{
  "schemaVersion": "1.0",
  "code": "50058",
  "name": "UserInformationNotProvided",
  "title": "AADSTS50058: Session information isn't sufficient for single sign-on",
  "url": "https://brambrinkmeier.com/entra/aadsts/50058/",
  "alternates": {
    "markdown": "https://brambrinkmeier.com/entra/aadsts/50058.md",
    "json": "https://brambrinkmeier.com/api/aadsts/50058.json",
    "html": "https://brambrinkmeier.com/entra/aadsts/50058/"
  },
  "description": "AADSTS50058: silent SSO (prompt=none) found no valid session. A common, expected error with low attack value; the app should prompt. KQL included.",
  "summary": "AADSTS50058 means an app tried to sign a user in silently (single sign-on, often with prompt=none) but there was no valid session to use. Microsoft calls it a common, expected error. It is one of the noisiest codes in most tenants and has low attack value. The app should fall back to an interactive sign-in. Filter it out of failure dashboards.",
  "inMicrosoftReference": true,
  "unlistedChecked": null,
  "meaningText": "Microsoft's description:\n\n> **UserInformationNotProvided**: Session information isn't sufficient for single-sign-on. This means that a user isn't signed in. This is a common error that's expected when a user is unauthenticated and hasn't yet signed in. If this error is encountered in an SSO context where the user has previously signed in, this means that the SSO session was either not found or invalid. This error might be returned to the application if prompt=none is specified.\n\nAn app asked Microsoft Entra ID to sign the user in **without showing anything** and there was no usable session. The app is expected to catch this and show a normal sign-in.\n\nThe usual trigger is `prompt=none`. Microsoft's authorization code flow reference says it *\"ensures that the user isn't presented with any interactive prompt. If the request can't be completed silently by using single-sign on, the Microsoft identity platform returns an `interaction_required` error.\"* The OpenID Connect reference lists the causes: *\"no signed-in user, the hinted user isn't signed in, or multiple users are signed in but no hint was provided.\"* Depending on the flow, the app may get 50058 itself or a protocol error such as `login_required` or `interaction_required`. Our reading is that these are the same event seen from two sides; the sign-in log records the AADSTS code.",
  "sections": [
    {
      "heading": "What does AADSTS50058 mean?",
      "text": "Microsoft's description:\n\n> **UserInformationNotProvided**: Session information isn't sufficient for single-sign-on. This means that a user isn't signed in. This is a common error that's expected when a user is unauthenticated and hasn't yet signed in. If this error is encountered in an SSO context where the user has previously signed in, this means that the SSO session was either not found or invalid. This error might be returned to the application if prompt=none is specified.\n\nAn app asked Microsoft Entra ID to sign the user in **without showing anything** and there was no usable session. The app is expected to catch this and show a normal sign-in.\n\nThe usual trigger is `prompt=none`. Microsoft's authorization code flow reference says it *\"ensures that the user isn't presented with any interactive prompt. If the request can't be completed silently by using single-sign on, the Microsoft identity platform returns an `interaction_required` error.\"* The OpenID Connect reference lists the causes: *\"no signed-in user, the hinted user isn't signed in, or multiple users are signed in but no hint was provided.\"* Depending on the flow, the app may get 50058 itself or a protocol error such as `login_required` or `interaction_required`. Our reading is that these are the same event seen from two sides; the sign-in log records the AADSTS code."
    },
    {
      "heading": "Is it an attack?",
      "text": "No. Microsoft's description calls it *\"a common error that's expected\"*. Single-page apps and MSAL.js try silent sign-in first (`ssoSilent`, `acquireTokenSilent`) and Microsoft tells developers to *\"handle any login_required or interaction_required errors with an interactive method\"*. Every user who opens such an app without a session produces one.\n\n| Pattern | Likely meaning |\n|---|---|\n| 50058 for many users across Microsoft 365 and line-of-business apps | Normal silent SSO attempts. Benign noise. |\n| 50058 followed within seconds by a success for the same user and app | The app fell back to an interactive sign-in. Working as designed. |\n| A jump in 50058 for one browser type | Third-party cookie restrictions. Microsoft notes that *\"ssoSilent requests will fail despite an active user session\"* in some browsers. Our interpretation: that shows up as extra 50058 rows. |\n| 50058 for one user, repeating, with no success after | The app keeps retrying silently and never prompts. A bug in the app, not an attack. |\n\nThere is no documented attack pattern for 50058. A silent request without a session gets nothing, so it gives an attacker nothing. Exclude it from failure-rate dashboards and spray detections, or it inflates them."
    },
    {
      "heading": "How do I find it in my logs (KQL)?",
      "text": "Microsoft doesn't document which sign-in table 50058 is logged in. Start by checking where it lands in your workspace:\n\n```kusto\nunion withsource=SourceTable SigninLogs, AADNonInteractiveUserSignInLogs\n| where TimeGenerated > ago(1d)\n| where ResultType == \"50058\"\n| summarize Rows = count(), Users = dcount(UserPrincipalName) by SourceTable\n```\n\nWhich apps generate the noise:\n\n```kusto\nSigninLogs\n| where TimeGenerated > ago(7d)\n| where ResultType == \"50058\"\n| summarize Rows = count(), Users = dcount(UserPrincipalName) by AppDisplayName, ClientAppUsed\n| sort by Rows desc\n```\n\nUsers who hit 50058 and never succeed afterwards on the same app the same day, a sign of an app that doesn't fall back to an interactive prompt:\n\n```kusto\nlet silentFails =\n    SigninLogs\n    | where TimeGenerated > ago(1d)\n    | where ResultType == \"50058\"\n    | summarize FirstFail = min(TimeGenerated), Fails = count() by UserPrincipalName, AppId, AppDisplayName;\nlet successes =\n    SigninLogs\n    | where TimeGenerated > ago(1d)\n    | where ResultType == \"0\"\n    | summarize LastSuccess = max(TimeGenerated) by UserPrincipalName, AppId;\nsilentFails\n| join kind=leftouter successes on UserPrincipalName, AppId\n| where isnull(LastSuccess) or LastSuccess < FirstFail\n| project UserPrincipalName, AppDisplayName, Fails, FirstFail\n| sort by Fails desc\n```\n\nIf the first query shows most 50058 in `AADNonInteractiveUserSignInLogs`, run the other two against that table, or both with `union`. Non-interactive rows are aggregated when application, user, IP address, status and resource match, so row counts there are not request counts. `ResultType` is a **string** column, so compare it with `\"50058\"`, not `50058`."
    },
    {
      "heading": "How does Conditional Access affect it?",
      "text": "- 50058 happens before Conditional Access. There is no authenticated user yet, so no policy is evaluated.\n- The interactive sign-in that follows goes through MFA and your Conditional Access policies as normal.\n- Don't confuse it with sign-in frequency. A refresh token refused by a sign-in frequency policy is logged as [70043](https://brambrinkmeier.com/entra/aadsts/70043/), a different code."
    },
    {
      "heading": "How do I fix AADSTS50058?",
      "text": "**For the user:** sign in when the app asks. If an app shows this error instead of a sign-in page, the app didn't fall back to an interactive sign-in; report it to whoever runs the app.\n\n**For developers:** treat 50058, `login_required` and `interaction_required` as *\"show a sign-in\"*, not as a failure. With MSAL.js, catch the error from the silent call and call `loginPopup`, `loginRedirect`, `acquireTokenPopup` or `acquireTokenRedirect`. Pass a `login_hint` with `prompt=none` when you know which user to expect.\n\n**For admins:**\n1. Nothing is broken. Exclude `\"50058\"` from failure counts, password spray rules and alerting thresholds.\n2. If the third query returns many users for one app, that app doesn't fall back to an interactive sign-in. Report it to its developer."
    }
  ],
  "microsoftWording": {
    "text": "**UserInformationNotProvided**: Session information isn't sufficient for single-sign-on. This means that a user isn't signed in. This is a common error that's expected when a user is unauthenticated and hasn't yet signed in. If this error is encountered in an SSO context where the user has previously signed in, this means that the SSO session was either not found or invalid. This error might be returned to the application if prompt=none is specified.",
    "source": "Microsoft's error code reference, as quoted on the page",
    "sourceUrl": "https://learn.microsoft.com/en-us/entra/identity-platform/reference-error-codes"
  },
  "securityReading": {
    "category": {
      "id": "token",
      "label": "Tokens and sessions"
    },
    "kind": {
      "id": "interrupt",
      "label": "Interrupt (an expected extra step, not a failure)"
    },
    "attackSignal": {
      "level": "low",
      "label": "Low: usually configuration or user error"
    },
    "mitre": [],
    "tables": [
      "SigninLogs",
      "AADNonInteractiveUserSignInLogs"
    ],
    "isItAnAttack": "No. Microsoft's description calls it *\"a common error that's expected\"*. Single-page apps and MSAL.js try silent sign-in first (`ssoSilent`, `acquireTokenSilent`) and Microsoft tells developers to *\"handle any login_required or interaction_required errors with an interactive method\"*. Every user who opens such an app without a session produces one.\n\n| Pattern | Likely meaning |\n|---|---|\n| 50058 for many users across Microsoft 365 and line-of-business apps | Normal silent SSO attempts. Benign noise. |\n| 50058 followed within seconds by a success for the same user and app | The app fell back to an interactive sign-in. Working as designed. |\n| A jump in 50058 for one browser type | Third-party cookie restrictions. Microsoft notes that *\"ssoSilent requests will fail despite an active user session\"* in some browsers. Our interpretation: that shows up as extra 50058 rows. |\n| 50058 for one user, repeating, with no success after | The app keeps retrying silently and never prompts. A bug in the app, not an attack. |\n\nThere is no documented attack pattern for 50058. A silent request without a session gets nothing, so it gives an attacker nothing. Exclude it from failure-rate dashboards and spray detections, or it inflates them.",
    "conditionalAccess": {
      "heading": "How does Conditional Access affect it?",
      "text": "- 50058 happens before Conditional Access. There is no authenticated user yet, so no policy is evaluated.\n- The interactive sign-in that follows goes through MFA and your Conditional Access policies as normal.\n- Don't confuse it with sign-in frequency. A refresh token refused by a sign-in frequency policy is logged as [70043](https://brambrinkmeier.com/entra/aadsts/70043/), a different code."
    }
  },
  "kql": [
    {
      "title": null,
      "leadIn": "Microsoft doesn't document which sign-in table 50058 is logged in. Start by checking where it lands in your workspace:",
      "query": "union withsource=SourceTable SigninLogs, AADNonInteractiveUserSignInLogs\n| where TimeGenerated > ago(1d)\n| where ResultType == \"50058\"\n| summarize Rows = count(), Users = dcount(UserPrincipalName) by SourceTable"
    },
    {
      "title": null,
      "leadIn": "Which apps generate the noise:",
      "query": "SigninLogs\n| where TimeGenerated > ago(7d)\n| where ResultType == \"50058\"\n| summarize Rows = count(), Users = dcount(UserPrincipalName) by AppDisplayName, ClientAppUsed\n| sort by Rows desc"
    },
    {
      "title": null,
      "leadIn": "Users who hit 50058 and never succeed afterwards on the same app the same day, a sign of an app that doesn't fall back to an interactive prompt:",
      "query": "let silentFails =\n    SigninLogs\n    | where TimeGenerated > ago(1d)\n    | where ResultType == \"50058\"\n    | summarize FirstFail = min(TimeGenerated), Fails = count() by UserPrincipalName, AppId, AppDisplayName;\nlet successes =\n    SigninLogs\n    | where TimeGenerated > ago(1d)\n    | where ResultType == \"0\"\n    | summarize LastSuccess = max(TimeGenerated) by UserPrincipalName, AppId;\nsilentFails\n| join kind=leftouter successes on UserPrincipalName, AppId\n| where isnull(LastSuccess) or LastSuccess < FirstFail\n| project UserPrincipalName, AppDisplayName, Fails, FirstFail\n| sort by Fails desc"
    }
  ],
  "kqlSectionText": "Microsoft doesn't document which sign-in table 50058 is logged in. Start by checking where it lands in your workspace:\n\n```kusto\nunion withsource=SourceTable SigninLogs, AADNonInteractiveUserSignInLogs\n| where TimeGenerated > ago(1d)\n| where ResultType == \"50058\"\n| summarize Rows = count(), Users = dcount(UserPrincipalName) by SourceTable\n```\n\nWhich apps generate the noise:\n\n```kusto\nSigninLogs\n| where TimeGenerated > ago(7d)\n| where ResultType == \"50058\"\n| summarize Rows = count(), Users = dcount(UserPrincipalName) by AppDisplayName, ClientAppUsed\n| sort by Rows desc\n```\n\nUsers who hit 50058 and never succeed afterwards on the same app the same day, a sign of an app that doesn't fall back to an interactive prompt:\n\n```kusto\nlet silentFails =\n    SigninLogs\n    | where TimeGenerated > ago(1d)\n    | where ResultType == \"50058\"\n    | summarize FirstFail = min(TimeGenerated), Fails = count() by UserPrincipalName, AppId, AppDisplayName;\nlet successes =\n    SigninLogs\n    | where TimeGenerated > ago(1d)\n    | where ResultType == \"0\"\n    | summarize LastSuccess = max(TimeGenerated) by UserPrincipalName, AppId;\nsilentFails\n| join kind=leftouter successes on UserPrincipalName, AppId\n| where isnull(LastSuccess) or LastSuccess < FirstFail\n| project UserPrincipalName, AppDisplayName, Fails, FirstFail\n| sort by Fails desc\n```\n\nIf the first query shows most 50058 in `AADNonInteractiveUserSignInLogs`, run the other two against that table, or both with `union`. Non-interactive rows are aggregated when application, user, IP address, status and resource match, so row counts there are not request counts. `ResultType` is a **string** column, so compare it with `\"50058\"`, not `50058`.",
  "fix": {
    "short": "Nothing to fix: this is an expected silent sign-in miss. User: sign in when the app asks. Developer: catch 50058, `login_required` and `interaction_required` from the silent call and fall back to an interactive sign-in. Admin: exclude 50058 from failure counts and spray rules.",
    "steps": "**For the user:** sign in when the app asks. If an app shows this error instead of a sign-in page, the app didn't fall back to an interactive sign-in; report it to whoever runs the app.\n\n**For developers:** treat 50058, `login_required` and `interaction_required` as *\"show a sign-in\"*, not as a failure. With MSAL.js, catch the error from the silent call and call `loginPopup`, `loginRedirect`, `acquireTokenPopup` or `acquireTokenRedirect`. Pass a `login_hint` with `prompt=none` when you know which user to expect.\n\n**For admins:**\n1. Nothing is broken. Exclude `\"50058\"` from failure counts, password spray rules and alerting thresholds.\n2. If the third query returns many users for one app, that app doesn't fall back to an interactive sign-in. Report it to its developer."
  },
  "labReproduced": null,
  "labSectionText": null,
  "labRuns": [],
  "verification": "documentation",
  "related": [
    "50140",
    "70043",
    "700082",
    "50089",
    "50196",
    "54005",
    "70044",
    "75011",
    "165000",
    "700081",
    "9002341"
  ],
  "coveredBy": [],
  "sources": [
    {
      "title": "Microsoft Entra authentication and authorization error codes",
      "url": "https://learn.microsoft.com/en-us/entra/identity-platform/reference-error-codes"
    },
    {
      "title": "Microsoft identity platform and OAuth 2.0 authorization code flow",
      "url": "https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth2-auth-code-flow"
    },
    {
      "title": "OpenID Connect on the Microsoft identity platform",
      "url": "https://learn.microsoft.com/en-us/entra/identity-platform/v2-protocols-oidc"
    },
    {
      "title": "Prompt behavior with MSAL.js",
      "url": "https://learn.microsoft.com/en-us/entra/identity-platform/msal-js-prompt-behavior"
    },
    {
      "title": "Non-interactive user sign-ins",
      "url": "https://learn.microsoft.com/en-us/entra/identity/monitoring-health/concept-noninteractive-sign-ins"
    },
    {
      "title": "SigninLogs table reference (Azure Monitor)",
      "url": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/signinlogs"
    }
  ],
  "published": null,
  "lastUpdated": "2026-10-24",
  "lastVerified": null,
  "license": "CC BY 4.0",
  "licenseUrl": "https://creativecommons.org/licenses/by/4.0/",
  "licenseNote": "CC BY 4.0 covers the author's own text and classification fields. Quoted Microsoft error wording belongs to Microsoft, is quoted with its source and can change.",
  "attribution": "Bram Brinkmeier, \"AADSTS50058: Session information isn't sufficient for single sign-on\", https://brambrinkmeier.com/entra/aadsts/50058/ (CC BY 4.0)",
  "microsoftErrorLookup": "https://login.microsoftonline.com/error?code=50058"
}