AADSTS50055: Password expired

What does AADSTS50055 mean?

InvalidPasswordExpiredPassword: The password is expired. The user’s password is expired, and therefore their login or session was ended. They will be offered the opportunity to reset it, or can ask an admin to reset it via Reset a user’s password using Microsoft Entra ID.

The user is sent to change the password before they can continue.

Is it an attack?

Microsoft’s password spray playbook lists “50055 - Password expired” among the sign-in events to review in a spray investigation. The playbook doesn’t say why. The likely reason is an inference from the description: Entra tells the user the password is expired, not wrong. In practice that means the password entered was the right one. Compare 50126, where it was wrong.

That changes how you read it:

Pattern	Likely meaning
A user on their normal device and IP, followed by a password change and success	Routine expiry. Benign.
A 50055 from an IP that also produced many 50126 across different users	The spray found a correct password for this account. Treat it as a compromised credential.
A 50055 from an unfamiliar country or hosting provider for a user who wasn’t travelling	Someone else has this user’s (old) password.
50055 followed by a success from the same unfamiliar IP	The worst case. The attacker may have changed the password and signed in. Check the audit log for the password change.

Expect ConditionalAccessStatus = notApplied on 50055 rows. Conditional Access only runs after the first factor succeeds, and the sign-in stopped at the password stage.

How do I find it in my logs (KQL)?

All 50055 rows, with the source, so you can spot ones that don’t fit the user:

SigninLogs
| where TimeGenerated > ago(7d)
| where ResultType == "50055"
| project TimeGenerated, UserPrincipalName, IPAddress, LocationDetails, AppDisplayName,
          ClientAppUsed, UserAgent
| sort by TimeGenerated desc

50055 from an IP that was also spraying. These are the rows that matter:

let sprayIPs =
    SigninLogs
    | where TimeGenerated > ago(1d)
    | where ResultType == "50126"
    | summarize FailedUsers = dcount(UserPrincipalName) by IPAddress
    | where FailedUsers >= 10
    | project IPAddress;
SigninLogs
| where TimeGenerated > ago(1d)
| where ResultType == "50055"
| where IPAddress in (sprayIPs)
| project TimeGenerated, UserPrincipalName, IPAddress, ResultDescription, AppDisplayName, ClientAppUsed
| sort by TimeGenerated asc

ResultType is a string column, so compare it with "50055".

How do Conditional Access and MFA affect it?

• Conditional Access never ran on the 50055 row itself. It can still matter on the next step: if the attacker completes a password change and signs in, CA and MFA apply to that new sign-in.
• That makes MFA the barrier that matters here. In practice, an attacker holding this password still has to pass whatever CA and MFA require on the follow-up sign-in.
• AuthenticationRequirement on the 50055 row says nothing about your MFA setup. MFA was never reached.

How do I fix AADSTS50055?

For the user: change your password when prompted, or ask your admin to reset it. If you weren’t trying to sign in at that time, tell your admin.

For admins:

1. Routine expiry: let the user reset through the prompt or self-service password reset.
2. 50055 from a spray IP or an unfamiliar location: treat the old password as known to an attacker. Reset it yourself, revoke sessions (Revoke-MgUserSignInSession), and check whether that IP later got a success or an MFA prompt for the user.
3. Make sure the user has MFA registered, so a correct password alone isn’t enough.