{
  "schemaVersion": "1.0",
  "code": "5000611",
  "name": null,
  "title": "AADSTS5000611: Key Derivation Function version 1 is invalid (fix)",
  "url": "https://brambrinkmeier.com/entra/aadsts/5000611/",
  "alternates": {
    "markdown": "https://brambrinkmeier.com/entra/aadsts/5000611.md",
    "json": "https://brambrinkmeier.com/api/aadsts/5000611.json",
    "html": "https://brambrinkmeier.com/entra/aadsts/5000611/"
  },
  "description": "AADSTS5000611: an unpatched Windows device used the retired KDFv1 algorithm. Not in Microsoft's reference. Which devices, the fix, and KQL to find them.",
  "summary": "AADSTS5000611 means a Windows device tried to authenticate with the retired KDFv1 algorithm, which Microsoft Entra ID now blocks because of CVE-2021-33781. Microsoft's error reference doesn't list it, but a Microsoft deprecation notice does. It hits joined and hybrid joined devices on Windows builds without the July 2021 fix. Low attack value; update the device.",
  "inMicrosoftReference": false,
  "unlistedChecked": "2026-10-30",
  "meaningText": "Microsoft's [error code reference](https://learn.microsoft.com/entra/identity-platform/reference-error-codes) doesn't list AADSTS5000611 (checked 30 October 2026).\n\nMicrosoft documents it in a deprecation notice for the Key Derivation Function version 1 (KDFv1) algorithm. The notice gives the sign-in log entry as:\n\n> Sign-in error code: 5000611\n> Failure reason: Symmetric Key Derivation Function version '1' is invalid. Update the device with the latest updates.\n\nMicrosoft's background, from the same notice:\n\n- KDFv1 was *\"used for the authentication of Microsoft Entra joined or Microsoft Entra hybrid joined devices in builds of Windows released before July 2021.\"*\n- A flaw that *\"allowed unauthorized authentication\"* is tracked as CVE-2021-33781. Microsoft fixed it in a Windows security update in July 2021, and *\"all Windows builds released after July 2021 no longer use the KDFv1 algorithm.\"*\n- Microsoft is *\"incrementally rolling out a security update that blocks the use of the KDFv1 algorithm.\"* *\"Unpatched Windows devices won't authenticate with Microsoft Entra once the rollout of this change completes.\"* *\"Early in the rollout retrying authentication will likely succeed.\"*\n\nThe notice gives no enforcement dates and no KB numbers.\n\nUsers quote the message with slightly different wording. On Microsoft Q&A, a user on Windows 10 who couldn't open Microsoft 365 mail or a company intranet site posted this message:\n\n> AADSTS5000611: Symmetric Key Derivation Function version 'KDFV1' is invalid. Update the device for the latest updates.\n\nThe version appears as `'KDFV1'` there and as `'1'` in Microsoft's notice. Match on the code, not on the text.",
  "sections": [
    {
      "heading": "What does AADSTS5000611 mean?",
      "text": "Microsoft's [error code reference](https://learn.microsoft.com/entra/identity-platform/reference-error-codes) doesn't list AADSTS5000611 (checked 30 October 2026).\n\nMicrosoft documents it in a deprecation notice for the Key Derivation Function version 1 (KDFv1) algorithm. The notice gives the sign-in log entry as:\n\n> Sign-in error code: 5000611\n> Failure reason: Symmetric Key Derivation Function version '1' is invalid. Update the device with the latest updates.\n\nMicrosoft's background, from the same notice:\n\n- KDFv1 was *\"used for the authentication of Microsoft Entra joined or Microsoft Entra hybrid joined devices in builds of Windows released before July 2021.\"*\n- A flaw that *\"allowed unauthorized authentication\"* is tracked as CVE-2021-33781. Microsoft fixed it in a Windows security update in July 2021, and *\"all Windows builds released after July 2021 no longer use the KDFv1 algorithm.\"*\n- Microsoft is *\"incrementally rolling out a security update that blocks the use of the KDFv1 algorithm.\"* *\"Unpatched Windows devices won't authenticate with Microsoft Entra once the rollout of this change completes.\"* *\"Early in the rollout retrying authentication will likely succeed.\"*\n\nThe notice gives no enforcement dates and no KB numbers.\n\nUsers quote the message with slightly different wording. On Microsoft Q&A, a user on Windows 10 who couldn't open Microsoft 365 mail or a company intranet site posted this message:\n\n> AADSTS5000611: Symmetric Key Derivation Function version 'KDFV1' is invalid. Update the device for the latest updates.\n\nThe version appears as `'KDFV1'` there and as `'1'` in Microsoft's notice. Match on the code, not on the text."
    },
    {
      "heading": "Is it an attack?",
      "text": "No. It is an outdated Windows device failing a check that protects against a known vulnerability. The block is the fix working.\n\n| Pattern | Likely meaning |\n|---|---|\n| 5000611 from a few Windows 10 devices | Devices missing security updates since mid-2021. Update them. |\n| 5000611 that sometimes succeeds on retry | Microsoft says retries likely succeed early in the rollout. Expect that to stop. |\n| 5000611 that persists after \"all updates are installed\" | Users report this on Windows 10 builds that couldn't move to a newer feature release. Check the build, not just the update status. |\n| 5000611 only in older Office apps | Users report it in Office 2016 and Outlook 2019, and report working around it by moving to Microsoft 365 apps. User reports only; Microsoft doesn't say this. |"
    },
    {
      "heading": "How do I find it in my logs (KQL)?",
      "text": "Microsoft says *\"this error message is also present in the Microsoft Entra sign-in logs\"*, but not in which table. Check where it lands:\n\n```kusto\nunion withsource=SourceTable SigninLogs, AADNonInteractiveUserSignInLogs, AADServicePrincipalSignInLogs\n| where TimeGenerated > ago(30d)\n| where ResultType == \"5000611\"\n| summarize Rows = count() by SourceTable\n```\n\nThe list of affected devices, which is what Microsoft's notice asks you to build. `DeviceDetail` is dynamic in `SigninLogs` and a string in `AADNonInteractiveUserSignInLogs`, so each leg parses it first. Property names come from the Graph `deviceDetail` resource; `operatingSystem` is documented as *\"the OS name and version used in the sign-in\"*:\n\n```kusto\nlet rows =\n    union\n        (SigninLogs | extend D = parse_json(tostring(DeviceDetail)) | project TimeGenerated, ResultType, UserPrincipalName, AppDisplayName, D),\n        (AADNonInteractiveUserSignInLogs | extend D = parse_json(DeviceDetail) | project TimeGenerated, ResultType, UserPrincipalName, AppDisplayName, D);\nrows\n| where TimeGenerated > ago(30d)\n| where ResultType == \"5000611\"\n| extend DeviceId = tostring(D.deviceId), DeviceName = tostring(D.displayName),\n         OS = tostring(D.operatingSystem), TrustType = tostring(D.trustType)\n| summarize Rows = count(), Users = make_set(UserPrincipalName, 10), Apps = make_set(AppDisplayName, 10),\n            LastSeen = max(TimeGenerated)\n          by DeviceId, DeviceName, OS, TrustType\n| sort by LastSeen desc\n```\n\nHand the `DeviceName` list to whoever runs patching. Our reading is that a device stops appearing here once it is updated; if it keeps appearing, the update didn't take."
    },
    {
      "heading": "How do I fix AADSTS5000611?",
      "text": "**For the user:** install all pending Windows updates, restart, and sign in again. If Windows can't install the updates (for example, not enough disk space), tell IT. Retrying may work for a while, but Microsoft says it will stop working.\n\n**For admins:**\n1. Build the device list with the second query.\n2. Update those devices. Microsoft: *\"All Windows devices that authenticate using Microsoft Entra must have the security patch applied or be running builds of Windows released after July 2021.\"*\n3. If a device stays on the list after updating, check its Windows build. In Q&A 5491800, installing the latest updates for an older Windows 10 build didn't help. A volunteer moderator suggested upgrading to 22H2; the thread doesn't confirm that it worked. Microsoft doesn't name a standalone patch.\n4. Microsoft also recommends looking for affected builds proactively, using the guidance in CVE-2021-33781, and setting automated update policies.\n5. If only an old Office version fails on an updated device, users report working around it by moving to Microsoft 365 apps. Treat that as a user report, not a documented fix."
    }
  ],
  "microsoftWording": {
    "text": "Sign-in error code: 5000611\nFailure reason: Symmetric Key Derivation Function version '1' is invalid. Update the device with the latest updates.",
    "source": "Quoted on the page from the lab or from user reports; the code is not in Microsoft's error code reference",
    "sourceUrl": null
  },
  "securityReading": {
    "category": {
      "id": "device",
      "label": "Devices"
    },
    "kind": {
      "id": "failure",
      "label": "Failure"
    },
    "attackSignal": {
      "level": "low",
      "label": "Low: usually configuration or user error"
    },
    "mitre": [],
    "tables": [],
    "isItAnAttack": "No. It is an outdated Windows device failing a check that protects against a known vulnerability. The block is the fix working.\n\n| Pattern | Likely meaning |\n|---|---|\n| 5000611 from a few Windows 10 devices | Devices missing security updates since mid-2021. Update them. |\n| 5000611 that sometimes succeeds on retry | Microsoft says retries likely succeed early in the rollout. Expect that to stop. |\n| 5000611 that persists after \"all updates are installed\" | Users report this on Windows 10 builds that couldn't move to a newer feature release. Check the build, not just the update status. |\n| 5000611 only in older Office apps | Users report it in Office 2016 and Outlook 2019, and report working around it by moving to Microsoft 365 apps. User reports only; Microsoft doesn't say this. |",
    "conditionalAccess": null
  },
  "kql": [
    {
      "title": null,
      "leadIn": "Microsoft says *\"this error message is also present in the Microsoft Entra sign-in logs\"*, but not in which table. Check where it lands:",
      "query": "union withsource=SourceTable SigninLogs, AADNonInteractiveUserSignInLogs, AADServicePrincipalSignInLogs\n| where TimeGenerated > ago(30d)\n| where ResultType == \"5000611\"\n| summarize Rows = count() by SourceTable"
    },
    {
      "title": null,
      "leadIn": "The list of affected devices, which is what Microsoft's notice asks you to build. `DeviceDetail` is dynamic in `SigninLogs` and a string in `AADNonInteractiveUserSignInLogs`, so each leg parses it first. Property names come from the Graph `deviceDetail` resource; `operatingSystem` is documented as *\"the OS name and version used in the sign-in\"*:",
      "query": "let rows =\n    union\n        (SigninLogs | extend D = parse_json(tostring(DeviceDetail)) | project TimeGenerated, ResultType, UserPrincipalName, AppDisplayName, D),\n        (AADNonInteractiveUserSignInLogs | extend D = parse_json(DeviceDetail) | project TimeGenerated, ResultType, UserPrincipalName, AppDisplayName, D);\nrows\n| where TimeGenerated > ago(30d)\n| where ResultType == \"5000611\"\n| extend DeviceId = tostring(D.deviceId), DeviceName = tostring(D.displayName),\n         OS = tostring(D.operatingSystem), TrustType = tostring(D.trustType)\n| summarize Rows = count(), Users = make_set(UserPrincipalName, 10), Apps = make_set(AppDisplayName, 10),\n            LastSeen = max(TimeGenerated)\n          by DeviceId, DeviceName, OS, TrustType\n| sort by LastSeen desc"
    }
  ],
  "kqlSectionText": "Microsoft says *\"this error message is also present in the Microsoft Entra sign-in logs\"*, but not in which table. Check where it lands:\n\n```kusto\nunion withsource=SourceTable SigninLogs, AADNonInteractiveUserSignInLogs, AADServicePrincipalSignInLogs\n| where TimeGenerated > ago(30d)\n| where ResultType == \"5000611\"\n| summarize Rows = count() by SourceTable\n```\n\nThe list of affected devices, which is what Microsoft's notice asks you to build. `DeviceDetail` is dynamic in `SigninLogs` and a string in `AADNonInteractiveUserSignInLogs`, so each leg parses it first. Property names come from the Graph `deviceDetail` resource; `operatingSystem` is documented as *\"the OS name and version used in the sign-in\"*:\n\n```kusto\nlet rows =\n    union\n        (SigninLogs | extend D = parse_json(tostring(DeviceDetail)) | project TimeGenerated, ResultType, UserPrincipalName, AppDisplayName, D),\n        (AADNonInteractiveUserSignInLogs | extend D = parse_json(DeviceDetail) | project TimeGenerated, ResultType, UserPrincipalName, AppDisplayName, D);\nrows\n| where TimeGenerated > ago(30d)\n| where ResultType == \"5000611\"\n| extend DeviceId = tostring(D.deviceId), DeviceName = tostring(D.displayName),\n         OS = tostring(D.operatingSystem), TrustType = tostring(D.trustType)\n| summarize Rows = count(), Users = make_set(UserPrincipalName, 10), Apps = make_set(AppDisplayName, 10),\n            LastSeen = max(TimeGenerated)\n          by DeviceId, DeviceName, OS, TrustType\n| sort by LastSeen desc\n```\n\nHand the `DeviceName` list to whoever runs patching. Our reading is that a device stops appearing here once it is updated; if it keeps appearing, the update didn't take.",
  "fix": {
    "short": "User: install all pending Windows updates, restart and sign in again; tell IT if updates won't install. Admin: find the affected devices with the second query and update them. If a device stays on the list after updating, check its Windows build; an older Windows 10 build may need a feature upgrade.",
    "steps": "**For the user:** install all pending Windows updates, restart, and sign in again. If Windows can't install the updates (for example, not enough disk space), tell IT. Retrying may work for a while, but Microsoft says it will stop working.\n\n**For admins:**\n1. Build the device list with the second query.\n2. Update those devices. Microsoft: *\"All Windows devices that authenticate using Microsoft Entra must have the security patch applied or be running builds of Windows released after July 2021.\"*\n3. If a device stays on the list after updating, check its Windows build. In Q&A 5491800, installing the latest updates for an older Windows 10 build didn't help. A volunteer moderator suggested upgrading to 22H2; the thread doesn't confirm that it worked. Microsoft doesn't name a standalone patch.\n4. Microsoft also recommends looking for affected builds proactively, using the guidance in CVE-2021-33781, and setting automated update policies.\n5. If only an old Office version fails on an updated device, users report working around it by moving to Microsoft 365 apps. Treat that as a user report, not a documented fix."
  },
  "labReproduced": null,
  "labSectionText": null,
  "labRuns": [],
  "verification": "documentation",
  "related": [
    "50097",
    "135011",
    "700003",
    "53000"
  ],
  "coveredBy": [],
  "sources": [
    {
      "title": "Microsoft Entra authentication and authorization error codes",
      "url": "https://learn.microsoft.com/en-us/entra/identity-platform/reference-error-codes"
    },
    {
      "title": "Deprecation of Key Derivation Function version 1 (Microsoft Entra devices)",
      "url": "https://learn.microsoft.com/en-us/entra/identity/devices/deprecation-key-derivation-function-version-1"
    },
    {
      "title": "Symmetric Key Derivation Function version 'KDFV1' is invalid (Microsoft Q&A 5491800)",
      "url": "https://learn.microsoft.com/en-us/answers/questions/5491800/symmetric-key-derivation-function-version-kdfv1-is"
    },
    {
      "title": "How to resolve AADSTS5000611 error while activating O365 (Microsoft Q&A 5522370)",
      "url": "https://learn.microsoft.com/en-us/answers/questions/5522370/how-to-resolve-aadsts5000611-error-while-activate"
    },
    {
      "title": "deviceDetail resource type (Microsoft Graph)",
      "url": "https://learn.microsoft.com/en-us/graph/api/resources/devicedetail"
    },
    {
      "title": "SigninLogs table reference (Azure Monitor)",
      "url": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/signinlogs"
    },
    {
      "title": "AADNonInteractiveUserSignInLogs table reference (Azure Monitor)",
      "url": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/AADNonInteractiveUserSignInLogs"
    }
  ],
  "published": "2026-10-30",
  "lastUpdated": "2026-10-30",
  "lastVerified": null,
  "license": "CC BY 4.0",
  "licenseUrl": "https://creativecommons.org/licenses/by/4.0/",
  "licenseNote": "CC BY 4.0 covers the author's own text and classification fields. Quoted Microsoft error wording belongs to Microsoft, is quoted with its source and can change.",
  "attribution": "Bram Brinkmeier, \"AADSTS5000611: Key Derivation Function version 1 is invalid (fix)\", https://brambrinkmeier.com/entra/aadsts/5000611/ (CC BY 4.0)",
  "microsoftErrorLookup": "https://login.microsoftonline.com/error?code=5000611"
}