AADSTS5000611: Key Derivation Function version 1 is invalid (fix)

What does AADSTS5000611 mean?

Microsoft’s error code reference doesn’t list AADSTS5000611 (checked 30 October 2026).

Microsoft documents it in a deprecation notice for the Key Derivation Function version 1 (KDFv1) algorithm. The notice gives the sign-in log entry as:

Sign-in error code: 5000611 Failure reason: Symmetric Key Derivation Function version ‘1’ is invalid. Update the device with the latest updates.

Microsoft’s background, from the same notice:

• KDFv1 was “used for the authentication of Microsoft Entra joined or Microsoft Entra hybrid joined devices in builds of Windows released before July 2021.”
• A flaw that “allowed unauthorized authentication” is tracked as CVE-2021-33781. Microsoft fixed it in a Windows security update in July 2021, and “all Windows builds released after July 2021 no longer use the KDFv1 algorithm.”
• Microsoft is “incrementally rolling out a security update that blocks the use of the KDFv1 algorithm.” “Unpatched Windows devices won’t authenticate with Microsoft Entra once the rollout of this change completes.” “Early in the rollout retrying authentication will likely succeed.”

The notice gives no enforcement dates and no KB numbers.

Users quote the message with slightly different wording. On Microsoft Q&A, a user on Windows 10 who couldn’t open Microsoft 365 mail or a company intranet site posted this message:

AADSTS5000611: Symmetric Key Derivation Function version ‘KDFV1’ is invalid. Update the device for the latest updates.

The version appears as 'KDFV1' there and as '1' in Microsoft’s notice. Match on the code, not on the text.

Is it an attack?

No. It is an outdated Windows device failing a check that protects against a known vulnerability. The block is the fix working.

Pattern	Likely meaning
5000611 from a few Windows 10 devices	Devices missing security updates since mid-2021. Update them.
5000611 that sometimes succeeds on retry	Microsoft says retries likely succeed early in the rollout. Expect that to stop.
5000611 that persists after “all updates are installed”	Users report this on Windows 10 builds that couldn’t move to a newer feature release. Check the build, not just the update status.
5000611 only in older Office apps	Users report it in Office 2016 and Outlook 2019, and report working around it by moving to Microsoft 365 apps. User reports only; Microsoft doesn’t say this.

How do I find it in my logs (KQL)?

Microsoft says “this error message is also present in the Microsoft Entra sign-in logs”, but not in which table. Check where it lands:

union withsource=SourceTable SigninLogs, AADNonInteractiveUserSignInLogs, AADServicePrincipalSignInLogs
| where TimeGenerated > ago(30d)
| where ResultType == "5000611"
| summarize Rows = count() by SourceTable

The list of affected devices, which is what Microsoft’s notice asks you to build. DeviceDetail is dynamic in SigninLogs and a string in AADNonInteractiveUserSignInLogs, so each leg parses it first. Property names come from the Graph deviceDetail resource; operatingSystem is documented as “the OS name and version used in the sign-in”:

let rows =
    union
        (SigninLogs | extend D = parse_json(tostring(DeviceDetail)) | project TimeGenerated, ResultType, UserPrincipalName, AppDisplayName, D),
        (AADNonInteractiveUserSignInLogs | extend D = parse_json(DeviceDetail) | project TimeGenerated, ResultType, UserPrincipalName, AppDisplayName, D);
rows
| where TimeGenerated > ago(30d)
| where ResultType == "5000611"
| extend DeviceId = tostring(D.deviceId), DeviceName = tostring(D.displayName),
         OS = tostring(D.operatingSystem), TrustType = tostring(D.trustType)
| summarize Rows = count(), Users = make_set(UserPrincipalName, 10), Apps = make_set(AppDisplayName, 10),
            LastSeen = max(TimeGenerated)
          by DeviceId, DeviceName, OS, TrustType
| sort by LastSeen desc

Hand the DeviceName list to whoever runs patching. Our reading is that a device stops appearing here once it is updated; if it keeps appearing, the update didn’t take.

How do I fix AADSTS5000611?

For the user: install all pending Windows updates, restart, and sign in again. If Windows can’t install the updates (for example, not enough disk space), tell IT. Retrying may work for a while, but Microsoft says it will stop working.

For admins:

1. Build the device list with the second query.
2. Update those devices. Microsoft: “All Windows devices that authenticate using Microsoft Entra must have the security patch applied or be running builds of Windows released after July 2021.”
3. If a device stays on the list after updating, check its Windows build. In Q&A 5491800, installing the latest updates for an older Windows 10 build didn’t help. A volunteer moderator suggested upgrading to 22H2; the thread doesn’t confirm that it worked. Microsoft doesn’t name a standalone patch.
4. Microsoft also recommends looking for affected builds proactively, using the guidance in CVE-2021-33781, and setting automated update policies.
5. If only an old Office version fails on an updated device, users report working around it by moving to Microsoft 365 apps. Treat that as a user report, not a documented fix.