AADSTS50054: Old password used for sign-in (fix)

What does AADSTS50054 mean?

Microsoft’s error code reference doesn’t list AADSTS50054 (checked 30 October 2026). It lists 50053 and 50055 but skips 50054.

Microsoft does quote it on another page. Change the Microsoft Entra Connector account password lists it under “errors reported by customers that were fixed by a credentials reset on the Microsoft Entra Connector account”:

Event 6900 The server encountered an unexpected error while processing a password change notification: AADSTS70002: Error validating credentials. AADSTS50054: Old password is used for authentication.

Event 659 Error while retrieving password policy sync configuration. Microsoft.IdentityModel.Clients.ActiveDirectory.AdalServiceException: AADSTS70002: Error validating credentials. AADSTS50054: Old password is used for authentication.

The Connector account is the account Entra Connect Sync uses to talk to Entra ID. Microsoft calls it “supposed to be service free”. The page gives no cause beyond the message. Our reading: the sync server presented a password the account had before. The account’s password changed in Entra ID, but the sync engine kept the old one.

Microsoft documents 50054 only for that account. Whether Entra returns 50054 or 50126 when a normal user types a former password is not documented. We haven’t tested it.

Is it an attack?

For the Connector account, no. It is a sync configuration problem that Microsoft fixes with a reset.

For any other account, it may matter, though Microsoft doesn’t say so. The message implies the password was right once, so a device, an app or a person likely still holds a password the user used before.

Pattern	Likely meaning
The Connector account, from your Entra Connect server’s IP	The sync engine has a stale password. Reset it as below.
A user, from their usual devices, soon after a password change	A phone, mail client or saved credential still uses the old password.
A user, from an IP or country they never use	Someone holds a former password, for example from an old leak. Investigate like a failed password from an unknown source.
Many accounts from one IP	A list of old passwords being tried. Treat it like a password spray.

Only the first row comes from Microsoft’s documentation. The other three are our reading.

How do I find it in my logs (KQL)?

Microsoft doesn’t document which sign-in table 50054 is logged in. Check all three:

union withsource=SourceTable SigninLogs, AADNonInteractiveUserSignInLogs, AADServicePrincipalSignInLogs
| where TimeGenerated > ago(30d)
| where ResultType == "50054"
| summarize Rows = count(), LastSeen = max(TimeGenerated) by SourceTable

Who, from where, and with which app. The Connector account should show your sync server’s IP:

union SigninLogs, AADNonInteractiveUserSignInLogs
| where TimeGenerated > ago(30d)
| where ResultType == "50054"
| summarize Rows = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), IPs = make_set(IPAddress, 20)
    by UserPrincipalName, AppDisplayName, ClientAppUsed
| sort by Rows desc

One IP with at least one 50054 row and failed passwords (50054 or 50126) for several accounts. The threshold of 3 is a starting point; tune it to your tenant:

union SigninLogs, AADNonInteractiveUserSignInLogs
| where TimeGenerated > ago(1d)
| where ResultType in ("50054", "50126")
| summarize Accounts = dcount(UserPrincipalName), OldPasswordRows = countif(ResultType == "50054"), Rows = count()
    by IPAddress
| where OldPasswordRows > 0 and Accounts >= 3
| sort by Accounts desc

How do I fix AADSTS50054?

For the user: sign in with your current password. Update it on every device and app that saved the old one, such as phone mail apps.

For admins (Entra Connect Connector account): Microsoft’s fix is to reset the account’s credentials on the sync server. On the Microsoft Entra Connect Sync server, open PowerShell:

$credential = Get-Credential
Add-ADSyncAADServiceAccount -AADCredential $credential

Enter Global Administrator credentials when asked. Microsoft says the cmdlet “resets the password for the service account and updates it both in Microsoft Entra ID and the sync engine.” After that, check that event 6900 or 659 stops.

For admins (any other account): find the device or app from the second query. If the IP is unknown to the user, reset the password and revoke the user’s sessions, as you would after a failed-password alert you can’t explain.