{
  "schemaVersion": "1.0",
  "code": "500341",
  "name": null,
  "title": "AADSTS500341: User account has been deleted from the directory (fix)",
  "url": "https://brambrinkmeier.com/entra/aadsts/500341/",
  "alternates": {
    "markdown": "https://brambrinkmeier.com/entra/aadsts/500341.md",
    "json": "https://brambrinkmeier.com/api/aadsts/500341.json",
    "html": "https://brambrinkmeier.com/entra/aadsts/500341/"
  },
  "description": "AADSTS500341: the signing-in account was deleted from the tenant. Not in Microsoft's reference. Restore it within 30 days or reconnect. KQL included.",
  "summary": "AADSTS500341 means the account signing in has been deleted from the Microsoft Entra tenant. Microsoft's error reference doesn't list it; a Microsoft Viva Goals page does. Something still uses the old account: a saved sign-in, a connection or a script. Restore the user within 30 days if the deletion was a mistake, otherwise reconnect with an active account.",
  "inMicrosoftReference": false,
  "unlistedChecked": "2026-10-30",
  "meaningText": "Microsoft's [error code reference](https://learn.microsoft.com/entra/identity-platform/reference-error-codes) doesn't list AADSTS500341 (checked 30 October 2026).\n\nMicrosoft documents it on a [Viva Goals page about Microsoft Entra errors](https://learn.microsoft.com/en-gb/viva/goals/integration-aad-errors), which gives the message as:\n\n> AADSTS500341: The user account <account ID> has been deleted from the <AAD> directory. To sign into this application, the account must be added to the directory\n\nIts resolution: *\"The user account with which this connection was first created is no longer in an active state. Try creating a new connection.\"*\n\nThe same page lists [50034](https://brambrinkmeier.com/entra/aadsts/50034/) as *\"The user account <account ID> doesn't exist in the <AAD> directory.\"* So the two codes say different things: 50034 is a name that doesn't exist, 500341 an account that existed and was deleted.\n\nMicrosoft's page on restoring users explains the deleted state: *\"After you delete a user, the account remains in a suspended state for 30 days. During that 30-day window, the user account can be restored, along with all its properties.\"* After that, *\"the permanent deletion process automatically starts and can't be stopped.\"* Microsoft doesn't say whether 500341 is returned only during those 30 days or also after permanent deletion.\n\nWe tried to reproduce it in the lab three times on 30 October 2026 and never got 500341. What we got instead is worth knowing:\n\n| Time between deleting the user and signing in | Result |\n|---|---|\n| About 30 seconds | [65001](https://brambrinkmeier.com/entra/aadsts/65001/), consent not granted: the same answer an active user got in that run |\n| About 30 seconds, with consent already granted | **A token was issued.** The sign-in succeeded for a user that no longer existed |\n| About 12 minutes | [50034](https://brambrinkmeier.com/entra/aadsts/50034/), the user account does not exist |\n\nThe middle row is the one to take away: a deleted account can still sign in successfully for a short window after deletion. That is a reason to revoke sessions and disable the account before you delete it, rather than relying on the delete alone.\n\nNone of the three runs produced 500341, so on this tenant a deleted user ends up at 50034 instead. Microsoft's Viva Goals page gives both codes the same resolution, and we can't tell from here which conditions produce which. The lab tenant's exported sign-in log shows the first attempt in `SigninLogs` under the deleted user's name, as 65001 with status Interrupted.",
  "sections": [
    {
      "heading": "What does AADSTS500341 mean?",
      "text": "Microsoft's [error code reference](https://learn.microsoft.com/entra/identity-platform/reference-error-codes) doesn't list AADSTS500341 (checked 30 October 2026).\n\nMicrosoft documents it on a [Viva Goals page about Microsoft Entra errors](https://learn.microsoft.com/en-gb/viva/goals/integration-aad-errors), which gives the message as:\n\n> AADSTS500341: The user account <account ID> has been deleted from the <AAD> directory. To sign into this application, the account must be added to the directory\n\nIts resolution: *\"The user account with which this connection was first created is no longer in an active state. Try creating a new connection.\"*\n\nThe same page lists [50034](https://brambrinkmeier.com/entra/aadsts/50034/) as *\"The user account <account ID> doesn't exist in the <AAD> directory.\"* So the two codes say different things: 50034 is a name that doesn't exist, 500341 an account that existed and was deleted.\n\nMicrosoft's page on restoring users explains the deleted state: *\"After you delete a user, the account remains in a suspended state for 30 days. During that 30-day window, the user account can be restored, along with all its properties.\"* After that, *\"the permanent deletion process automatically starts and can't be stopped.\"* Microsoft doesn't say whether 500341 is returned only during those 30 days or also after permanent deletion.\n\nWe tried to reproduce it in the lab three times on 30 October 2026 and never got 500341. What we got instead is worth knowing:\n\n| Time between deleting the user and signing in | Result |\n|---|---|\n| About 30 seconds | [65001](https://brambrinkmeier.com/entra/aadsts/65001/), consent not granted: the same answer an active user got in that run |\n| About 30 seconds, with consent already granted | **A token was issued.** The sign-in succeeded for a user that no longer existed |\n| About 12 minutes | [50034](https://brambrinkmeier.com/entra/aadsts/50034/), the user account does not exist |\n\nThe middle row is the one to take away: a deleted account can still sign in successfully for a short window after deletion. That is a reason to revoke sessions and disable the account before you delete it, rather than relying on the delete alone.\n\nNone of the three runs produced 500341, so on this tenant a deleted user ends up at 50034 instead. Microsoft's Viva Goals page gives both codes the same resolution, and we can't tell from here which conditions produce which. The lab tenant's exported sign-in log shows the first attempt in `SigninLogs` under the deleted user's name, as 65001 with status Interrupted."
    },
    {
      "heading": "Is it an attack?",
      "text": "Usually not. It means something still uses an account you deleted.\n\n| Pattern | Likely meaning |\n|---|---|\n| A connection or integration stops working after an offboarding | It was set up with the deleted user's account, as Microsoft's Viva Goals page describes. Reconnect it with an active account. |\n| One device or app keeps failing for a departed employee | A saved sign-in or a mail profile on a device that wasn't wiped. Benign, but find the device. |\n| A user deleted by mistake who suddenly can't sign in | Restore them within 30 days. |\n| Attempts on a deleted account from IP addresses the person never used | Someone else has the old credentials. The sign-in fails, but check where else those credentials work, for example other accounts with the same password. Our interpretation, not a documented pattern. |"
    },
    {
      "heading": "How do I find it in my logs (KQL)?",
      "text": "Microsoft doesn't document which sign-in table 500341 is logged in. Check where it lands:\n\n```kusto\nunion withsource=SourceTable SigninLogs, AADNonInteractiveUserSignInLogs, AADServicePrincipalSignInLogs\n| where TimeGenerated > ago(30d)\n| where ResultType == \"500341\"\n| summarize Rows = count() by SourceTable\n```\n\nWhich deleted accounts are still being used, from where and by what:\n\n```kusto\nunion SigninLogs, AADNonInteractiveUserSignInLogs\n| where TimeGenerated > ago(30d)\n| where ResultType == \"500341\"\n| summarize Attempts = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated),\n            IPs = make_set(IPAddress, 10), Apps = make_set(AppDisplayName, 10), Agents = make_set(UserAgent, 5)\n          by UserPrincipalName, UserId\n| sort by Attempts desc\n```\n\nSign-ins for an account after it was deleted, whatever the result. `Delete user` is an activity name in Microsoft's audit activity list. This joins on the object ID; whether `UserId` is still filled for a deleted account is our assumption, not checked:\n\n```kusto\nlet deletions =\n    AuditLogs\n    | where TimeGenerated > ago(30d)\n    | where ActivityDisplayName == \"Delete user\"\n    | extend UserId = tostring(TargetResources[0].id),\n             DeletedBy = coalesce(tostring(InitiatedBy.user.userPrincipalName), tostring(InitiatedBy.app.displayName))\n    | project DeletedAt = TimeGenerated, UserId, DeletedBy;\nunion SigninLogs, AADNonInteractiveUserSignInLogs\n| where TimeGenerated > ago(30d)\n| join kind=inner deletions on UserId\n| where TimeGenerated > DeletedAt\n| summarize Attempts = count(), Results = make_set(ResultType, 10), LastSeen = max(TimeGenerated)\n          by UserPrincipalName, UserId, DeletedAt, DeletedBy\n| sort by LastSeen desc\n```\n\nA `\"0\"` in `Results` means a sign-in succeeded after the deletion was logged. The lab run above didn't show that: it got 65001, not a success. Look at how long after `DeletedAt` it happened before treating it as a problem."
    },
    {
      "heading": "How do I fix AADSTS500341?",
      "text": "**For the user:** your account was removed from the organization. Ask its IT team whether that was intended. If you moved to a new account, sign out of the app and sign in with the new one.\n\n**For developers:** treat 500341 as \"this account is gone\". Clear the cached account and send the user through an interactive sign-in instead of retrying the same account.\n\n**For admins:**\n1. Deleted by mistake: restore the user within 30 days. In the Microsoft Entra admin center, as at least a User Administrator, go to **Entra ID** > **Users** > **Deleted users**. Microsoft says restoring brings back the account's properties and the licenses it had.\n2. For a synced user, Microsoft warns that *\"if the user still exists in your on-premises directory, the sync engine may restore the user during the next synchronization cycle.\"* Fix the source object first if the deletion was intended.\n3. Deleted on purpose: find what still uses the account with the second query, and reconnect each integration with an active account, as the Viva Goals page says.\n4. Unknown IP addresses on a deleted account: treat the old password as known to someone else. If the same person has another account, reset its password and revoke its sessions."
    }
  ],
  "microsoftWording": {
    "text": "AADSTS500341: The user account <account ID> has been deleted from the <AAD> directory. To sign into this application, the account must be added to the directory",
    "source": "Quoted on the page from the lab or from user reports; the code is not in Microsoft's error code reference",
    "sourceUrl": null
  },
  "securityReading": {
    "category": {
      "id": "credentials",
      "label": "Credentials and lockout"
    },
    "kind": {
      "id": "failure",
      "label": "Failure"
    },
    "attackSignal": {
      "level": "low",
      "label": "Low: usually configuration or user error"
    },
    "mitre": [],
    "tables": [],
    "isItAnAttack": "Usually not. It means something still uses an account you deleted.\n\n| Pattern | Likely meaning |\n|---|---|\n| A connection or integration stops working after an offboarding | It was set up with the deleted user's account, as Microsoft's Viva Goals page describes. Reconnect it with an active account. |\n| One device or app keeps failing for a departed employee | A saved sign-in or a mail profile on a device that wasn't wiped. Benign, but find the device. |\n| A user deleted by mistake who suddenly can't sign in | Restore them within 30 days. |\n| Attempts on a deleted account from IP addresses the person never used | Someone else has the old credentials. The sign-in fails, but check where else those credentials work, for example other accounts with the same password. Our interpretation, not a documented pattern. |",
    "conditionalAccess": null
  },
  "kql": [
    {
      "title": null,
      "leadIn": "Microsoft doesn't document which sign-in table 500341 is logged in. Check where it lands:",
      "query": "union withsource=SourceTable SigninLogs, AADNonInteractiveUserSignInLogs, AADServicePrincipalSignInLogs\n| where TimeGenerated > ago(30d)\n| where ResultType == \"500341\"\n| summarize Rows = count() by SourceTable"
    },
    {
      "title": null,
      "leadIn": "Which deleted accounts are still being used, from where and by what:",
      "query": "union SigninLogs, AADNonInteractiveUserSignInLogs\n| where TimeGenerated > ago(30d)\n| where ResultType == \"500341\"\n| summarize Attempts = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated),\n            IPs = make_set(IPAddress, 10), Apps = make_set(AppDisplayName, 10), Agents = make_set(UserAgent, 5)\n          by UserPrincipalName, UserId\n| sort by Attempts desc"
    },
    {
      "title": null,
      "leadIn": "Sign-ins for an account after it was deleted, whatever the result. `Delete user` is an activity name in Microsoft's audit activity list. This joins on the object ID; whether `UserId` is still filled for a deleted account is our assumption, not checked:",
      "query": "let deletions =\n    AuditLogs\n    | where TimeGenerated > ago(30d)\n    | where ActivityDisplayName == \"Delete user\"\n    | extend UserId = tostring(TargetResources[0].id),\n             DeletedBy = coalesce(tostring(InitiatedBy.user.userPrincipalName), tostring(InitiatedBy.app.displayName))\n    | project DeletedAt = TimeGenerated, UserId, DeletedBy;\nunion SigninLogs, AADNonInteractiveUserSignInLogs\n| where TimeGenerated > ago(30d)\n| join kind=inner deletions on UserId\n| where TimeGenerated > DeletedAt\n| summarize Attempts = count(), Results = make_set(ResultType, 10), LastSeen = max(TimeGenerated)\n          by UserPrincipalName, UserId, DeletedAt, DeletedBy\n| sort by LastSeen desc"
    }
  ],
  "kqlSectionText": "Microsoft doesn't document which sign-in table 500341 is logged in. Check where it lands:\n\n```kusto\nunion withsource=SourceTable SigninLogs, AADNonInteractiveUserSignInLogs, AADServicePrincipalSignInLogs\n| where TimeGenerated > ago(30d)\n| where ResultType == \"500341\"\n| summarize Rows = count() by SourceTable\n```\n\nWhich deleted accounts are still being used, from where and by what:\n\n```kusto\nunion SigninLogs, AADNonInteractiveUserSignInLogs\n| where TimeGenerated > ago(30d)\n| where ResultType == \"500341\"\n| summarize Attempts = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated),\n            IPs = make_set(IPAddress, 10), Apps = make_set(AppDisplayName, 10), Agents = make_set(UserAgent, 5)\n          by UserPrincipalName, UserId\n| sort by Attempts desc\n```\n\nSign-ins for an account after it was deleted, whatever the result. `Delete user` is an activity name in Microsoft's audit activity list. This joins on the object ID; whether `UserId` is still filled for a deleted account is our assumption, not checked:\n\n```kusto\nlet deletions =\n    AuditLogs\n    | where TimeGenerated > ago(30d)\n    | where ActivityDisplayName == \"Delete user\"\n    | extend UserId = tostring(TargetResources[0].id),\n             DeletedBy = coalesce(tostring(InitiatedBy.user.userPrincipalName), tostring(InitiatedBy.app.displayName))\n    | project DeletedAt = TimeGenerated, UserId, DeletedBy;\nunion SigninLogs, AADNonInteractiveUserSignInLogs\n| where TimeGenerated > ago(30d)\n| join kind=inner deletions on UserId\n| where TimeGenerated > DeletedAt\n| summarize Attempts = count(), Results = make_set(ResultType, 10), LastSeen = max(TimeGenerated)\n          by UserPrincipalName, UserId, DeletedAt, DeletedBy\n| sort by LastSeen desc\n```\n\nA `\"0\"` in `Results` means a sign-in succeeded after the deletion was logged. The lab run above didn't show that: it got 65001, not a success. Look at how long after `DeletedAt` it happened before treating it as a problem.",
  "fix": {
    "short": "Admin: if the deletion was a mistake, restore the user within 30 days (Entra ID > Users > Deleted users). If it was intended, reconnect each integration that still uses the account with an active account. User: ask IT whether the removal was intended, or sign in with your new account.",
    "steps": "**For the user:** your account was removed from the organization. Ask its IT team whether that was intended. If you moved to a new account, sign out of the app and sign in with the new one.\n\n**For developers:** treat 500341 as \"this account is gone\". Clear the cached account and send the user through an interactive sign-in instead of retrying the same account.\n\n**For admins:**\n1. Deleted by mistake: restore the user within 30 days. In the Microsoft Entra admin center, as at least a User Administrator, go to **Entra ID** > **Users** > **Deleted users**. Microsoft says restoring brings back the account's properties and the licenses it had.\n2. For a synced user, Microsoft warns that *\"if the user still exists in your on-premises directory, the sync engine may restore the user during the next synchronization cycle.\"* Fix the source object first if the deletion was intended.\n3. Deleted on purpose: find what still uses the account with the second query, and reconnect each integration with an active account, as the Viva Goals page says.\n4. Unknown IP addresses on a deleted account: treat the old password as known to someone else. If the same person has another account, reset its password and revoke its sessions."
  },
  "labReproduced": null,
  "labSectionText": null,
  "labRuns": [
    {
      "date": "2026-10-30",
      "run": "round 4",
      "method": "token-endpoint requests against a lab tenant",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/67",
      "scenario": "Deleted user signs in",
      "expected": "500341 / 50034",
      "got": "65001",
      "matchedExpectation": false,
      "message": "AADSTS65001: The user or administrator has not consented to use the application with ID '{app-id}' named 'lab-signin-client'. Send a"
    },
    {
      "date": "2026-10-30",
      "run": "round 4",
      "method": "token-endpoint requests against a lab tenant",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/67",
      "scenario": "Deleted user signs in, about 12 minutes after deletion",
      "expected": "500341 / 50034",
      "got": "50034",
      "matchedExpectation": true,
      "message": "AADSTS50034: The user account {EUII Hidden} does not exist in the {tenant-id} directory. To sign into this application, the account mus"
    },
    {
      "date": "2026-10-30",
      "run": "round 5",
      "method": "token-endpoint requests against a lab tenant, using lab-created test apps",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/69",
      "scenario": "Deleted user signs in",
      "expected": "500341 / 50034",
      "got": "success",
      "matchedExpectation": false,
      "message": ""
    },
    {
      "date": "2026-10-30",
      "run": "round 5",
      "method": "token-endpoint requests against a lab tenant, using lab-created test apps",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/69",
      "scenario": "Deleted user signs in, about 12 minutes after deletion",
      "expected": "500341 / 50034",
      "got": "50034",
      "matchedExpectation": true,
      "message": "AADSTS50034: The user account {EUII Hidden} does not exist in the {tenant-id} directory. To sign into this application, the account mus"
    },
    {
      "date": "2026-10-30",
      "run": "round 5 (first attempt)",
      "method": "token-endpoint requests against a lab tenant",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/68",
      "scenario": "Deleted user signs in",
      "expected": "500341 / 50034",
      "got": "success",
      "matchedExpectation": false,
      "message": ""
    },
    {
      "date": "2026-10-30",
      "run": "round 5 (first attempt)",
      "method": "token-endpoint requests against a lab tenant",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/68",
      "scenario": "Deleted user signs in, about 12 minutes after deletion",
      "expected": "500341 / 50034",
      "got": "50034",
      "matchedExpectation": true,
      "message": "AADSTS50034: The user account {EUII Hidden} does not exist in the {tenant-id} directory. To sign into this application, the account mus"
    },
    {
      "date": "2026-10-30",
      "run": "round 6",
      "method": "token-endpoint requests against a lab tenant, using lab-created test apps",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/70",
      "scenario": "Deleted user signs in",
      "expected": "500341 / 50034",
      "got": "success",
      "matchedExpectation": false,
      "message": ""
    },
    {
      "date": "2026-10-30",
      "run": "round 6",
      "method": "token-endpoint requests against a lab tenant, using lab-created test apps",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/70",
      "scenario": "Deleted user signs in, about 12 minutes after deletion",
      "expected": "500341 / 50034",
      "got": "50034",
      "matchedExpectation": true,
      "message": "AADSTS50034: The user account {EUII Hidden} does not exist in the {tenant-id} directory. To sign into this application, the account mus"
    },
    {
      "date": "2026-10-30",
      "run": "round 7",
      "method": "token-endpoint requests against a lab tenant",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/71",
      "scenario": "Deleted user signs in",
      "expected": "500341 / 50034",
      "got": "success",
      "matchedExpectation": false,
      "message": ""
    },
    {
      "date": "2026-10-30",
      "run": "round 7",
      "method": "token-endpoint requests against a lab tenant",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/71",
      "scenario": "Deleted user signs in, about 12 minutes after deletion",
      "expected": "500341 / 50034",
      "got": "50034",
      "matchedExpectation": true,
      "message": "AADSTS50034: The user account {EUII Hidden} does not exist in the {tenant-id} directory. To sign into this application, the account mus"
    },
    {
      "date": "2026-10-30",
      "run": null,
      "method": "ROPC and other token-endpoint requests against a lab tenant",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/66",
      "scenario": "Deleted user signs in",
      "expected": "500341 / 50034",
      "got": "65001",
      "matchedExpectation": false,
      "message": "AADSTS65001: The user or administrator has not consented to use the application with ID '{app-id}' named 'lab-signin-client'. Send a"
    },
    {
      "date": "2026-10-31",
      "run": "round 8",
      "method": "token-endpoint and device-code requests against a lab tenant",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/72",
      "scenario": "Deleted user signs in",
      "expected": "500341 / 50034",
      "got": "success",
      "matchedExpectation": false,
      "message": ""
    },
    {
      "date": "2026-10-31",
      "run": "round 8",
      "method": "token-endpoint and device-code requests against a lab tenant",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/72",
      "scenario": "Deleted user signs in, about 12 minutes after deletion",
      "expected": "500341 / 50034",
      "got": "50034",
      "matchedExpectation": true,
      "message": "AADSTS50034: The user account {EUII Hidden} does not exist in the {tenant-id} directory. To sign into this application, the account mus"
    },
    {
      "date": "2026-10-31",
      "run": "round 9",
      "method": "token-endpoint and device-code requests against a lab tenant",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/73",
      "scenario": "Deleted user signs in",
      "expected": "500341 / 50034",
      "got": "success",
      "matchedExpectation": false,
      "message": ""
    },
    {
      "date": "2026-10-31",
      "run": "round 9",
      "method": "token-endpoint and device-code requests against a lab tenant",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/73",
      "scenario": "Deleted user signs in, about 12 minutes after deletion",
      "expected": "500341 / 50034",
      "got": "50034",
      "matchedExpectation": true,
      "message": "AADSTS50034: The user account {EUII Hidden} does not exist in the {tenant-id} directory. To sign into this application, the account mus"
    }
  ],
  "verification": "documentation",
  "related": [
    "50034",
    "50057",
    "50173",
    "65001"
  ],
  "coveredBy": [],
  "sources": [
    {
      "title": "Microsoft Entra authentication and authorization error codes",
      "url": "https://learn.microsoft.com/en-us/entra/identity-platform/reference-error-codes"
    },
    {
      "title": "Microsoft Entra ID errors (Viva Goals integrations)",
      "url": "https://learn.microsoft.com/en-gb/viva/goals/integration-aad-errors"
    },
    {
      "title": "Restore or remove a recently deleted user",
      "url": "https://learn.microsoft.com/entra/fundamentals/users-restore"
    },
    {
      "title": "Microsoft Entra audit log categories and activities",
      "url": "https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities"
    },
    {
      "title": "SigninLogs table reference (Azure Monitor)",
      "url": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/signinlogs"
    }
  ],
  "published": "2026-10-30",
  "lastUpdated": "2026-10-30",
  "lastVerified": null,
  "license": "CC BY 4.0",
  "licenseUrl": "https://creativecommons.org/licenses/by/4.0/",
  "licenseNote": "CC BY 4.0 covers the author's own text and classification fields. Quoted Microsoft error wording belongs to Microsoft, is quoted with its source and can change.",
  "attribution": "Bram Brinkmeier, \"AADSTS500341: User account has been deleted from the directory (fix)\", https://brambrinkmeier.com/entra/aadsts/500341/ (CC BY 4.0)",
  "microsoftErrorLookup": "https://login.microsoftonline.com/error?code=500341"
}