AADSTS error code map

This map lists the AADSTS codes covered here, ordered by how often they show up in attacks. Each code page has Microsoft’s official description, how to tell an attack from a misconfiguration, how Conditional Access interacts with it, and the KQL to hunt it.

Look up an AADSTS code. Codes without a page here open Microsoft's own lookup.Look up

Codes

Code	Microsoft name	Attack signal	ATT&CK technique	Type	Category
50053	IdsLocked	High	T1110.003 Password Spraying T1110.001 Password Guessing	Failure	Credentials and lockout
50079	UserStrongAuthEnrollmentRequired	High	T1078.004 Valid Accounts: Cloud Accounts T1098.005 Account Manipulation: Device Registration	Interrupt	Multifactor authentication
50126	InvalidUserNameOrPassword	High	T1110.003 Password Spraying T1110.001 Password Guessing	Failure	Credentials and lockout
50034	UserAccountNotFound	Medium	T1087.004 Account Discovery: Cloud Account T1110.003 Password Spraying	Failure	Credentials and lockout
50055	InvalidPasswordExpiredPassword	Medium	T1110.003 Password Spraying T1078.004 Valid Accounts: Cloud Accounts	Failure	Credentials and lockout
50057	UserDisabled	Medium	T1110.003 Password Spraying T1078.004 Valid Accounts: Cloud Accounts	Failure	Credentials and lockout
50074	UserStrongAuthClientAuthNRequiredInterrupt	Medium	T1621 MFA Request Generation T1078.004 Valid Accounts: Cloud Accounts	Interrupt	Multifactor authentication
50076	UserStrongAuthClientAuthNRequired	Medium	T1078.004 Valid Accounts: Cloud Accounts T1110.003 Password Spraying	Interrupt	Multifactor authentication
50097	DeviceAuthenticationRequired	Medium	T1078.004 Valid Accounts: Cloud Accounts	Interrupt	Devices
50125	PasswordResetRegistrationRequiredInterrupt	Medium	T1078.004 Valid Accounts: Cloud Accounts	Interrupt	Credentials and lockout
50173	Grant expired due to revocation	Medium	T1550.001 Use Alternate Authentication Material: Application Access Token	Failure	Tokens and sessions
53000	DeviceNotCompliant	Medium	T1078.004 Valid Accounts: Cloud Accounts T1550.001 Use Alternate Authentication Material: Application Access Token	Failure	Devices
53001	DeviceNotDomainJoined	Medium	T1078.004 Valid Accounts: Cloud Accounts	Failure	Devices
53003	BlockedByConditionalAccess	Medium	T1078.004 Valid Accounts: Cloud Accounts	Failure	Conditional Access
65001	DelegationDoesNotExist	Medium	T1528 Steal Application Access Token T1566.002 Phishing: Spearphishing Link	Failure	Consent and app permissions
90094	AdminConsentRequired	Medium	T1566.002 Phishing: Spearphishing Link T1528 Steal Application Access Token	Failure	Consent and app permissions
500121	MFA prompt not completed	Medium	T1621 MFA Request Generation	Failure	Multifactor authentication
530032	BlockedByConditionalAccessOnSecurityPolicy	Medium	T1078.004 Valid Accounts: Cloud Accounts T1110.003 Password Spraying	Failure	Conditional Access
7000215	Invalid client secret	Medium	T1078.004 Valid Accounts: Cloud Accounts	Failure	App configuration
50011	InvalidReplyTo	Low	T1528 Steal Application Access Token	Failure	App configuration
50020	UserUnauthorized	Low	-	Failure	Guests and tenants
50105	EntitlementGrantsNotFound	Low	T1078.004 Valid Accounts: Cloud Accounts	Failure	App configuration
50133	SsoArtifactRevoked	Low	-	Failure	Tokens and sessions
50140	KmsiInterrupt	Low	T1078.004 Valid Accounts: Cloud Accounts	Interrupt	Tokens and sessions
50158	External security challenge not satisfied	Low	T1078.004 Valid Accounts: Cloud Accounts	Interrupt	Multifactor authentication
70043	BadTokenDueToSignInFrequency	Low	-	Failure	Tokens and sessions
90095	AdminConsentRequiredRequestAccess	Low	T1566.002 Phishing: Spearphishing Link T1528 Steal Application Access Token	Interrupt	Consent and app permissions
135011	Device disabled	Low	-	Failure	Devices
700016	UnauthorizedClient_DoesNotMatchRequest	Low	-	Failure	App configuration
700082	ExpiredOrRevokedGrantInactiveToken	Low	-	Failure	Tokens and sessions

How to read sign-in failures

• Conditional Access runs after the first factor. Credential failures such as 50126, 50053 and 50057 show Conditional Access as notApplied. That does not mean your policies are missing.
• Interrupts are not failures. Codes such as 50076, 50079 and 50140 are expected extra steps. They matter when an attacker’s IP reaches them, because the password was correct.
• ResultType is a string. Write ResultType == "50126", not ResultType == 50126.
• Refresh-token activity is non-interactive. Many post-incident codes, such as 50173, appear in AADNonInteractiveUserSignInLogs.