{
  "schemaVersion": "1.0",
  "code": "50052",
  "name": "InvalidPasswordExceedsMaxLength",
  "title": "AADSTS50052: Password exceeds the maximum length (fix)",
  "url": "https://brambrinkmeier.com/entra/aadsts/50052/",
  "alternates": {
    "markdown": "https://brambrinkmeier.com/entra/aadsts/50052.md",
    "json": "https://brambrinkmeier.com/api/aadsts/50052.json",
    "html": "https://brambrinkmeier.com/entra/aadsts/50052/"
  },
  "description": "AADSTS50052: the password is longer than Entra's 256-character limit. Not in Microsoft's error list. What it means, KQL and the fix.",
  "summary": "AADSTS50052 means the password sent was longer than Entra's limit of 256 characters. Microsoft's error reference doesn't list it, but a Microsoft change notice from 2020 names it InvalidPasswordExceedsMaxLength. Usually a user with an old over-long password, or a tool that sends garbage. Low attack value. Reset the password to 256 characters or fewer.",
  "inMicrosoftReference": false,
  "unlistedChecked": "2026-10-30",
  "meaningText": "Microsoft's [error code reference](https://learn.microsoft.com/entra/identity-platform/reference-error-codes) doesn't list AADSTS50052 (checked 30 October 2026).\n\nThe lab reproduced it. A password-grant token request with a 300-character password returned:\n\n> AADSTS50052: The password entered exceeds the maximum length. Please reach out to your admin to reset the password.\n\nMicrosoft documents the code on another page. Its \"What's new for authentication?\" page has a March 2020 entry, **\"User passwords will be restricted to 256 characters\"**, effective 13 March 2020, for all endpoints and all user flows:\n\n> Users with passwords longer than 256 characters who sign in directly to Microsoft Entra ID (not a federated IDP, like AD FS) will be asked to change their passwords before they can sign in. Admins may receive requests to help reset the user's password.\n>\n> The error in the sign-in logs will be similar to *AADSTS 50052: InvalidPasswordExceedsMaxLength*.\n\nThat page gives the message as *\"The password entered exceeds the maximum length of 256. Please reach out to your admin to reset the password.\"* The lab got the same text without \"of 256\".\n\nThe limit itself is in Microsoft's password policy: *\"A minimum of 8 characters and a maximum of 256 characters.\"*",
  "sections": [
    {
      "heading": "What does AADSTS50052 mean?",
      "text": "Microsoft's [error code reference](https://learn.microsoft.com/entra/identity-platform/reference-error-codes) doesn't list AADSTS50052 (checked 30 October 2026).\n\nThe lab reproduced it. A password-grant token request with a 300-character password returned:\n\n> AADSTS50052: The password entered exceeds the maximum length. Please reach out to your admin to reset the password.\n\nMicrosoft documents the code on another page. Its \"What's new for authentication?\" page has a March 2020 entry, **\"User passwords will be restricted to 256 characters\"**, effective 13 March 2020, for all endpoints and all user flows:\n\n> Users with passwords longer than 256 characters who sign in directly to Microsoft Entra ID (not a federated IDP, like AD FS) will be asked to change their passwords before they can sign in. Admins may receive requests to help reset the user's password.\n>\n> The error in the sign-in logs will be similar to *AADSTS 50052: InvalidPasswordExceedsMaxLength*.\n\nThat page gives the message as *\"The password entered exceeds the maximum length of 256. Please reach out to your admin to reset the password.\"* The lab got the same text without \"of 256\".\n\nThe limit itself is in Microsoft's password policy: *\"A minimum of 8 characters and a maximum of 256 characters.\"*"
    },
    {
      "heading": "Reproduced in the lab",
      "text": "On 30 October 2026 an automated lab run sent a password-grant (ROPC) token request for a test user in my lab tenant, with a 300-character password. Entra returned `AADSTS50052` with the first line quoted above.\n\nThat confirms the code and the current wording at the token endpoint. Our reading: Entra checks the length before it checks the password. The current policy caps passwords at 256 characters, so a 300-character password can't match one set under it. It could only be wrong, yet the answer was the length error and not [AADSTS50126](https://brambrinkmeier.com/entra/aadsts/50126/). We did not test whether a user that doesn't exist gets 50052 too. It lands in **`SigninLogs`**: Status Failure, Conditional Access Not Applied. Entra's explanation on the row reads: *\"The user is unable to login because their password exceeds the permitted maximum length. They should contact their admin to reset the password. If SSPR is enabled for their tenant, they can reset their password by following the \"Forgot your password\" link.\"* The KQL below was run on these rows ([how](https://brambrinkmeier.com/methodology/)). The first two queries found the row. The third returned nothing as written, as expected for one attempt; with its threshold lowered to 1 it found it."
    },
    {
      "heading": "Is it an attack?",
      "text": "Usually not. A real person rarely types 257 characters.\n\n| Pattern | Likely meaning |\n|---|---|\n| One user, repeated, from their usual devices | A password set before the March 2020 limit, or a sign-in tool or password manager that sends too much. The user needs a reset. |\n| One app or service account, every attempt | A script or config sending the wrong value as the password, such as a token, a certificate or a whole file. |\n| Many users from one IP, mixed with 50126 | A spray or stuffing tool sending broken or over-long entries from a bad list. Look at the 50126 rows; those are the real attempts. |\n\nThe meanings in this table are our reading. Microsoft doesn't describe these patterns. A 50052 is a failed sign-in. No token is issued."
    },
    {
      "heading": "How do I find it in my logs (KQL)?",
      "text": "Microsoft's 2020 notice says the error shows in the sign-in logs, but doesn't say which table. Check where it lands in your workspace:\n\n```kusto\nunion withsource=SourceTable SigninLogs, AADNonInteractiveUserSignInLogs\n| where TimeGenerated > ago(30d)\n| where ResultType == \"50052\"\n| summarize Rows = count(), Users = dcount(UserPrincipalName) by SourceTable\n```\n\nWho hits it, from where, with which app:\n\n```kusto\nunion withsource=SourceTable SigninLogs, AADNonInteractiveUserSignInLogs\n| where TimeGenerated > ago(30d)\n| where ResultType == \"50052\"\n| summarize Attempts = count(),\n            LastSeen = max(TimeGenerated),\n            IPs = make_set(IPAddress, 10),\n            Apps = make_set(AppDisplayName, 5),\n            Clients = make_set(ClientAppUsed, 5)\n          by UserPrincipalName\n| sort by Attempts desc\n```\n\nIPs that produce 50052 for several users, with their other credential failures next to it. The threshold of 3 users is a starting point:\n\n```kusto\nSigninLogs\n| where TimeGenerated > ago(7d)\n| where ResultType in (\"50052\", \"50126\", \"50034\")\n| summarize Users = dcount(UserPrincipalName),\n            TooLong = countif(ResultType == \"50052\"),\n            WrongPassword = countif(ResultType == \"50126\"),\n            UnknownUser = countif(ResultType == \"50034\")\n          by IPAddress\n| where TooLong > 0 and Users >= 3\n| sort by Users desc\n```"
    },
    {
      "heading": "How do I fix AADSTS50052?",
      "text": "**For the user:** your password is longer than the 256 characters Entra allows. Ask your admin to reset it, or use \"Forgot your password\" if your organisation allows self-service reset. Microsoft's notice says: *\"If SSPR is enabled for their tenant, they can reset their password by following the \"Forgot your password\" link.\"* Pick a new password of 256 characters or fewer.\n\n**For developers:** check what your code sends in the `password` field. If it is longer than 256 characters, it is almost certainly not the password. Probably a secret, token or file read into the wrong variable, though we haven't confirmed that.\n\n**For admins:**\n1. Find the user with the queries above.\n2. Reset the password to one of 256 characters or fewer. Microsoft's policy allows 8 to 256 characters.\n3. If it is a service account used by a script, fix what the script sends, then look at why it uses a password grant at all."
    }
  ],
  "microsoftWording": {
    "text": "AADSTS50052: The password entered exceeds the maximum length. Please reach out to your admin to reset the password.",
    "source": "Quoted on the page from the lab or from user reports; the code is not in Microsoft's error code reference",
    "sourceUrl": null
  },
  "securityReading": {
    "category": {
      "id": "credentials",
      "label": "Credentials and lockout"
    },
    "kind": {
      "id": "failure",
      "label": "Failure"
    },
    "attackSignal": {
      "level": "low",
      "label": "Low: usually configuration or user error"
    },
    "mitre": [],
    "tables": [],
    "isItAnAttack": "Usually not. A real person rarely types 257 characters.\n\n| Pattern | Likely meaning |\n|---|---|\n| One user, repeated, from their usual devices | A password set before the March 2020 limit, or a sign-in tool or password manager that sends too much. The user needs a reset. |\n| One app or service account, every attempt | A script or config sending the wrong value as the password, such as a token, a certificate or a whole file. |\n| Many users from one IP, mixed with 50126 | A spray or stuffing tool sending broken or over-long entries from a bad list. Look at the 50126 rows; those are the real attempts. |\n\nThe meanings in this table are our reading. Microsoft doesn't describe these patterns. A 50052 is a failed sign-in. No token is issued.",
    "conditionalAccess": null
  },
  "kql": [
    {
      "title": null,
      "leadIn": "Microsoft's 2020 notice says the error shows in the sign-in logs, but doesn't say which table. Check where it lands in your workspace:",
      "query": "union withsource=SourceTable SigninLogs, AADNonInteractiveUserSignInLogs\n| where TimeGenerated > ago(30d)\n| where ResultType == \"50052\"\n| summarize Rows = count(), Users = dcount(UserPrincipalName) by SourceTable"
    },
    {
      "title": null,
      "leadIn": "Who hits it, from where, with which app:",
      "query": "union withsource=SourceTable SigninLogs, AADNonInteractiveUserSignInLogs\n| where TimeGenerated > ago(30d)\n| where ResultType == \"50052\"\n| summarize Attempts = count(),\n            LastSeen = max(TimeGenerated),\n            IPs = make_set(IPAddress, 10),\n            Apps = make_set(AppDisplayName, 5),\n            Clients = make_set(ClientAppUsed, 5)\n          by UserPrincipalName\n| sort by Attempts desc"
    },
    {
      "title": null,
      "leadIn": "IPs that produce 50052 for several users, with their other credential failures next to it. The threshold of 3 users is a starting point:",
      "query": "SigninLogs\n| where TimeGenerated > ago(7d)\n| where ResultType in (\"50052\", \"50126\", \"50034\")\n| summarize Users = dcount(UserPrincipalName),\n            TooLong = countif(ResultType == \"50052\"),\n            WrongPassword = countif(ResultType == \"50126\"),\n            UnknownUser = countif(ResultType == \"50034\")\n          by IPAddress\n| where TooLong > 0 and Users >= 3\n| sort by Users desc"
    }
  ],
  "kqlSectionText": "Microsoft's 2020 notice says the error shows in the sign-in logs, but doesn't say which table. Check where it lands in your workspace:\n\n```kusto\nunion withsource=SourceTable SigninLogs, AADNonInteractiveUserSignInLogs\n| where TimeGenerated > ago(30d)\n| where ResultType == \"50052\"\n| summarize Rows = count(), Users = dcount(UserPrincipalName) by SourceTable\n```\n\nWho hits it, from where, with which app:\n\n```kusto\nunion withsource=SourceTable SigninLogs, AADNonInteractiveUserSignInLogs\n| where TimeGenerated > ago(30d)\n| where ResultType == \"50052\"\n| summarize Attempts = count(),\n            LastSeen = max(TimeGenerated),\n            IPs = make_set(IPAddress, 10),\n            Apps = make_set(AppDisplayName, 5),\n            Clients = make_set(ClientAppUsed, 5)\n          by UserPrincipalName\n| sort by Attempts desc\n```\n\nIPs that produce 50052 for several users, with their other credential failures next to it. The threshold of 3 users is a starting point:\n\n```kusto\nSigninLogs\n| where TimeGenerated > ago(7d)\n| where ResultType in (\"50052\", \"50126\", \"50034\")\n| summarize Users = dcount(UserPrincipalName),\n            TooLong = countif(ResultType == \"50052\"),\n            WrongPassword = countif(ResultType == \"50126\"),\n            UnknownUser = countif(ResultType == \"50034\")\n          by IPAddress\n| where TooLong > 0 and Users >= 3\n| sort by Users desc\n```",
  "fix": {
    "short": "User: ask your admin to reset your password, or use 'Forgot your password' if your organisation allows self-service reset, and pick one of 256 characters or fewer. Admin: reset it to 8 to 256 characters. Developer: check what your code sends in the `password` field.",
    "steps": "**For the user:** your password is longer than the 256 characters Entra allows. Ask your admin to reset it, or use \"Forgot your password\" if your organisation allows self-service reset. Microsoft's notice says: *\"If SSPR is enabled for their tenant, they can reset their password by following the \"Forgot your password\" link.\"* Pick a new password of 256 characters or fewer.\n\n**For developers:** check what your code sends in the `password` field. If it is longer than 256 characters, it is almost certainly not the password. Probably a secret, token or file read into the wrong variable, though we haven't confirmed that.\n\n**For admins:**\n1. Find the user with the queries above.\n2. Reset the password to one of 256 characters or fewer. Microsoft's policy allows 8 to 256 characters.\n3. If it is a service account used by a script, fix what the script sends, then look at why it uses a password grant at all."
  },
  "labReproduced": {
    "date": "2026-10-30",
    "method": "ROPC and other token-endpoint requests against a lab tenant",
    "scenario": "Password longer than 256 characters",
    "message": "AADSTS50052: The password entered exceeds the maximum length. Please reach out to your admin to reset the password.",
    "logCaptured": "2026-10-30",
    "kqlTested": "2026-10-30"
  },
  "labSectionText": "On 30 October 2026 an automated lab run sent a password-grant (ROPC) token request for a test user in my lab tenant, with a 300-character password. Entra returned `AADSTS50052` with the first line quoted above.\n\nThat confirms the code and the current wording at the token endpoint. Our reading: Entra checks the length before it checks the password. The current policy caps passwords at 256 characters, so a 300-character password can't match one set under it. It could only be wrong, yet the answer was the length error and not [AADSTS50126](https://brambrinkmeier.com/entra/aadsts/50126/). We did not test whether a user that doesn't exist gets 50052 too. It lands in **`SigninLogs`**: Status Failure, Conditional Access Not Applied. Entra's explanation on the row reads: *\"The user is unable to login because their password exceeds the permitted maximum length. They should contact their admin to reset the password. If SSPR is enabled for their tenant, they can reset their password by following the \"Forgot your password\" link.\"* The KQL below was run on these rows ([how](https://brambrinkmeier.com/methodology/)). The first two queries found the row. The third returned nothing as written, as expected for one attempt; with its threshold lowered to 1 it found it.",
  "labRuns": [
    {
      "date": "2026-10-30",
      "run": "round 4",
      "method": "token-endpoint requests against a lab tenant",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/67",
      "scenario": "Password longer than 256 characters",
      "expected": "50052",
      "got": "50052",
      "matchedExpectation": true,
      "message": "AADSTS50052: The password entered exceeds the maximum length. Please reach out to your admin to reset the password."
    },
    {
      "date": "2026-10-30",
      "run": "round 5",
      "method": "token-endpoint requests against a lab tenant, using lab-created test apps",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/69",
      "scenario": "Password longer than 256 characters",
      "expected": "50052",
      "got": "50052",
      "matchedExpectation": true,
      "message": "AADSTS50052: The password entered exceeds the maximum length. Please reach out to your admin to reset the password."
    },
    {
      "date": "2026-10-30",
      "run": "round 5 (first attempt)",
      "method": "token-endpoint requests against a lab tenant",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/68",
      "scenario": "Password longer than 256 characters",
      "expected": "50052",
      "got": "50052",
      "matchedExpectation": true,
      "message": "AADSTS50052: The password entered exceeds the maximum length. Please reach out to your admin to reset the password."
    },
    {
      "date": "2026-10-30",
      "run": "round 6",
      "method": "token-endpoint requests against a lab tenant, using lab-created test apps",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/70",
      "scenario": "Password longer than 256 characters",
      "expected": "50052",
      "got": "50052",
      "matchedExpectation": true,
      "message": "AADSTS50052: The password entered exceeds the maximum length. Please reach out to your admin to reset the password."
    },
    {
      "date": "2026-10-30",
      "run": "round 7",
      "method": "token-endpoint requests against a lab tenant",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/71",
      "scenario": "Password longer than 256 characters",
      "expected": "50052",
      "got": "50052",
      "matchedExpectation": true,
      "message": "AADSTS50052: The password entered exceeds the maximum length. Please reach out to your admin to reset the password."
    },
    {
      "date": "2026-10-30",
      "run": null,
      "method": "ROPC and other token-endpoint requests against a lab tenant",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/66",
      "scenario": "Password longer than 256 characters",
      "expected": "50052",
      "got": "50052",
      "matchedExpectation": true,
      "message": "AADSTS50052: The password entered exceeds the maximum length. Please reach out to your admin to reset the password."
    },
    {
      "date": "2026-10-31",
      "run": "round 8",
      "method": "token-endpoint and device-code requests against a lab tenant",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/72",
      "scenario": "Password longer than 256 characters",
      "expected": "50052",
      "got": "50052",
      "matchedExpectation": true,
      "message": "AADSTS50052: The password entered exceeds the maximum length. Please reach out to your admin to reset the password."
    },
    {
      "date": "2026-10-31",
      "run": "round 9",
      "method": "token-endpoint and device-code requests against a lab tenant",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/73",
      "scenario": "Password longer than 256 characters",
      "expected": "50052",
      "got": "50052",
      "matchedExpectation": true,
      "message": "AADSTS50052: The password entered exceeds the maximum length. Please reach out to your admin to reset the password."
    }
  ],
  "verification": "lab-reproduced",
  "related": [
    "50126",
    "50055",
    "50053",
    "50034"
  ],
  "coveredBy": [],
  "sources": [
    {
      "title": "Microsoft Entra authentication and authorization error codes",
      "url": "https://learn.microsoft.com/entra/identity-platform/reference-error-codes"
    },
    {
      "title": "What's new for authentication? (Microsoft identity platform)",
      "url": "https://learn.microsoft.com/en-ca/entra/identity-platform/reference-breaking-changes"
    },
    {
      "title": "Password policies and account restrictions in Microsoft Entra ID",
      "url": "https://learn.microsoft.com/entra/identity/authentication/concept-sspr-policy"
    },
    {
      "title": "SigninLogs table reference (Azure Monitor)",
      "url": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/signinlogs"
    }
  ],
  "published": "2026-10-30",
  "lastUpdated": "2026-10-30",
  "lastVerified": null,
  "license": "CC BY 4.0",
  "licenseUrl": "https://creativecommons.org/licenses/by/4.0/",
  "licenseNote": "CC BY 4.0 covers the author's own text and classification fields. Quoted Microsoft error wording belongs to Microsoft, is quoted with its source and can change.",
  "attribution": "Bram Brinkmeier, \"AADSTS50052: Password exceeds the maximum length (fix)\", https://brambrinkmeier.com/entra/aadsts/50052/ (CC BY 4.0)",
  "microsoftErrorLookup": "https://login.microsoftonline.com/error?code=50052"
}