AADSTS500121: User didn't complete the MFA prompt

What does AADSTS500121 mean?

500121: User didn’t complete the MFA prompt.

Microsoft’s troubleshooting guide adds that it “often appears if the user hasn’t finished MFA setup”.

Where this is documented: this code is described in Microsoft’s How to troubleshoot sign-in errors guide, not in the main error code reference table. When this page was written (2026-10-11) the reference table had no row for 500121, so there is no PascalCase name to quote.

Is it an attack?

Most 500121 rows are users who closed the prompt, had no signal, or hadn’t finished setting up MFA. The security reading is about volume per user and the source IP. Microsoft frames this code as troubleshooting; the MFA fatigue reading below is reasoning from what the code means, not a Microsoft statement.

Pattern	Likely meaning
One 500121, then 0 from the same IP and device	The user retried. Benign.
500121 for a user who is mid-onboarding	Unfinished MFA setup, as Microsoft describes.
Many 500121 for one user in a short window from an IP the user doesn’t use	MFA fatigue (T1621). The password is correct and the attacker is pushing prompts.
A 500121 burst followed by 0 from the same IP	The user gave in and approved. Treat as account takeover.
500121 mixed with 50074 for the same user and IP	Same picture. See 50074.

Microsoft’s password spray playbook says to “record successful passwords but failed MFA responses, as this activity indicates that the attacker is getting the password but not passing MFA.” Every 500121 is a correct password.

How do I find it in my logs (KQL)?

Users with repeated 500121 from one IP within an hour:

SigninLogs
| where TimeGenerated > ago(1d)
| where ResultType == "500121"
| summarize NotCompleted = count(),
            FirstSeen = min(TimeGenerated),
            LastSeen = max(TimeGenerated),
            Apps = make_set(AppDisplayName, 5)
          by UserPrincipalName, IPAddress, bin(TimeGenerated, 1h)
| where NotCompleted >= 3
| sort by NotCompleted desc

Did a fatigued user approve in the end? Successes from the same IP within an hour after the last unfinished prompt:

let fatigued =
    SigninLogs
    | where TimeGenerated > ago(1d)
    | where ResultType == "500121"
    | summarize NotCompleted = count(), LastNotCompleted = max(TimeGenerated)
              by UserPrincipalName, IPAddress
    | where NotCompleted >= 3;
SigninLogs
| where TimeGenerated > ago(1d)
| where ResultType == "0"
| join kind=inner fatigued on UserPrincipalName, IPAddress
| where TimeGenerated between (LastNotCompleted .. (LastNotCompleted + 1h))
| project TimeGenerated, UserPrincipalName, IPAddress, NotCompleted,
          AppDisplayName, UserAgent
| sort by TimeGenerated asc

The threshold of 3 is a starting point, not a Microsoft number. ResultType is a string column, so compare it with "500121".

How do Conditional Access and MFA affect it?

• 500121 is the MFA step holding. Whatever required MFA stopped a sign-in with a correct password.
• The risk is the user approving on the next attempt. Push approval without context is what fatigue attacks rely on. Number matching is enforced for Microsoft Authenticator push since 2023; phishing-resistant methods remove the push entirely. The MFA fatigue guide walks through the investigation.
• Microsoft notes that requiring reauthentication too often “can increase security friction to a point that it causes users to experience MFA fatigue”. A user who sees prompts all day is easier to fatigue.

How do I fix AADSTS500121?

For the user: if you didn’t start the sign-in, deny the prompt and report it. If you’re setting up MFA, finish registration and sign in again.

For admins:

1. For a burst from an unfamiliar IP, reset the user’s password. The attacker already has it.
2. Run the second query. If a 0 followed, revoke sessions (Revoke-MgUserSignInSession) and review what the session accessed.
3. Move users to phishing-resistant MFA, and check any third-party or NPS-extension MFA path that still allows a plain approve.
4. For onboarding users stuck here, help them finish MFA registration.