AADSTS50053

What it means

The account is locked after too many failed sign-ins, or the sign-in came from an IP with malicious activity.

How to fix it

Wait for Smart Lockout to clear and investigate the source IPs in the sign-in logs for password spray.

How to investigate

1. Confirm which account the user actually signed in with. A personal account or the wrong tenant causes many of these.
2. Check the user object: enabled, licensed, in the right tenant, and with no recent password change or reset.
3. Look at the sign-in logs over a few days for a pattern, such as repeated failures from one IP address.
4. Search the sign-in logs for the request ID or correlation ID from the troubleshooting details on the error page.

Guides on this site

• Six KQL queries for Entra sign-in logs every admin should keep

Tools that help

• Sign-in log explainer
• KQL library
• Microsoft's error lookup for 50053 ↗