← cd ~/errors
// entra id sign-in errors
Accounts, passwords and sessions errors
Problems with the account itself: wrong password, locked, disabled or expired accounts, the wrong tenant, and expired sessions.
How to investigate
- Confirm which account the user actually signed in with. A personal account or the wrong tenant causes many of these.
- Check the user object: enabled, licensed, in the right tenant, and with no recent password change or reset.
- Look at the sign-in logs over a few days for a pattern, such as repeated failures from one IP address.
Common errors (21)
- AADSTS16000 InteractionRequired
- AADSTS50020 UserUnauthorized
- AADSTS50034 UserAccountNotFound
- AADSTS50053 IdsLocked
- AADSTS50055 InvalidPasswordExpiredPassword
- AADSTS50056 Invalid or null password
- AADSTS50057 UserDisabled
- AADSTS50058 UserInformationNotProvided
- AADSTS50064 CredentialAuthenticationError
- AADSTS50089 Flow token expired
- AADSTS50126 InvalidUserNameOrPassword
- AADSTS50128 Invalid domain name
- AADSTS50132 SsoArtifactInvalidOrExpired
- AADSTS50133 SsoArtifactRevoked
- AADSTS50135 PasswordChangeCompromisedPassword
- AADSTS50140 KmsiInterrupt
- AADSTS50144 InvalidPasswordExpiredOnPremPassword
- AADSTS50173 Grant expired
- AADSTS50199 CmsiInterrupt
- AADSTS51004 UserAccountNotInDirectory
- AADSTS81010 DesktopSsoAuthTokenInvalid
More codes from Microsoft's reference (44)
- AADSTS16001 UserAccountSelectionInvalid
- AADSTS16002 AppSessionSelectionInvalid
- AADSTS50068 SignoutInitiatorNotParticipant
- AADSTS50125 PasswordResetRegistrationRequiredInterrupt
- AADSTS50127 BrokerAppNotInstalled
- AADSTS50177 ExternalChallengeNotSupportedForPassthroughUsers
- AADSTS50178 SessionControlNotSupportedForPassthroughUsers
- AADSTS50197 ConflictingIdentities
- AADSTS51000 RequiredFeatureNotEnabled
- AADSTS53011
- AADSTS54000 MinorUserBlockedLegalAgeGroupRule
- AADSTS70012 MsaServerError
- AADSTS70018 BadVerificationCode
- AADSTS70019 CodeExpired
- AADSTS80001 OnPremiseStoreIsNotAvailable
- AADSTS80007 OnPremisePasswordValidatorErrorOccurredOnPrem
- AADSTS80010 OnPremisePasswordValidationEncryptionException
- AADSTS80012 OnPremisePasswordValidationAccountLogonInvalidHours
- AADSTS80013 OnPremisePasswordValidationTimeSkew
- AADSTS81009 DesktopSsoAuthorizationHeaderValueWithBadFormat
- AADSTS81011 DesktopSsoLookupUserBySidFailed
- AADSTS90013 InvalidUserInput
- AADSTS90119 InvalidUserCode
- AADSTS90125 DebugModeEnrollTenantNotFound
- AADSTS90126 DebugModeEnrollTenantNotInferred
- AADSTS120000 PasswordChangeIncorrectCurrentPassword
- AADSTS120002 PasswordChangeInvalidNewPasswordWeak
- AADSTS120003 PasswordChangeInvalidNewPasswordContainsMemberName
- AADSTS120004 PasswordChangeOnPremComplexity
- AADSTS120005 PasswordChangeOnPremSuccessCloudFail
- AADSTS120008 PasswordChangeAsyncJobStateTerminated
- AADSTS120011 PasswordChangeAsyncUpnInferenceFailed
- AADSTS120012 PasswordChangeNeedsToHappenOnPrem
- AADSTS120013 PasswordChangeOnPremisesConnectivityFailure
- AADSTS120014 PasswordChangeOnPremUserAccountLockedOutOrDisabled
- AADSTS120015 PasswordChangeADAdminActionRequired
- AADSTS120016 PasswordChangeUserNotFoundBySspr
- AADSTS120018 PasswordChangePasswordDoesnotComplyFuzzyPolicy
- AADSTS120020 PasswordChangeFailure
- AADSTS500208
- AADSTS530034 DelegatedAdminBlockedDueToSuspiciousActivity
- AADSTS901011 NoEmailAddressCollectedFromExternalOidcIDP
- AADSTS1000000 UserNotBoundError
- AADSTS1000002 BindCompleteInterruptError