# AADSTS50126: Invalid username or password

Canonical: https://brambrinkmeier.com/entra/aadsts/50126/
By Bram Brinkmeier. JSON: https://brambrinkmeier.com/api/aadsts/50126.json

**Short answer:** AADSTS50126 means Microsoft Entra ID rejected the username or password. A few per day are normal typos. The security signal is the shape: many accounts failing from one IP is password spraying, many failures on one account is brute force. Hunt it in SigninLogs with ResultType == "50126".

**Fix:** User: check the account name and keyboard layout, then reset your password with self-service reset if needed. Admin: if it's a spray, check whether any targeted account succeeded or reached MFA, then reset those passwords and revoke sessions. Block legacy authentication.

| Field | Value |
|---|---|
| Code | AADSTS50126 |
| Microsoft name | InvalidUserNameOrPassword |
| Category | Credentials and lockout |
| Type | Failure |
| Attack signal | High: often seen in attacks |
| MITRE ATT&CK | [T1110.003](https://attack.mitre.org/techniques/T1110/003/) Brute Force: Password Spraying, [T1110.001](https://attack.mitre.org/techniques/T1110/001/) Brute Force: Password Guessing |
| Where to look | `SigninLogs`, `AADNonInteractiveUserSignInLogs` |
| In Microsoft's error reference | Yes |
| Verification | lab-reproduced (2026-10-25) |
| Last updated | 2026-10-30 |

## What does AADSTS50126 mean?

Microsoft's description:

> **InvalidUserNameOrPassword**: Error validating credentials due to invalid username or password. The user didn't enter the right credentials. Expect to see some number of these errors in your logs due to users making mistakes.

Source: [Microsoft Entra authentication and authorization error codes](https://learn.microsoft.com/en-us/entra/identity-platform/reference-error-codes).

The request reached the password check and failed. Nothing after that ran: no MFA prompt and no Conditional Access evaluation.

## Reproduced in the lab

On 25 October 2026 an automated lab run sent a token request for an existing test user with the wrong password. Entra returned `AADSTS50126` with this first line:

> AADSTS50126: Error validating credentials due to invalid username or password.

That confirms the code and its wording at the token endpoint.

The same attempt in the lab tenant's sign-in log (Entra admin center, interactive user sign-ins), with identifiers left out:

| Field | Value in the lab row |
|---|---|
| Status | Failure |
| Sign-in error code | 50126 |
| Failure reason | Error validating credentials due to invalid username or password. |
| Additional details | The user didn't enter the right credentials. It's expected to see some number of these errors in your logs due to users making mistakes. |
| Authentication details | Password (password in the cloud), succeeded: false |
| Authentication requirement | Single-factor authentication |
| Conditional Access | Not Applied |
| Resource | Microsoft Graph |
| User type | Member |

In the real row Conditional Access shows **Not Applied**: a wrong password stops the sign-in before any policy is evaluated, which is why a spray that never guesses right leaves no Conditional Access trace. The KQL below was run on the lab rows ([how](https://brambrinkmeier.com/methodology/)). Both queries returned nothing as written, as expected: the lab sends one wrong password per run, far below the spray threshold of 10 users. With the threshold lowered to 1, the spray query found both source IPs and the follow-up query found the next sign-ins from those IPs.

## Is it an attack?

[Microsoft itself says](https://learn.microsoft.com/en-us/entra/identity-platform/reference-error-codes) a baseline of 50126 is expected. **The signal is the distribution, not the presence.** The [password spray guide](https://brambrinkmeier.com/guides/detect-password-spray-entra-id/) turns the patterns below into a step-by-step investigation.

| Pattern | Likely meaning |
|---|---|
| 1–3 failures, then a success from the same IP and device | A user typo. Benign. |
| Many **different users**, few attempts each, from one IP or a small IP range | **Password spraying** (T1110.003) |
| Many attempts against **one user** | Brute force / password guessing (T1110.001) |
| Failures via `ClientAppUsed` = IMAP, POP, SMTP, Exchange ActiveSync, other legacy clients | Spray tooling using legacy protocols, which can't do MFA |
| 50126 followed by **50053** for the same accounts | The spray tripped smart lockout |
| 50126 followed by **50076/50074** or **53003** from the same IP | **The password was correct** on a later try. MFA or Conditional Access is now the only barrier. Treat it as a compromised password. |

Two details from Microsoft's documentation matter when you read these rows:

- **Conditional Access never ran.** CA [only evaluates after the first factor succeeds](https://learn.microsoft.com/en-us/entra/identity/conditional-access/overview), so 50126 rows show `ConditionalAccessStatus` = `notApplied`. That doesn't mean your policies are missing.
- **`AuthenticationRequirement` shows `singleFactorAuthentication` even in an MFA-enforced tenant**, because MFA was never reached ([sign-in log activity details](https://learn.microsoft.com/en-us/entra/identity/monitoring-health/concept-sign-in-log-activity-details)). Don't use it as evidence that MFA is off.

## How do I find it in my logs (KQL)?

Spray pattern: one IP, many distinct users failing, over the last day.

```kusto
SigninLogs
| where TimeGenerated > ago(1d)
| where ResultType == "50126"
| summarize FailedUsers = dcount(UserPrincipalName),
            Attempts = count(),
            Apps = make_set(AppDisplayName, 5),
            Clients = make_set(ClientAppUsed, 5)
          by IPAddress
| where FailedUsers >= 10
| sort by FailedUsers desc
```

Did any of those IPs **also get a correct password**? That is the row that matters:

```kusto
let sprayIPs =
    SigninLogs
    | where TimeGenerated > ago(1d)
    | where ResultType == "50126"
    | summarize FailedUsers = dcount(UserPrincipalName) by IPAddress
    | where FailedUsers >= 10
    | project IPAddress;
SigninLogs
| where TimeGenerated > ago(1d)
| where IPAddress in (sprayIPs)
| where ResultType in ("0", "50076", "50074", "50079", "53003", "50055")
| project TimeGenerated, UserPrincipalName, IPAddress, ResultType, ResultDescription,
          ConditionalAccessStatus, AppDisplayName, ClientAppUsed
| sort by TimeGenerated asc
```

`ResultType` is a **string** column, so compare it with `"50126"`, not `50126`. Legacy-protocol sign-ins that replay a stored password can also show up in `AADNonInteractiveUserSignInLogs`; run the same query there if you allow legacy auth.

## How do Conditional Access and MFA affect it?

- CA can't stop a 50126. It happens before CA runs. What CA controls is what happens **after** a correct password (MFA, compliant device, block).
- **Blocking legacy authentication** removes the protocols most spray tools use, and those protocols can't do MFA.
- **[Smart lockout](https://learn.microsoft.com/en-us/entra/identity/authentication/howto-password-smart-lockout)** is always on. By default it locks after 10 failed attempts (Azure public cloud), with separate counters for familiar and unfamiliar locations, which then turns the errors into 50053.

## How do I fix AADSTS50126?

**For the user:** check the account name and keyboard layout, then reset the password with self-service password reset if needed.

**For admins:**
1. If it's a spray, check whether any targeted account **succeeded** or reached MFA (second query above). Reset those passwords and revoke sessions.
2. Block legacy authentication with Conditional Access.
3. Make sure every account has a registered phishing-resistant MFA method, so a correct password alone isn't enough.
4. Consider custom banned passwords. Spray lists use seasonal and company-name passwords.
5. If the failures come from the IP address of one of your own servers, check that server for compromise. A host that was breached may be trying credentials it found on it. See [hunting credential reuse after a web-server breach](https://brambrinkmeier.com/guides/hunt-credential-reuse-after-web-server-breach/).

## Evidence

Reproduced in a lab tenant on 2026-10-25 (ROPC token request against a lab tenant; scenario: Wrong password). First line returned:

> AADSTS50126: Error validating credentials due to invalid username or password.

Sign-in log row read: 2026-10-30. KQL run against the exported lab rows: 2026-10-30.

Lab-run rows naming this code (11; full list at https://brambrinkmeier.com/lab-runs.json):

| Date | Scenario | Expected | Got | Message (first line) |
|---|---|---|---|---|
| 2026-10-25 | Wrong password | 50126 | 50126 | AADSTS50126: Error validating credentials due to invalid username or password. |
| 2026-10-30 | Wrong password | 50126 | 50126 | AADSTS50126: Error validating credentials due to invalid username or password. |
| 2026-10-30 | Old password after an admin reset | 50054 / 50126 | error | Graph PATCH /users/{object-id}: HTTP 403 {"error":{"code":"Authorization_RequestDenied","message":"Insufficient privileges to complete  |
| 2026-10-30 | Wrong password | 50126 | 50126 | AADSTS50126: Error validating credentials due to invalid username or password. |
| 2026-10-30 | Repeated wrong passwords (smart lockout) | 50053 | 50126 | AADSTS50126: Error validating credentials due to invalid username or password. |
| 2026-10-30 | Wrong password | 50126 | 50126 | AADSTS50126: Error validating credentials due to invalid username or password. |
| 2026-10-30 | Wrong password | 50126 | 50126 | AADSTS50126: Error validating credentials due to invalid username or password. |
| 2026-10-30 | Wrong password | 50126 | 50126 | AADSTS50126: Error validating credentials due to invalid username or password. |
| 2026-10-30 | Wrong password | 50126 | 50126 | AADSTS50126: Error validating credentials due to invalid username or password. |
| 2026-10-31 | Wrong password | 50126 | 50126 | AADSTS50126: Error validating credentials due to invalid username or password. |
| 2026-10-31 | Wrong password | 50126 | 50126 | AADSTS50126: Error validating credentials due to invalid username or password. |

## Sources

1. [Microsoft Entra authentication and authorization error codes](https://learn.microsoft.com/en-us/entra/identity-platform/reference-error-codes)
2. [Password spray investigation (Microsoft incident response playbook)](https://learn.microsoft.com/en-us/security/operations/incident-response-playbook-password-spray)
3. [Protect user accounts from attacks with Microsoft Entra smart lockout](https://learn.microsoft.com/en-us/entra/identity/authentication/howto-password-smart-lockout)
4. [Sign-in log activity details](https://learn.microsoft.com/en-us/entra/identity/monitoring-health/concept-sign-in-log-activity-details)
5. [SigninLogs table reference (Azure Monitor)](https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/signinlogs)
6. [What is Conditional Access? (Microsoft Entra)](https://learn.microsoft.com/en-us/entra/identity/conditional-access/overview)

## Related codes

[AADSTS50053](https://brambrinkmeier.com/entra/aadsts/50053/), [AADSTS50057](https://brambrinkmeier.com/entra/aadsts/50057/), [AADSTS50055](https://brambrinkmeier.com/entra/aadsts/50055/), [AADSTS50034](https://brambrinkmeier.com/entra/aadsts/50034/), [AADSTS53003](https://brambrinkmeier.com/entra/aadsts/53003/), [AADSTS50076](https://brambrinkmeier.com/entra/aadsts/50076/), [AADSTS50052](https://brambrinkmeier.com/entra/aadsts/50052/), [AADSTS50054](https://brambrinkmeier.com/entra/aadsts/50054/), [AADSTS50074](https://brambrinkmeier.com/entra/aadsts/50074/), [AADSTS50079](https://brambrinkmeier.com/entra/aadsts/50079/), [AADSTS50125](https://brambrinkmeier.com/entra/aadsts/50125/), [AADSTS50133](https://brambrinkmeier.com/entra/aadsts/50133/), [AADSTS50140](https://brambrinkmeier.com/entra/aadsts/50140/), [AADSTS50158](https://brambrinkmeier.com/entra/aadsts/50158/), [AADSTS53000](https://brambrinkmeier.com/entra/aadsts/53000/), [AADSTS70002](https://brambrinkmeier.com/entra/aadsts/70002/), [AADSTS500121](https://brambrinkmeier.com/entra/aadsts/500121/), [AADSTS530032](https://brambrinkmeier.com/entra/aadsts/530032/), [AADSTS900144](https://brambrinkmeier.com/entra/aadsts/900144/)

## License and citation

CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). CC BY 4.0 covers the author's own text and classification fields. Quoted Microsoft error wording belongs to Microsoft, is quoted with its source and can change.

Cite as: Bram Brinkmeier, "AADSTS50126: Invalid username or password", https://brambrinkmeier.com/entra/aadsts/50126/ (CC BY 4.0), last updated 2026-10-30.