{
  "schemaVersion": "1.0",
  "code": "50054",
  "name": null,
  "title": "AADSTS50054: Old password used for sign-in (fix)",
  "url": "https://brambrinkmeier.com/entra/aadsts/50054/",
  "alternates": {
    "markdown": "https://brambrinkmeier.com/entra/aadsts/50054.md",
    "json": "https://brambrinkmeier.com/api/aadsts/50054.json",
    "html": "https://brambrinkmeier.com/entra/aadsts/50054/"
  },
  "description": "AADSTS50054: a sign-in used an old password. Unlisted by Microsoft; seen on the Entra Connect Connector account. Fix with PowerShell, plus KQL.",
  "summary": "AADSTS50054 means a sign-in used an old password. Microsoft doesn't list the code. Its Entra Connect docs show it for the Connector account, often with AADSTS70002, and fix it with Add-ADSyncAADServiceAccount. For a normal user, our reading is that someone or something still holds a former password; treat repeated rows from unknown IPs like failed passwords.",
  "inMicrosoftReference": false,
  "unlistedChecked": "2026-10-30",
  "meaningText": "Microsoft's [error code reference](https://learn.microsoft.com/entra/identity-platform/reference-error-codes) doesn't list AADSTS50054 (checked 30 October 2026). It lists 50053 and 50055 but skips 50054.\n\nMicrosoft does quote it on another page. [Change the Microsoft Entra Connector account password](https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-azureadaccount) lists it under *\"errors reported by customers that were fixed by a credentials reset on the Microsoft Entra Connector account\"*:\n\n> Event 6900 The server encountered an unexpected error while processing a password change notification:\n> AADSTS70002: Error validating credentials. AADSTS50054: Old password is used for authentication.\n\n> Event 659 Error while retrieving password policy sync configuration. Microsoft.IdentityModel.Clients.ActiveDirectory.AdalServiceException: AADSTS70002: Error validating credentials. AADSTS50054: Old password is used for authentication.\n\nThe Connector account is the account Entra Connect Sync uses to talk to Entra ID. Microsoft calls it *\"supposed to be service free\"*. The page gives no cause beyond the message. Our reading: the sync server presented a password the account had before. The account's password changed in Entra ID, but the sync engine kept the old one.\n\nMicrosoft documents 50054 only for that account. Whether Entra returns 50054 or [50126](https://brambrinkmeier.com/entra/aadsts/50126/) when a normal user types a former password is not documented. We haven't tested it.",
  "sections": [
    {
      "heading": "What does AADSTS50054 mean?",
      "text": "Microsoft's [error code reference](https://learn.microsoft.com/entra/identity-platform/reference-error-codes) doesn't list AADSTS50054 (checked 30 October 2026). It lists 50053 and 50055 but skips 50054.\n\nMicrosoft does quote it on another page. [Change the Microsoft Entra Connector account password](https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-azureadaccount) lists it under *\"errors reported by customers that were fixed by a credentials reset on the Microsoft Entra Connector account\"*:\n\n> Event 6900 The server encountered an unexpected error while processing a password change notification:\n> AADSTS70002: Error validating credentials. AADSTS50054: Old password is used for authentication.\n\n> Event 659 Error while retrieving password policy sync configuration. Microsoft.IdentityModel.Clients.ActiveDirectory.AdalServiceException: AADSTS70002: Error validating credentials. AADSTS50054: Old password is used for authentication.\n\nThe Connector account is the account Entra Connect Sync uses to talk to Entra ID. Microsoft calls it *\"supposed to be service free\"*. The page gives no cause beyond the message. Our reading: the sync server presented a password the account had before. The account's password changed in Entra ID, but the sync engine kept the old one.\n\nMicrosoft documents 50054 only for that account. Whether Entra returns 50054 or [50126](https://brambrinkmeier.com/entra/aadsts/50126/) when a normal user types a former password is not documented. We haven't tested it."
    },
    {
      "heading": "Is it an attack?",
      "text": "For the Connector account, no. It is a sync configuration problem that Microsoft fixes with a reset.\n\nFor any other account, it may matter, though Microsoft doesn't say so. The message implies the password was right once, so a device, an app or a person likely still holds a password the user used before.\n\n| Pattern | Likely meaning |\n|---|---|\n| The Connector account, from your Entra Connect server's IP | The sync engine has a stale password. Reset it as below. |\n| A user, from their usual devices, soon after a password change | A phone, mail client or saved credential still uses the old password. |\n| A user, from an IP or country they never use | Someone holds a former password, for example from an old leak. Investigate like a failed password from an unknown source. |\n| Many accounts from one IP | A list of old passwords being tried. Treat it like a password spray. |\n\nOnly the first row comes from Microsoft's documentation. The other three are our reading."
    },
    {
      "heading": "How do I find it in my logs (KQL)?",
      "text": "Microsoft doesn't document which sign-in table 50054 is logged in. Check all three:\n\n```kusto\nunion withsource=SourceTable SigninLogs, AADNonInteractiveUserSignInLogs, AADServicePrincipalSignInLogs\n| where TimeGenerated > ago(30d)\n| where ResultType == \"50054\"\n| summarize Rows = count(), LastSeen = max(TimeGenerated) by SourceTable\n```\n\nWho, from where, and with which app. The Connector account should show your sync server's IP:\n\n```kusto\nunion SigninLogs, AADNonInteractiveUserSignInLogs\n| where TimeGenerated > ago(30d)\n| where ResultType == \"50054\"\n| summarize Rows = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), IPs = make_set(IPAddress, 20)\n    by UserPrincipalName, AppDisplayName, ClientAppUsed\n| sort by Rows desc\n```\n\nOne IP with at least one 50054 row and failed passwords (50054 or 50126) for several accounts. The threshold of 3 is a starting point; tune it to your tenant:\n\n```kusto\nunion SigninLogs, AADNonInteractiveUserSignInLogs\n| where TimeGenerated > ago(1d)\n| where ResultType in (\"50054\", \"50126\")\n| summarize Accounts = dcount(UserPrincipalName), OldPasswordRows = countif(ResultType == \"50054\"), Rows = count()\n    by IPAddress\n| where OldPasswordRows > 0 and Accounts >= 3\n| sort by Accounts desc\n```"
    },
    {
      "heading": "How do I fix AADSTS50054?",
      "text": "**For the user:** sign in with your current password. Update it on every device and app that saved the old one, such as phone mail apps.\n\n**For admins** (Entra Connect Connector account): Microsoft's fix is to reset the account's credentials on the sync server. On the Microsoft Entra Connect Sync server, open PowerShell:\n\n```powershell\n$credential = Get-Credential\nAdd-ADSyncAADServiceAccount -AADCredential $credential\n```\n\nEnter Global Administrator credentials when asked. Microsoft says the cmdlet *\"resets the password for the service account and updates it both in Microsoft Entra ID and the sync engine.\"* After that, check that event 6900 or 659 stops.\n\n**For admins** (any other account): find the device or app from the second query. If the IP is unknown to the user, reset the password and revoke the user's sessions, as you would after a failed-password alert you can't explain."
    }
  ],
  "microsoftWording": {
    "text": "Event 6900 The server encountered an unexpected error while processing a password change notification:\nAADSTS70002: Error validating credentials. AADSTS50054: Old password is used for authentication.",
    "source": "Quoted on the page from the lab or from user reports; the code is not in Microsoft's error code reference",
    "sourceUrl": null
  },
  "securityReading": {
    "category": {
      "id": "credentials",
      "label": "Credentials and lockout"
    },
    "kind": {
      "id": "failure",
      "label": "Failure"
    },
    "attackSignal": {
      "level": "medium",
      "label": "Medium: worth a look in context"
    },
    "mitre": [],
    "tables": [],
    "isItAnAttack": "For the Connector account, no. It is a sync configuration problem that Microsoft fixes with a reset.\n\nFor any other account, it may matter, though Microsoft doesn't say so. The message implies the password was right once, so a device, an app or a person likely still holds a password the user used before.\n\n| Pattern | Likely meaning |\n|---|---|\n| The Connector account, from your Entra Connect server's IP | The sync engine has a stale password. Reset it as below. |\n| A user, from their usual devices, soon after a password change | A phone, mail client or saved credential still uses the old password. |\n| A user, from an IP or country they never use | Someone holds a former password, for example from an old leak. Investigate like a failed password from an unknown source. |\n| Many accounts from one IP | A list of old passwords being tried. Treat it like a password spray. |\n\nOnly the first row comes from Microsoft's documentation. The other three are our reading.",
    "conditionalAccess": null
  },
  "kql": [
    {
      "title": null,
      "leadIn": "Microsoft doesn't document which sign-in table 50054 is logged in. Check all three:",
      "query": "union withsource=SourceTable SigninLogs, AADNonInteractiveUserSignInLogs, AADServicePrincipalSignInLogs\n| where TimeGenerated > ago(30d)\n| where ResultType == \"50054\"\n| summarize Rows = count(), LastSeen = max(TimeGenerated) by SourceTable"
    },
    {
      "title": null,
      "leadIn": "Who, from where, and with which app. The Connector account should show your sync server's IP:",
      "query": "union SigninLogs, AADNonInteractiveUserSignInLogs\n| where TimeGenerated > ago(30d)\n| where ResultType == \"50054\"\n| summarize Rows = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), IPs = make_set(IPAddress, 20)\n    by UserPrincipalName, AppDisplayName, ClientAppUsed\n| sort by Rows desc"
    },
    {
      "title": null,
      "leadIn": "One IP with at least one 50054 row and failed passwords (50054 or 50126) for several accounts. The threshold of 3 is a starting point; tune it to your tenant:",
      "query": "union SigninLogs, AADNonInteractiveUserSignInLogs\n| where TimeGenerated > ago(1d)\n| where ResultType in (\"50054\", \"50126\")\n| summarize Accounts = dcount(UserPrincipalName), OldPasswordRows = countif(ResultType == \"50054\"), Rows = count()\n    by IPAddress\n| where OldPasswordRows > 0 and Accounts >= 3\n| sort by Accounts desc"
    }
  ],
  "kqlSectionText": "Microsoft doesn't document which sign-in table 50054 is logged in. Check all three:\n\n```kusto\nunion withsource=SourceTable SigninLogs, AADNonInteractiveUserSignInLogs, AADServicePrincipalSignInLogs\n| where TimeGenerated > ago(30d)\n| where ResultType == \"50054\"\n| summarize Rows = count(), LastSeen = max(TimeGenerated) by SourceTable\n```\n\nWho, from where, and with which app. The Connector account should show your sync server's IP:\n\n```kusto\nunion SigninLogs, AADNonInteractiveUserSignInLogs\n| where TimeGenerated > ago(30d)\n| where ResultType == \"50054\"\n| summarize Rows = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), IPs = make_set(IPAddress, 20)\n    by UserPrincipalName, AppDisplayName, ClientAppUsed\n| sort by Rows desc\n```\n\nOne IP with at least one 50054 row and failed passwords (50054 or 50126) for several accounts. The threshold of 3 is a starting point; tune it to your tenant:\n\n```kusto\nunion SigninLogs, AADNonInteractiveUserSignInLogs\n| where TimeGenerated > ago(1d)\n| where ResultType in (\"50054\", \"50126\")\n| summarize Accounts = dcount(UserPrincipalName), OldPasswordRows = countif(ResultType == \"50054\"), Rows = count()\n    by IPAddress\n| where OldPasswordRows > 0 and Accounts >= 3\n| sort by Accounts desc\n```",
  "fix": {
    "short": "User: sign in with your current password and update it on every device and app that saved it. Admin (Entra Connect Connector account): on the sync server run `Add-ADSyncAADServiceAccount` with Global Administrator credentials. Other account from an unknown IP: reset the password, revoke sessions.",
    "steps": "**For the user:** sign in with your current password. Update it on every device and app that saved the old one, such as phone mail apps.\n\n**For admins** (Entra Connect Connector account): Microsoft's fix is to reset the account's credentials on the sync server. On the Microsoft Entra Connect Sync server, open PowerShell:\n\n```powershell\n$credential = Get-Credential\nAdd-ADSyncAADServiceAccount -AADCredential $credential\n```\n\nEnter Global Administrator credentials when asked. Microsoft says the cmdlet *\"resets the password for the service account and updates it both in Microsoft Entra ID and the sync engine.\"* After that, check that event 6900 or 659 stops.\n\n**For admins** (any other account): find the device or app from the second query. If the IP is unknown to the user, reset the password and revoke the user's sessions, as you would after a failed-password alert you can't explain."
  },
  "labReproduced": null,
  "labSectionText": null,
  "labRuns": [
    {
      "date": "2026-10-30",
      "run": "round 4",
      "method": "token-endpoint requests against a lab tenant",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/67",
      "scenario": "Old password after an admin reset",
      "expected": "50054 / 50126",
      "got": "error",
      "matchedExpectation": false,
      "message": "Graph PATCH /users/{object-id}: HTTP 403 {\"error\":{\"code\":\"Authorization_RequestDenied\",\"message\":\"Insufficient privileges to complete "
    }
  ],
  "verification": "documentation",
  "related": [
    "50126",
    "50055",
    "50133",
    "50053"
  ],
  "coveredBy": [],
  "sources": [
    {
      "title": "Microsoft Entra authentication and authorization error codes",
      "url": "https://learn.microsoft.com/entra/identity-platform/reference-error-codes"
    },
    {
      "title": "Change the Microsoft Entra Connector account password",
      "url": "https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-azureadaccount"
    },
    {
      "title": "SigninLogs table reference (Azure Monitor)",
      "url": "https://docs.azure.cn/en-us/azure-monitor/reference/tables/SigninLogs"
    },
    {
      "title": "AADNonInteractiveUserSignInLogs table reference (Azure Monitor)",
      "url": "https://docs.azure.cn/en-us/azure-monitor/reference/tables/AADNonInteractiveUserSignInLogs"
    }
  ],
  "published": "2026-10-30",
  "lastUpdated": "2026-10-30",
  "lastVerified": null,
  "license": "CC BY 4.0",
  "licenseUrl": "https://creativecommons.org/licenses/by/4.0/",
  "licenseNote": "CC BY 4.0 covers the author's own text and classification fields. Quoted Microsoft error wording belongs to Microsoft, is quoted with its source and can change.",
  "attribution": "Bram Brinkmeier, \"AADSTS50054: Old password used for sign-in (fix)\", https://brambrinkmeier.com/entra/aadsts/50054/ (CC BY 4.0)",
  "microsoftErrorLookup": "https://login.microsoftonline.com/error?code=50054"
}