{
  "schemaVersion": "1.0",
  "code": "50072",
  "name": "UserStrongAuthEnrollmentRequiredInterrupt",
  "title": "AADSTS50072: User needs to enroll for second factor authentication",
  "url": "https://brambrinkmeier.com/entra/aadsts/50072/",
  "alternates": {
    "markdown": "https://brambrinkmeier.com/entra/aadsts/50072.md",
    "json": "https://brambrinkmeier.com/api/aadsts/50072.json",
    "html": "https://brambrinkmeier.com/entra/aadsts/50072/"
  },
  "description": "AADSTS50072: user needs to enroll for second factor authentication. Normal for new users; from an unfamiliar IP, check who registers MFA. KQL.",
  "summary": "AADSTS50072 is an interrupt: the user must enroll a second factor before the sign-in can finish. For a new user it is expected. Microsoft's password spray playbook lists it among the codes to monitor. From an unfamiliar IP it can mean someone with the correct password is being asked to set up MFA on the account.",
  "inMicrosoftReference": true,
  "unlistedChecked": null,
  "meaningText": "Microsoft's description:\n\n> **UserStrongAuthEnrollmentRequiredInterrupt**: User needs to enroll for second factor authentication (interactive).\n\nMicrosoft's password spray playbook lists it among the Entra codes to monitor, worded as *\"50072 - User prompted to provide MFA\"*. Both texts point to the same moment: the password was accepted, MFA applies, and the sign-in is interrupted for the second factor. The error reference says the user still has to enroll one.\n\nThe closely related [50079](https://brambrinkmeier.com/entra/aadsts/50079/) is the code the playbook describes as *\"user needs to register security info\"*.",
  "sections": [
    {
      "heading": "What does AADSTS50072 mean?",
      "text": "Microsoft's description:\n\n> **UserStrongAuthEnrollmentRequiredInterrupt**: User needs to enroll for second factor authentication (interactive).\n\nMicrosoft's password spray playbook lists it among the Entra codes to monitor, worded as *\"50072 - User prompted to provide MFA\"*. Both texts point to the same moment: the password was accepted, MFA applies, and the sign-in is interrupted for the second factor. The error reference says the user still has to enroll one.\n\nThe closely related [50079](https://brambrinkmeier.com/entra/aadsts/50079/) is the code the playbook describes as *\"user needs to register security info\"*."
    },
    {
      "heading": "What is the quick fix?",
      "text": "Usually nothing is broken. The user has to set up a second factor and then finish signing in.\n\n- **User:** follow the registration prompt from a device and network you trust. If you didn't start this sign-in, stop and contact IT.\n- **Admin, new users:** Microsoft's Conditional Access guidance says *\"Administrators have to issue Temporary Access Pass credentials to new users so they can satisfy the requirements for multifactor authentication to register\"* when registration itself requires MFA. Microsoft also notes *\"Temporary Access Pass does not work for guest users.\"*\n- **Admin, unexpected rows:** if the user should already have methods, or the IP is unfamiliar, see the next section."
    },
    {
      "heading": "Is it an attack?",
      "text": "For a new hire or a user who just came into scope of an MFA policy, 50072 is the normal path into MFA. It matters when the sign-in isn't the user's: whoever completes enrollment from that session chooses the second factor. This is reasoning from how registration works, not a Microsoft statement. It is the same concern as on the [50079 page](https://brambrinkmeier.com/entra/aadsts/50079/).\n\n| Pattern | Likely meaning |\n|---|---|\n| 50072 for a new or newly in-scope user from a known office or home IP | Expected enrollment. Benign. |\n| 50072 from an IP that also produced **50126** failures against other users | A spray found a working password on an account without MFA. |\n| 50072 from an unfamiliar IP or country, then a success | Someone may have registered their own method. Check the account's methods. |\n| 50072 for a long-standing account that should already be registered | Check whether its methods were removed, and by whom. |\n\nThese readings are based on Microsoft's description and the playbook listing. Microsoft doesn't publish a threat pattern for 50072 specifically."
    },
    {
      "heading": "How do I find it in my logs (KQL)?",
      "text": "50072 per user and IP, with whether the same user and IP had a success afterwards:\n\n```kusto\nlet window = 7d;\nlet interrupts =\n    SigninLogs\n    | where TimeGenerated > ago(window)\n    | where ResultType == \"50072\"\n    | summarize FirstInterrupt = min(TimeGenerated), Interrupts = count(),\n                Apps = make_set(AppDisplayName, 5)\n              by UserPrincipalName, IPAddress\n    | extend Apps = strcat_array(Apps, \", \");\nlet successes =\n    SigninLogs\n    | where TimeGenerated > ago(window)\n    | where ResultType == \"0\"\n    | project SuccessTime = TimeGenerated, UserPrincipalName, IPAddress;\ninterrupts\n| join kind=leftouter successes on UserPrincipalName, IPAddress\n| summarize SuccessAfter = countif(SuccessTime > FirstInterrupt)\n          by UserPrincipalName, IPAddress, FirstInterrupt, Interrupts, Apps\n| sort by FirstInterrupt desc\n```\n\n50072 from IPs that were failing passwords against other users the same day:\n\n```kusto\nlet sprayIPs =\n    SigninLogs\n    | where TimeGenerated > ago(1d)\n    | where ResultType == \"50126\"\n    | summarize FailedUsers = dcount(UserPrincipalName) by IPAddress\n    | where FailedUsers >= 5\n    | project IPAddress;\nSigninLogs\n| where TimeGenerated > ago(1d)\n| where ResultType == \"50072\"\n| where IPAddress in (sprayIPs)\n| project TimeGenerated, UserPrincipalName, IPAddress, AppDisplayName,\n          ClientAppUsed, UserAgent\n| sort by TimeGenerated asc\n```\n\nThe threshold of 5 failed users is a starting point, not a Microsoft number. `ResultType` is a **string** column, so compare it with `\"50072\"`, not `50072`."
    },
    {
      "heading": "How do Conditional Access and MFA affect it?",
      "text": "- 50072 means an MFA requirement applies and the account can't meet it yet.\n- Microsoft documents that an interrupted sign-in *\"appears on the logs but shows **Not applied** for Conditional Access.\"* So `notApplied` on a 50072 row doesn't mean your policies are missing.\n- Conditional Access can protect the registration step itself with the **Register security information** user action. Microsoft's template *\"requires users who are not on a trusted network to do multifactor authentication\"* to register."
    },
    {
      "heading": "How do I fix AADSTS50072?",
      "text": "**For the user:** register your second factor when prompted, from a device and network you trust.\n\n**For admins:**\n1. For new users, issue a Temporary Access Pass if your registration policy requires MFA.\n2. For every 50072 from an IP the user doesn't use, check the account's registered methods and remove any you can't tie to the user.\n3. Protect security info registration with a Conditional Access policy on the **Register security information** user action."
    }
  ],
  "microsoftWording": {
    "text": "**UserStrongAuthEnrollmentRequiredInterrupt**: User needs to enroll for second factor authentication (interactive).",
    "source": "Microsoft's error code reference, as quoted on the page",
    "sourceUrl": "https://learn.microsoft.com/en-us/entra/identity-platform/reference-error-codes"
  },
  "securityReading": {
    "category": {
      "id": "mfa",
      "label": "Multifactor authentication"
    },
    "kind": {
      "id": "interrupt",
      "label": "Interrupt (an expected extra step, not a failure)"
    },
    "attackSignal": {
      "level": "medium",
      "label": "Medium: worth a look in context"
    },
    "mitre": [
      {
        "id": "T1078.004",
        "name": "Valid Accounts: Cloud Accounts",
        "url": "https://attack.mitre.org/techniques/T1078/004/"
      },
      {
        "id": "T1098.005",
        "name": "Account Manipulation: Device Registration",
        "url": "https://attack.mitre.org/techniques/T1098/005/"
      }
    ],
    "tables": [
      "SigninLogs"
    ],
    "isItAnAttack": "For a new hire or a user who just came into scope of an MFA policy, 50072 is the normal path into MFA. It matters when the sign-in isn't the user's: whoever completes enrollment from that session chooses the second factor. This is reasoning from how registration works, not a Microsoft statement. It is the same concern as on the [50079 page](https://brambrinkmeier.com/entra/aadsts/50079/).\n\n| Pattern | Likely meaning |\n|---|---|\n| 50072 for a new or newly in-scope user from a known office or home IP | Expected enrollment. Benign. |\n| 50072 from an IP that also produced **50126** failures against other users | A spray found a working password on an account without MFA. |\n| 50072 from an unfamiliar IP or country, then a success | Someone may have registered their own method. Check the account's methods. |\n| 50072 for a long-standing account that should already be registered | Check whether its methods were removed, and by whom. |\n\nThese readings are based on Microsoft's description and the playbook listing. Microsoft doesn't publish a threat pattern for 50072 specifically.",
    "conditionalAccess": {
      "heading": "How do Conditional Access and MFA affect it?",
      "text": "- 50072 means an MFA requirement applies and the account can't meet it yet.\n- Microsoft documents that an interrupted sign-in *\"appears on the logs but shows **Not applied** for Conditional Access.\"* So `notApplied` on a 50072 row doesn't mean your policies are missing.\n- Conditional Access can protect the registration step itself with the **Register security information** user action. Microsoft's template *\"requires users who are not on a trusted network to do multifactor authentication\"* to register."
    }
  },
  "kql": [
    {
      "title": null,
      "leadIn": "50072 per user and IP, with whether the same user and IP had a success afterwards:",
      "query": "let window = 7d;\nlet interrupts =\n    SigninLogs\n    | where TimeGenerated > ago(window)\n    | where ResultType == \"50072\"\n    | summarize FirstInterrupt = min(TimeGenerated), Interrupts = count(),\n                Apps = make_set(AppDisplayName, 5)\n              by UserPrincipalName, IPAddress\n    | extend Apps = strcat_array(Apps, \", \");\nlet successes =\n    SigninLogs\n    | where TimeGenerated > ago(window)\n    | where ResultType == \"0\"\n    | project SuccessTime = TimeGenerated, UserPrincipalName, IPAddress;\ninterrupts\n| join kind=leftouter successes on UserPrincipalName, IPAddress\n| summarize SuccessAfter = countif(SuccessTime > FirstInterrupt)\n          by UserPrincipalName, IPAddress, FirstInterrupt, Interrupts, Apps\n| sort by FirstInterrupt desc"
    },
    {
      "title": null,
      "leadIn": "50072 from IPs that were failing passwords against other users the same day:",
      "query": "let sprayIPs =\n    SigninLogs\n    | where TimeGenerated > ago(1d)\n    | where ResultType == \"50126\"\n    | summarize FailedUsers = dcount(UserPrincipalName) by IPAddress\n    | where FailedUsers >= 5\n    | project IPAddress;\nSigninLogs\n| where TimeGenerated > ago(1d)\n| where ResultType == \"50072\"\n| where IPAddress in (sprayIPs)\n| project TimeGenerated, UserPrincipalName, IPAddress, AppDisplayName,\n          ClientAppUsed, UserAgent\n| sort by TimeGenerated asc"
    }
  ],
  "kqlSectionText": "50072 per user and IP, with whether the same user and IP had a success afterwards:\n\n```kusto\nlet window = 7d;\nlet interrupts =\n    SigninLogs\n    | where TimeGenerated > ago(window)\n    | where ResultType == \"50072\"\n    | summarize FirstInterrupt = min(TimeGenerated), Interrupts = count(),\n                Apps = make_set(AppDisplayName, 5)\n              by UserPrincipalName, IPAddress\n    | extend Apps = strcat_array(Apps, \", \");\nlet successes =\n    SigninLogs\n    | where TimeGenerated > ago(window)\n    | where ResultType == \"0\"\n    | project SuccessTime = TimeGenerated, UserPrincipalName, IPAddress;\ninterrupts\n| join kind=leftouter successes on UserPrincipalName, IPAddress\n| summarize SuccessAfter = countif(SuccessTime > FirstInterrupt)\n          by UserPrincipalName, IPAddress, FirstInterrupt, Interrupts, Apps\n| sort by FirstInterrupt desc\n```\n\n50072 from IPs that were failing passwords against other users the same day:\n\n```kusto\nlet sprayIPs =\n    SigninLogs\n    | where TimeGenerated > ago(1d)\n    | where ResultType == \"50126\"\n    | summarize FailedUsers = dcount(UserPrincipalName) by IPAddress\n    | where FailedUsers >= 5\n    | project IPAddress;\nSigninLogs\n| where TimeGenerated > ago(1d)\n| where ResultType == \"50072\"\n| where IPAddress in (sprayIPs)\n| project TimeGenerated, UserPrincipalName, IPAddress, AppDisplayName,\n          ClientAppUsed, UserAgent\n| sort by TimeGenerated asc\n```\n\nThe threshold of 5 failed users is a starting point, not a Microsoft number. `ResultType` is a **string** column, so compare it with `\"50072\"`, not `50072`.",
  "fix": {
    "short": "User: register your second factor when prompted, from a device and network you trust. If you didn't start this sign-in, stop and contact IT. Admin: issue new users a Temporary Access Pass if registration requires MFA. From an unfamiliar IP, check the account's registered methods.",
    "steps": "**For the user:** register your second factor when prompted, from a device and network you trust.\n\n**For admins:**\n1. For new users, issue a Temporary Access Pass if your registration policy requires MFA.\n2. For every 50072 from an IP the user doesn't use, check the account's registered methods and remove any you can't tie to the user.\n3. Protect security info registration with a Conditional Access policy on the **Register security information** user action."
  },
  "labReproduced": null,
  "labSectionText": null,
  "labRuns": [
    {
      "date": "2026-10-25",
      "run": null,
      "method": "ROPC token request against a lab tenant",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/38",
      "scenario": "Correct password (security defaults / MFA / consent decide)",
      "expected": "success / 50076 / 50079 / 65001 / 50072",
      "got": "65001",
      "matchedExpectation": true,
      "message": "AADSTS65001: The user or administrator has not consented to use the application with ID '{app-id}' named 'lab-signin-client'. Send a"
    },
    {
      "date": "2026-10-30",
      "run": "round 4",
      "method": "token-endpoint requests against a lab tenant",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/67",
      "scenario": "Correct password (security defaults / MFA / consent decide)",
      "expected": "success / 50076 / 50079 / 65001 / 50072",
      "got": "65001",
      "matchedExpectation": true,
      "message": "AADSTS65001: The user or administrator has not consented to use the application with ID '{app-id}' named 'lab-signin-client'. Send a"
    },
    {
      "date": "2026-10-30",
      "run": "round 5",
      "method": "token-endpoint requests against a lab tenant, using lab-created test apps",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/69",
      "scenario": "Correct password (security defaults / MFA / consent decide)",
      "expected": "success / 50076 / 50079 / 65001 / 50072",
      "got": "success",
      "matchedExpectation": true,
      "message": ""
    },
    {
      "date": "2026-10-30",
      "run": "round 5 (first attempt)",
      "method": "token-endpoint requests against a lab tenant",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/68",
      "scenario": "Correct password (security defaults / MFA / consent decide)",
      "expected": "success / 50076 / 50079 / 65001 / 50072",
      "got": "success",
      "matchedExpectation": true,
      "message": ""
    },
    {
      "date": "2026-10-30",
      "run": "round 6",
      "method": "token-endpoint requests against a lab tenant, using lab-created test apps",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/70",
      "scenario": "Correct password (security defaults / MFA / consent decide)",
      "expected": "success / 50076 / 50079 / 65001 / 50072",
      "got": "success",
      "matchedExpectation": true,
      "message": ""
    },
    {
      "date": "2026-10-30",
      "run": "round 7",
      "method": "token-endpoint requests against a lab tenant",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/71",
      "scenario": "Correct password (security defaults / MFA / consent decide)",
      "expected": "success / 50076 / 50079 / 65001 / 50072",
      "got": "success",
      "matchedExpectation": true,
      "message": ""
    },
    {
      "date": "2026-10-30",
      "run": null,
      "method": "ROPC and other token-endpoint requests against a lab tenant",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/66",
      "scenario": "Correct password (security defaults / MFA / consent decide)",
      "expected": "success / 50076 / 50079 / 65001 / 50072",
      "got": "65001",
      "matchedExpectation": true,
      "message": "AADSTS65001: The user or administrator has not consented to use the application with ID '{app-id}' named 'lab-signin-client'. Send a"
    },
    {
      "date": "2026-10-31",
      "run": "round 8",
      "method": "token-endpoint and device-code requests against a lab tenant",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/72",
      "scenario": "Correct password (security defaults / MFA / consent decide)",
      "expected": "success / 50076 / 50079 / 65001 / 50072",
      "got": "success",
      "matchedExpectation": true,
      "message": ""
    },
    {
      "date": "2026-10-31",
      "run": "round 9",
      "method": "token-endpoint and device-code requests against a lab tenant",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/73",
      "scenario": "Correct password (security defaults / MFA / consent decide)",
      "expected": "success / 50076 / 50079 / 65001 / 50072",
      "got": "success",
      "matchedExpectation": true,
      "message": ""
    }
  ],
  "verification": "documentation",
  "related": [
    "50079",
    "50074",
    "50076",
    "53003"
  ],
  "coveredBy": [
    {
      "title": "How to detect password spraying in Microsoft Entra ID (with KQL)",
      "url": "https://brambrinkmeier.com/guides/detect-password-spray-entra-id/"
    }
  ],
  "sources": [
    {
      "title": "Microsoft Entra authentication and authorization error codes",
      "url": "https://learn.microsoft.com/en-us/entra/identity-platform/reference-error-codes"
    },
    {
      "title": "Password spray investigation (Microsoft incident response playbook)",
      "url": "https://learn.microsoft.com/en-us/security/operations/incident-response-playbook-password-spray"
    },
    {
      "title": "Interactive user sign-ins",
      "url": "https://learn.microsoft.com/en-us/entra/identity/monitoring-health/concept-interactive-sign-ins"
    },
    {
      "title": "Require MFA for security info registration (Conditional Access)",
      "url": "https://learn.microsoft.com/en-us/entra/identity/conditional-access/policy-all-users-security-info-registration"
    },
    {
      "title": "SigninLogs table reference (Azure Monitor)",
      "url": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/signinlogs"
    }
  ],
  "published": "2026-10-25",
  "lastUpdated": "2026-10-25",
  "lastVerified": null,
  "license": "CC BY 4.0",
  "licenseUrl": "https://creativecommons.org/licenses/by/4.0/",
  "licenseNote": "CC BY 4.0 covers the author's own text and classification fields. Quoted Microsoft error wording belongs to Microsoft, is quoted with its source and can change.",
  "attribution": "Bram Brinkmeier, \"AADSTS50072: User needs to enroll for second factor authentication\", https://brambrinkmeier.com/entra/aadsts/50072/ (CC BY 4.0)",
  "microsoftErrorLookup": "https://login.microsoftonline.com/error?code=50072"
}