      "verification": "documentation",
      "inMicrosoftReference": false,
      "updated": "2026-10-30",
      "url": "https://brambrinkmeier.com/entra/aadsts/530004/"
    },
    {
      "code": "530031",
      "name": "",
      "category": "conditional-access",
      "kind": "failure",
      "attackSignal": "medium",
      "mitre": [],
      "tables": [],
      "related": [
        "53003",
        "530032",
        "53000",
        "53001"
      ],
      "status": "draft",
      "verification": "documentation",
      "inMicrosoftReference": false,
      "updated": "2026-10-30",
      "url": "https://brambrinkmeier.com/entra/aadsts/530031/"
    },
    {
      "code": "530032",
      "name": "BlockedByConditionalAccessOnSecurityPolicy",
      "category": "conditional-access",
      "kind": "failure",
      "attackSignal": "medium",
      "mitre": [
        "T1078.004",
        "T1110.003"
      ],
      "tables": [
        "SigninLogs",
        "AADNonInteractiveUserSignInLogs"
      ],
      "related": [
        "53003",
        "50126",
        "50053",
        "53000",
        "50076"
      ],
      "status": "draft",
      "verification": "documentation",
      "inMicrosoftReference": true,
      "updated": "2026-10-11",
      "url": "https://brambrinkmeier.com/entra/aadsts/530032/"
    },
    {
      "code": "650052",
      "name": "",
      "category": "consent",
      "kind": "config",
      "attackSignal": "low",
      "mitre": [],
      "tables": [],
      "related": [
        "500011",
        "65001",
        "650056",
        "700016"
      ],
      "status": "draft",
      "verification": "documentation",
      "inMicrosoftReference": true,
      "updated": "2026-11-01",
      "url": "https://brambrinkmeier.com/entra/aadsts/650052/"
    },
    {
      "code": "650056",
      "name": "",
      "category": "consent",
      "kind": "config",
      "attackSignal": "low",
      "mitre": [],
      "tables": [],
      "related": [
        "65001",
        "90094",
        "90095",
        "65004",
        "500011",
        "700016"
      ],
      "status": "draft",
      "verification": "documentation",
      "inMicrosoftReference": true,
      "updated": "2026-10-30",
      "url": "https://brambrinkmeier.com/entra/aadsts/650056/"
    },
    {
      "code": "700003",
      "name": "",
      "category": "device",
      "kind": "failure",
      "attackSignal": "low",
      "mitre": [],
      "tables": [],
      "related": [
        "135011",
        "50097",
        "53000",
        "50173"
      ],
      "status": "draft",
      "verification": "documentation",
      "inMicrosoftReference": false,
      "updated": "2026-10-30",
      "url": "https://brambrinkmeier.com/entra/aadsts/700003/"
    },
    {
      "code": "700016",
      "name": "UnauthorizedClient_DoesNotMatchRequest",
      "category": "app-config",
      "kind": "failure",
      "attackSignal": "low",
      "mitre": [],
      "tables": [
        "SigninLogs",
        "AADServicePrincipalSignInLogs"
      ],
      "related": [
        "50011",
        "65001",
        "50020",
        "7000215",
        "500011"
      ],
      "status": "draft",
      "verification": "lab-reproduced",
      "labReproduced": "2026-10-25",
      "logCaptured": "2026-10-30",
      "kqlTested": "2026-10-30",
      "inMicrosoftReference": true,
      "updated": "2026-10-30",
      "url": "https://brambrinkmeier.com/entra/aadsts/700016/"
    },
    {
      "code": "700024",
      "name": "",
      "category": "app-config",
      "kind": "failure",
      "attackSignal": "low",
      "mitre": [],
      "tables": [],
      "related": [
        "7000215",
        "7000222",
        "7000218",
        "700016"
      ],
      "status": "draft",
      "verification": "lab-reproduced",
      "labReproduced": "2026-10-30",
      "logCaptured": "2026-10-30",
      "kqlTested": "2026-10-30",
      "inMicrosoftReference": false,
      "updated": "2026-10-30",
      "url": "https://brambrinkmeier.com/entra/aadsts/700024/"
    },
    {
      "code": "700051",
      "name": "",
      "category": "app-config",
      "kind": "config",
      "attackSignal": "low",
      "mitre": [],
      "tables": [],
      "related": [
        "700054",
        "500113",
        "50011",
        "700016"
      ],
      "status": "draft",
      "verification": "lab-reproduced",
      "labReproduced": "2026-10-30",
      "logCaptured": "2026-10-30",
      "kqlTested": "2026-10-30",
      "inMicrosoftReference": false,
      "updated": "2026-10-30",
      "url": "https://brambrinkmeier.com/entra/aadsts/700051/"
    },
    {
      "code": "700054",
      "name": "",
      "category": "app-config",
      "kind": "config",
      "attackSignal": "low",
      "mitre": [],
      "tables": [
        "SigninLogs"
      ],
      "related": [
        "50011",
        "700016",
        "54005"
      ],
      "status": "draft",
      "verification": "documentation",
      "inMicrosoftReference": true,
      "updated": "2026-10-30",
      "url": "https://brambrinkmeier.com/entra/aadsts/700054/"
    },
    {
      "code": "700081",
      "name": "",
      "category": "token",
      "kind": "interrupt",
      "attackSignal": "low",
      "mitre": [],
      "tables": [],
      "related": [
        "700082",
        "70008",
        "50058",
        "9002327"
      ],
      "status": "draft",
      "verification": "documentation",
      "inMicrosoftReference": false,
      "updated": "2026-10-30",
      "url": "https://brambrinkmeier.com/entra/aadsts/700081/"
    },
    {
      "code": "700082",
      "name": "ExpiredOrRevokedGrantInactiveToken",
      "category": "token",
      "kind": "failure",
      "attackSignal": "low",
      "mitre": [],
      "tables": [
        "AADNonInteractiveUserSignInLogs"
      ],
      "related": [
        "70043",
        "50173",
        "50133"
      ],
      "status": "draft",
      "verification": "documentation",
      "inMicrosoftReference": true,
      "updated": "2026-10-25",
      "url": "https://brambrinkmeier.com/entra/aadsts/700082/"
    },
    {
      "code": "700211",
      "name": "",
      "category": "app-config",
      "kind": "config",
      "attackSignal": "low",
      "mitre": [],
      "tables": [],
      "related": [
        "70021",
        "700212",
        "700213",
        "7002138",
        "70025"
      ],
      "status": "draft",
      "verification": "lab-reproduced",
      "labReproduced": "2026-10-30",
      "inMicrosoftReference": false,
      "updated": "2026-10-30",
      "url": "https://brambrinkmeier.com/entra/aadsts/700211/"
    },
    {
      "code": "700212",
      "name": "",
      "category": "app-config",
      "kind": "config",
      "attackSignal": "low",
      "mitre": [],
      "tables": [],
      "related": [
        "7002121",
        "70021",
        "700211",
        "700213",
        "7002138",
        "70025"
      ],
      "status": "draft",
      "verification": "documentation",
      "inMicrosoftReference": false,
      "updated": "2026-10-30",
      "url": "https://brambrinkmeier.com/entra/aadsts/700212/"
    },
    {
      "code": "700213",
      "name": "",
      "category": "app-config",
      "kind": "config",
      "attackSignal": "low",
      "mitre": [],
      "tables": [],
      "related": [
        "7002138",
        "70021",
        "700211",
        "700212",
        "70025"
      ],
      "status": "draft",
      "verification": "lab-reproduced",
      "labReproduced": "2026-10-30",
      "inMicrosoftReference": false,
      "updated": "2026-10-30",
      "url": "https://brambrinkmeier.com/entra/aadsts/700213/"
    },
    {
      "code": "700226",
      "name": "",
      "category": "app-config",
      "kind": "config",
      "attackSignal": "low",
      "mitre": [],
      "tables": [
        "AADServicePrincipalSignInLogs"
      ],
      "related": [
        "70025",
        "700211",
        "700213",
        "7002121",
        "700212"
      ],
      "status": "draft",
      "verification": "lab-reproduced",
      "labReproduced": "2026-10-30",
      "inMicrosoftReference": false,
      "updated": "2026-10-30",
      "url": "https://brambrinkmeier.com/entra/aadsts/700226/"
    },
    {
      "code": "750054",
      "name": "",
      "category": "app-config",
      "kind": "config",
      "attackSignal": "low",
      "mitre": [],
      "tables": [],
      "related": [
        "76021",
        "75011",
        "50011",
        "9002313"
      ],
      "status": "draft",
      "verification": "documentation",
      "inMicrosoftReference": true,
      "updated": "2026-11-01",
      "url": "https://brambrinkmeier.com/entra/aadsts/750054/"
    },
    {
      "code": "900023",
      "name": "",
      "category": "app-config",
      "kind": "config",
      "attackSignal": "low",
      "mitre": [],
      "tables": [],
      "related": [
        "90002",
        "700016",
        "900144",
        "9002313"
      ],
      "status": "draft",
      "verification": "lab-reproduced",
      "labReproduced": "2026-10-30",
      "inMicrosoftReference": false,
      "updated": "2026-10-30",
      "url": "https://brambrinkmeier.com/entra/aadsts/900023/"
    },
    {
      "code": "900144",
      "name": "",
      "category": "app-config",
      "kind": "config",
      "attackSignal": "low",
      "mitre": [],
      "tables": [
        "SigninLogs",
        "AADNonInteractiveUserSignInLogs",
        "AADServicePrincipalSignInLogs"
      ],
      "related": [
        "7000215",
        "700016",
        "50126"
      ],
      "status": "draft",
      "verification": "lab-reproduced",
      "labReproduced": "2026-10-25",
      "inMicrosoftReference": true,
      "updated": "2026-10-30",
      "url": "https://brambrinkmeier.com/entra/aadsts/900144/"
    },
    {
      "code": "900439",
      "name": "USGClientNotSupportedOnPublicEndpoint",
      "category": "app-config",
      "kind": "config",
      "attackSignal": "low",
      "mitre": [],
      "tables": [],
      "related": [
        "90002",
        "700016"
      ],
      "status": "draft",
      "verification": "documentation",
      "inMicrosoftReference": false,
      "updated": "2026-10-30",
      "url": "https://brambrinkmeier.com/entra/aadsts/900439/"
    },
    {
      "code": "900561",
      "name": "BadResourceRequestInvalidRequest",
      "category": "request",
      "kind": "failure",
      "attackSignal": "low",
      "mitre": [],
      "tables": [],
      "related": [
        "9002313",
        "900144",
        "90023"
      ],
      "status": "draft",
      "verification": "documentation",
      "inMicrosoftReference": true,
      "updated": "2026-11-01",
      "url": "https://brambrinkmeier.com/entra/aadsts/900561/"
    },
    {
      "code": "901002",
      "name": "",
      "category": "app-config",
      "kind": "config",
      "attackSignal": "low",
      "mitre": [],
      "tables": [],
      "related": [
        "500011",
        "900144",
        "9002313"
      ],
      "status": "draft",
      "verification": "documentation",
      "inMicrosoftReference": true,
      "updated": "2026-11-01",
      "url": "https://brambrinkmeier.com/entra/aadsts/901002/"
    },
    {
      "code": "1002016",
      "name": "",
      "category": "app-config",
      "kind": "config",
      "attackSignal": "low",
      "mitre": [],
      "tables": [],
      "related": [
        "7000218",
        "700016",
        "90002",
        "9002313"
      ],
      "status": "draft",
      "verification": "documentation",
      "inMicrosoftReference": false,
      "updated": "2026-10-30",
      "url": "https://brambrinkmeier.com/entra/aadsts/1002016/"
    },
    {
      "code": "1003031",
      "name": "",
      "category": "consent",
      "kind": "config",
      "attackSignal": "low",
      "mitre": [],
      "tables": [],
      "related": [
        "650056",
        "65001",
        "90094",
        "700016"
      ],
      "status": "draft",
      "verification": "documentation",
      "inMicrosoftReference": false,
      "updated": "2026-10-30",
      "url": "https://brambrinkmeier.com/entra/aadsts/1003031/"
    },
    {
      "code": "5000211",
      "name": "",
      "category": "b2b-tenant",
      "kind": "failure",
      "attackSignal": "low",
      "mitre": [],
      "tables": [],
      "related": [
        "53003",
        "90072",
        "50020"
      ],
      "status": "draft",
      "verification": "documentation",
      "inMicrosoftReference": false,
      "updated": "2026-10-30",
      "url": "https://brambrinkmeier.com/entra/aadsts/5000211/"
    },
    {
      "code": "5000224",
      "name": "NotAllowedTenantBlockedTenantFraud",
      "category": "b2b-tenant",
      "kind": "failure",
      "attackSignal": "medium",
      "mitre": [],
      "tables": [],
      "related": [
        "5000225",
        "90002",
        "5000211"
      ],
      "status": "draft",
      "verification": "documentation",
      "inMicrosoftReference": true,
      "updated": "2026-11-01",
      "url": "https://brambrinkmeier.com/entra/aadsts/5000224/"
    },
    {
      "code": "5000225",
      "name": "",
      "category": "b2b-tenant",
      "kind": "failure",
      "attackSignal": "low",
      "mitre": [],
      "tables": [],
      "related": [
        "90002",
        "700016",
        "50034"
      ],
      "status": "draft",
      "verification": "documentation",
      "inMicrosoftReference": false,
      "updated": "2026-10-30",
      "url": "https://brambrinkmeier.com/entra/aadsts/5000225/"
    },
    {
      "code": "5000611",
      "name": "",
      "category": "device",
      "kind": "failure",
      "attackSignal": "low",
      "mitre": [],
      "tables": [],
      "related": [
        "50097",
        "135011",
        "700003",
        "53000"
      ],
      "status": "draft",
      "verification": "documentation",
      "inMicrosoftReference": false,
      "updated": "2026-10-30",
      "url": "https://brambrinkmeier.com/entra/aadsts/5000611/"
    },
    {
      "code": "5002730",
      "name": "",
      "category": "app-config",
      "kind": "config",
      "attackSignal": "low",
      "mitre": [],
      "tables": [],
      "related": [
        "7000218",
        "7000215",
        "7000222",
        "700016"
      ],
      "status": "draft",
      "verification": "documentation",
      "inMicrosoftReference": false,
      "updated": "2026-10-30",
      "url": "https://brambrinkmeier.com/entra/aadsts/5002730/"
    },
    {
      "code": "7000014",
      "name": "",
      "category": "token",
      "kind": "failure",
      "attackSignal": "low",
      "mitre": [],
      "tables": [],
      "related": [
        "9002313",
        "700016"
      ],
      "status": "draft",
      "verification": "lab-reproduced",
      "labReproduced": "2026-10-30",
      "inMicrosoftReference": false,
      "updated": "2026-10-30",
      "url": "https://brambrinkmeier.com/entra/aadsts/7000014/"
    },
    {
      "code": "7000110",
      "name": "",
      "category": "token",
      "kind": "config",
      "attackSignal": "low",
      "mitre": [],
      "tables": [],
      "related": [
        "700016",
        "70008",
        "700082",
        "7000215"
      ],
      "status": "draft",
      "verification": "documentation",
      "inMicrosoftReference": false,
      "updated": "2026-10-30",
      "url": "https://brambrinkmeier.com/entra/aadsts/7000110/"
    },
    {
      "code": "7000112",
      "name": "UnauthorizedClientApplicationDisabled",
      "category": "app-config",
      "kind": "config",
      "attackSignal": "low",
      "mitre": [],
      "tables": [],
      "related": [
        "700016",
        "500011",
        "65001",
        "7000215"
      ],
      "status": "draft",
      "verification": "lab-reproduced",
      "labReproduced": "2026-10-30",
      "logCaptured": "2026-10-31",
      "inMicrosoftReference": true,
      "updated": "2026-10-30",
      "url": "https://brambrinkmeier.com/entra/aadsts/7000112/"
    },
    {
      "code": "7000215",
      "name": "Invalid client secret",
      "category": "app-config",
      "kind": "failure",
      "attackSignal": "medium",
      "mitre": [
        "T1078.004"
      ],
      "tables": [
        "AADServicePrincipalSignInLogs"
      ],
      "related": [
        "7000222",
        "700016",
        "500011",
        "65001"
      ],
      "status": "draft",
      "verification": "lab-reproduced",
      "labReproduced": "2026-10-30",
      "inMicrosoftReference": true,
      "updated": "2026-10-30",
      "url": "https://brambrinkmeier.com/entra/aadsts/7000215/"
    },
    {
      "code": "7000216",
      "name": "",
      "category": "app-config",
      "kind": "failure",
      "attackSignal": "low",
      "mitre": [],
      "tables": [
        "AADServicePrincipalSignInLogs"
      ],
      "related": [
        "7000218",
        "7000215",
        "7000222",
        "700016"
      ],
      "status": "draft",
      "verification": "lab-reproduced",
      "labReproduced": "2026-10-30",
      "inMicrosoftReference": false,
      "updated": "2026-10-30",
      "url": "https://brambrinkmeier.com/entra/aadsts/7000216/"
    },
    {
      "code": "7000218",
      "name": "",
      "category": "app-config",
      "kind": "failure",
      "attackSignal": "low",
      "mitre": [],
      "tables": [],
      "related": [
        "7000215",
        "7000222",
        "700016",
        "500011"
      ],
      "status": "draft",
      "verification": "lab-reproduced",
      "labReproduced": "2026-10-30",
      "logCaptured": "2026-10-31",
      "inMicrosoftReference": true,
      "updated": "2026-10-30",
      "url": "https://brambrinkmeier.com/entra/aadsts/7000218/"
    },
    {
      "code": "7000222",
      "name": "InvalidClientSecretExpiredKeysProvided",
      "category": "app-config",
      "kind": "failure",
      "attackSignal": "low",
      "mitre": [],
      "tables": [
        "AADServicePrincipalSignInLogs"
      ],
      "related": [
        "7000215",
        "700016",
        "500011"
      ],
      "status": "draft",
      "verification": "documentation",
      "inMicrosoftReference": true,
      "updated": "2026-10-24",
      "url": "https://brambrinkmeier.com/entra/aadsts/7000222/"
    },
    {
      "code": "7002121",
      "name": "",
      "category": "app-config",
      "kind": "config",
      "attackSignal": "low",
      "mitre": [],
      "tables": [
        "AADServicePrincipalSignInLogs"
      ],
      "related": [
        "700212",
        "700211",
        "700213",
        "7002138",
        "70025"
      ],
      "status": "draft",
      "verification": "lab-reproduced",
      "labReproduced": "2026-10-30",
      "inMicrosoftReference": false,
      "updated": "2026-10-30",
      "url": "https://brambrinkmeier.com/entra/aadsts/7002121/"
    },
    {
      "code": "7002138",
      "name": "",
      "category": "app-config",
      "kind": "config",
      "attackSignal": "low",
      "mitre": [],
      "tables": [],
      "related": [
        "700213",
        "70021",
        "700211",
        "700212",
        "70025"
      ],
      "status": "draft",
      "verification": "lab-reproduced",
      "labReproduced": "2026-10-30",
      "inMicrosoftReference": false,
      "updated": "2026-10-30",
      "url": "https://brambrinkmeier.com/entra/aadsts/7002138/"
    },
    {
      "code": "9002313",
      "name": "InvalidRequest",
      "category": "app-config",
      "kind": "failure",
      "attackSignal": "low",
      "mitre": [],
      "tables": [],
      "related": [
        "50011",
        "7000215",
        "500011",
        "700016"
      ],
      "status": "draft",
      "verification": "documentation",
      "inMicrosoftReference": true,
      "updated": "2026-10-30",
      "url": "https://brambrinkmeier.com/entra/aadsts/9002313/"
    },
    {
      "code": "9002326",
      "name": "",
      "category": "app-config",
      "kind": "config",
      "attackSignal": "low",
      "mitre": [],
      "tables": [],
      "related": [
        "7000218",
        "7000215",
        "700016",
        "9002313"
      ],
      "status": "draft",
      "verification": "lab-reproduced",
      "labReproduced": "2026-10-30",
      "logCaptured": "2026-10-30",
      "kqlTested": "2026-10-30",
      "inMicrosoftReference": false,
      "updated": "2026-10-30",
      "url": "https://brambrinkmeier.com/entra/aadsts/9002326/"
    },
    {
      "code": "9002327",
      "name": "",
      "category": "app-config",
      "kind": "config",
      "attackSignal": "low",
      "mitre": [],
      "tables": [],
      "related": [
        "9002326",
        "700054",
        "9002313",
        "7000218"
      ],
      "status": "draft",
      "verification": "documentation",
      "inMicrosoftReference": false,
      "updated": "2026-10-30",
      "url": "https://brambrinkmeier.com/entra/aadsts/9002327/"
    },
    {
      "code": "9002331",
      "name": "",
      "category": "app-config",
      "kind": "config",
      "attackSignal": "low",
      "mitre": [],
      "tables": [],
      "related": [
        "50020",
        "700016",
        "90002",
        "9002313"
      ],
      "status": "draft",
      "verification": "documentation",
      "inMicrosoftReference": false,
      "updated": "2026-10-30",
      "url": "https://brambrinkmeier.com/entra/aadsts/9002331/"
    },
    {
      "code": "9002341",
      "name": "",
      "category": "consent",
      "kind": "interrupt",
      "attackSignal": "low",
      "mitre": [],
      "tables": [
        "SigninLogs",
        "AADNonInteractiveUserSignInLogs"
      ],
      "related": [
        "65001",
        "50058"
      ],
      "status": "draft",
      "verification": "documentation",
      "inMicrosoftReference": true,
      "updated": "2026-10-30",
      "url": "https://brambrinkmeier.com/entra/aadsts/9002341/"
    },
    {
      "code": "9002346",
      "name": "",
      "category": "app-config",
      "kind": "config",
      "attackSignal": "low",
      "mitre": [],
      "tables": [],
      "related": [
        "9002331",
        "50020",
        "700016",
        "90002"
      ],
      "status": "draft",
      "verification": "lab-reproduced",
      "labReproduced": "2026-10-30",
      "logCaptured": "2026-10-31",
      "inMicrosoftReference": false,
      "updated": "2026-10-30",
      "url": "https://brambrinkmeier.com/entra/aadsts/9002346/"
    },
    {
      "code": "9010010",
      "name": "",
      "category": "app-config",
      "kind": "config",
      "attackSignal": "low",
      "mitre": [],
      "tables": [],
      "related": [
        "500011",
        "9002313",
        "700016"
      ],
      "status": "draft",
      "verification": "lab-reproduced",
      "labReproduced": "2026-10-30",
      "logCaptured": "2026-10-30",
      "kqlTested": "2026-10-30",
      "inMicrosoftReference": false,
      "updated": "2026-10-30",
      "url": "https://brambrinkmeier.com/entra/aadsts/9010010/"
    }
  ]
}