# AADSTS5000611: Key Derivation Function version 1 is invalid (fix)

Canonical: https://brambrinkmeier.com/entra/aadsts/5000611/
By Bram Brinkmeier. JSON: https://brambrinkmeier.com/api/aadsts/5000611.json

**Short answer:** AADSTS5000611 means a Windows device tried to authenticate with the retired KDFv1 algorithm, which Microsoft Entra ID now blocks because of CVE-2021-33781. Microsoft's error reference doesn't list it, but a Microsoft deprecation notice does. It hits joined and hybrid joined devices on Windows builds without the July 2021 fix. Low attack value; update the device.

**Fix:** User: install all pending Windows updates, restart and sign in again; tell IT if updates won't install. Admin: find the affected devices with the second query and update them. If a device stays on the list after updating, check its Windows build; an older Windows 10 build may need a feature upgrade.

| Field | Value |
|---|---|
| Code | AADSTS5000611 |
| Category | Devices |
| Type | Failure |
| Attack signal | Low: usually configuration or user error |
| In Microsoft's error reference | No (checked 2026-10-30) |
| Verification | documentation |
| Last updated | 2026-10-30 |

## What does AADSTS5000611 mean?

Microsoft's [error code reference](https://learn.microsoft.com/entra/identity-platform/reference-error-codes) doesn't list AADSTS5000611 (checked 30 October 2026).

Microsoft documents it in a deprecation notice for the Key Derivation Function version 1 (KDFv1) algorithm. The notice gives the sign-in log entry as:

> Sign-in error code: 5000611
> Failure reason: Symmetric Key Derivation Function version '1' is invalid. Update the device with the latest updates.

Microsoft's background, from the same notice:

- KDFv1 was *"used for the authentication of Microsoft Entra joined or Microsoft Entra hybrid joined devices in builds of Windows released before July 2021."*
- A flaw that *"allowed unauthorized authentication"* is tracked as CVE-2021-33781. Microsoft fixed it in a Windows security update in July 2021, and *"all Windows builds released after July 2021 no longer use the KDFv1 algorithm."*
- Microsoft is *"incrementally rolling out a security update that blocks the use of the KDFv1 algorithm."* *"Unpatched Windows devices won't authenticate with Microsoft Entra once the rollout of this change completes."* *"Early in the rollout retrying authentication will likely succeed."*

The notice gives no enforcement dates and no KB numbers.

Users quote the message with slightly different wording. On Microsoft Q&A, a user on Windows 10 who couldn't open Microsoft 365 mail or a company intranet site posted this message:

> AADSTS5000611: Symmetric Key Derivation Function version 'KDFV1' is invalid. Update the device for the latest updates.

The version appears as `'KDFV1'` there and as `'1'` in Microsoft's notice. Match on the code, not on the text.

## Is it an attack?

No. It is an outdated Windows device failing a check that protects against a known vulnerability. The block is the fix working.

| Pattern | Likely meaning |
|---|---|
| 5000611 from a few Windows 10 devices | Devices missing security updates since mid-2021. Update them. |
| 5000611 that sometimes succeeds on retry | Microsoft says retries likely succeed early in the rollout. Expect that to stop. |
| 5000611 that persists after "all updates are installed" | Users report this on Windows 10 builds that couldn't move to a newer feature release. Check the build, not just the update status. |
| 5000611 only in older Office apps | Users report it in Office 2016 and Outlook 2019, and report working around it by moving to Microsoft 365 apps. User reports only; Microsoft doesn't say this. |

## How do I find it in my logs (KQL)?

Microsoft says *"this error message is also present in the Microsoft Entra sign-in logs"*, but not in which table. Check where it lands:

```kusto
union withsource=SourceTable SigninLogs, AADNonInteractiveUserSignInLogs, AADServicePrincipalSignInLogs
| where TimeGenerated > ago(30d)
| where ResultType == "5000611"
| summarize Rows = count() by SourceTable
```

The list of affected devices, which is what Microsoft's notice asks you to build. `DeviceDetail` is dynamic in `SigninLogs` and a string in `AADNonInteractiveUserSignInLogs`, so each leg parses it first. Property names come from the Graph `deviceDetail` resource; `operatingSystem` is documented as *"the OS name and version used in the sign-in"*:

```kusto
let rows =
    union
        (SigninLogs | extend D = parse_json(tostring(DeviceDetail)) | project TimeGenerated, ResultType, UserPrincipalName, AppDisplayName, D),
        (AADNonInteractiveUserSignInLogs | extend D = parse_json(DeviceDetail) | project TimeGenerated, ResultType, UserPrincipalName, AppDisplayName, D);
rows
| where TimeGenerated > ago(30d)
| where ResultType == "5000611"
| extend DeviceId = tostring(D.deviceId), DeviceName = tostring(D.displayName),
         OS = tostring(D.operatingSystem), TrustType = tostring(D.trustType)
| summarize Rows = count(), Users = make_set(UserPrincipalName, 10), Apps = make_set(AppDisplayName, 10),
            LastSeen = max(TimeGenerated)
          by DeviceId, DeviceName, OS, TrustType
| sort by LastSeen desc
```

Hand the `DeviceName` list to whoever runs patching. Our reading is that a device stops appearing here once it is updated; if it keeps appearing, the update didn't take.

## How do I fix AADSTS5000611?

**For the user:** install all pending Windows updates, restart, and sign in again. If Windows can't install the updates (for example, not enough disk space), tell IT. Retrying may work for a while, but Microsoft says it will stop working.

**For admins:**
1. Build the device list with the second query.
2. Update those devices. Microsoft: *"All Windows devices that authenticate using Microsoft Entra must have the security patch applied or be running builds of Windows released after July 2021."*
3. If a device stays on the list after updating, check its Windows build. In Q&A 5491800, installing the latest updates for an older Windows 10 build didn't help. A volunteer moderator suggested upgrading to 22H2; the thread doesn't confirm that it worked. Microsoft doesn't name a standalone patch.
4. Microsoft also recommends looking for affected builds proactively, using the guidance in CVE-2021-33781, and setting automated update policies.
5. If only an old Office version fails on an updated device, users report working around it by moving to Microsoft 365 apps. Treat that as a user report, not a documented fix.

## Evidence

Not in Microsoft's error reference and not reproduced in the lab; built from lab results, other Microsoft pages and user reports, which the page names.

## Sources

1. [Microsoft Entra authentication and authorization error codes](https://learn.microsoft.com/en-us/entra/identity-platform/reference-error-codes)
2. [Deprecation of Key Derivation Function version 1 (Microsoft Entra devices)](https://learn.microsoft.com/en-us/entra/identity/devices/deprecation-key-derivation-function-version-1)
3. [Symmetric Key Derivation Function version 'KDFV1' is invalid (Microsoft Q&A 5491800)](https://learn.microsoft.com/en-us/answers/questions/5491800/symmetric-key-derivation-function-version-kdfv1-is)
4. [How to resolve AADSTS5000611 error while activating O365 (Microsoft Q&A 5522370)](https://learn.microsoft.com/en-us/answers/questions/5522370/how-to-resolve-aadsts5000611-error-while-activate)
5. [deviceDetail resource type (Microsoft Graph)](https://learn.microsoft.com/en-us/graph/api/resources/devicedetail)
6. [SigninLogs table reference (Azure Monitor)](https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/signinlogs)
7. [AADNonInteractiveUserSignInLogs table reference (Azure Monitor)](https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/AADNonInteractiveUserSignInLogs)

## Related codes

[AADSTS50097](https://brambrinkmeier.com/entra/aadsts/50097/), [AADSTS135011](https://brambrinkmeier.com/entra/aadsts/135011/), [AADSTS700003](https://brambrinkmeier.com/entra/aadsts/700003/), [AADSTS53000](https://brambrinkmeier.com/entra/aadsts/53000/)

## License and citation

CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). CC BY 4.0 covers the author's own text and classification fields. Quoted Microsoft error wording belongs to Microsoft, is quoted with its source and can change.

Cite as: Bram Brinkmeier, "AADSTS5000611: Key Derivation Function version 1 is invalid (fix)", https://brambrinkmeier.com/entra/aadsts/5000611/ (CC BY 4.0), last updated 2026-10-30.