← cd ~/errors
// entra id sign-in errors
App registration and tokens errors
Mismatches between what an app sends and how it's registered in Entra: redirect URIs, client IDs, secrets, certificates, scopes and tokens.
How to investigate
- Compare what the app sends (client ID, redirect URI, scopes, tenant) with the app registration.
- Decode the token or request: the JWT and SAML decoders on this site show exactly what was sent.
- Check the app's credentials (secrets and certificates) and whether the service principal exists and is enabled in this tenant.
Common errors (18)
- AADSTS50011 InvalidReplyTo
- AADSTS50146 MissingCustomSigningKey
- AADSTS50196 LoopDetected
- AADSTS54005 Authorization code already redeemed
- AADSTS70000 InvalidGrant
- AADSTS70008 ExpiredOrRevokedGrant
- AADSTS70011 InvalidScope
- AADSTS70043 BadTokenDueToSignInFrequency
- AADSTS500011 InvalidResourceServicePrincipalNotFound
- AADSTS500014 InvalidResourceServicePrincipalDisabled
- AADSTS700016 UnauthorizedClient_DoesNotMatchRequest
- AADSTS700027 Client assertion signature failed
- AADSTS700054 ID token implicit grant not enabled
- AADSTS700082 ExpiredOrRevokedGrantInactiveToken
- AADSTS900144 Missing required parameter
- AADSTS900971 No reply address
- AADSTS9002313 InvalidRequest
- AADSTS50107 Federation realm not found
More codes from Microsoft's reference (193)
- AADSTS16003 SsoUserAccountNotFoundInResourceTenant
- AADSTS17003 CredentialKeyProvisioningFailed
- AADSTS50000 TokenIssuanceError
- AADSTS50001 InvalidResource
- AADSTS50002 NotAllowedTenant
- AADSTS50003 MissingSigningKey
- AADSTS50006 InvalidSignature
- AADSTS50007 PartnerEncryptionCertificateMissing
- AADSTS50010 AudienceUriValidationFailed
- AADSTS50012 AuthenticationFailed
- AADSTS50013 InvalidAssertion
- AADSTS50014 GuestUserInPendingState
- AADSTS50017 CertificateValidationFailed
- AADSTS50027 InvalidJwtToken
- AADSTS50029
- AADSTS50032 WeakRsaKey
- AADSTS50033 RetryableError
- AADSTS50042 UnableToGeneratePairwiseIdentifierWithMissingSalt
- AADSTS50043 UnableToGeneratePairwiseIdentifierWithMultipleSalts
- AADSTS50048 SubjectMismatchesIssuer
- AADSTS50049 NoSuchInstanceForDiscovery
- AADSTS50050 MalformedDiscoveryRequest
- AADSTS50059 MissingTenantRealmAndNoUserInformationProvided
- AADSTS50061 SignoutInvalidRequest
- AADSTS50070 SignoutUnknownSessionIdentifier
- AADSTS50071 SignoutMessageExpired
- AADSTS50085
- AADSTS50086 SasNonRetryableError
- AADSTS50098
- AADSTS50099 PKeyAuthInvalidJwtUnauthorized
- AADSTS50100
- AADSTS50101
- AADSTS50102
- AADSTS50103
- AADSTS50108
- AADSTS50109
- AADSTS50111
- AADSTS50117
- AADSTS50120
- AADSTS50123
- AADSTS50129 DeviceIsNotWorkplaceJoined
- AADSTS50130
- AADSTS50134 DeviceFlowAuthorizeWrongDatacenter
- AADSTS50136 RedirectMsaSessionToApp
- AADSTS50137
- AADSTS50138
- AADSTS50139 SessionMissingMsaOAuth2RefreshToken
- AADSTS50141
- AADSTS50143
- AADSTS50147
- AADSTS50148
- AADSTS50149
- AADSTS50156
- AADSTS50157
- AADSTS50159
- AADSTS50160
- AADSTS50161
- AADSTS50162
- AADSTS50163
- AADSTS50164
- AADSTS50165
- AADSTS50166
- AADSTS50167
- AADSTS50168
- AADSTS50169 InvalidRequestBadRealm
- AADSTS50170 MissingExternalClaimsProviderMapping
- AADSTS50171
- AADSTS50172
- AADSTS50176
- AADSTS50180 WindowsIntegratedAuthMissing
- AADSTS50187 DeviceInformationNotProvided
- AADSTS50192
- AADSTS50194
- AADSTS51001 DomainHintMustbePresent
- AADSTS51005 TemporaryRedirect
- AADSTS51006 ForceReauthDueToInsufficientAuth
- AADSTS67003 ActorNotValidServiceIdentity
- AADSTS70001 UnauthorizedClient
- AADSTS70002 InvalidClient
- AADSTS70003 UnsupportedGrantType
- AADSTS70004 InvalidRedirectUri
- AADSTS70007 UnsupportedResponseMode
- AADSTS70016 AuthorizationPending
- AADSTS76021 ApplicationRequiresSignedRequests
- AADSTS80002 OnPremisePasswordValidatorRequestTimedout
- AADSTS80005 OnPremisePasswordValidatorUnpredictableWebException
- AADSTS80014 OnPremisePasswordValidationAuthenticationAgentTimeout
- AADSTS81004 DesktopSsoIdentityInTicketIsNotAuthenticated
- AADSTS81005 DesktopSsoAuthenticationPackageNotSupported
- AADSTS81006 DesktopSsoNoAuthorizationHeader
- AADSTS81007 DesktopSsoTenantIsNotOptIn
- AADSTS81012 DesktopSsoMismatchBetweenTokenUpnAndChosenUpn
- AADSTS90002 InvalidTenantName
- AADSTS90004 InvalidRequestFormat
- AADSTS90005 InvalidRequestWithMultipleRequirements
- AADSTS90006 ExternalServerRetryableError
- AADSTS90007 InvalidSessionId
- AADSTS90009 TokenForItselfMissingIdenticalAppIdentifier
- AADSTS90010 NotSupported
- AADSTS90012 RequestTimeout
- AADSTS90014 MissingRequiredField
- AADSTS90015 QueryStringTooLong
- AADSTS90016 MissingRequiredClaim
- AADSTS90019 MissingTenantRealm
- AADSTS90022 AuthenticatedInvalidPrincipalNameFormat
- AADSTS90023 InvalidRequest
- AADSTS90024 RequestBudgetExceededError
- AADSTS90027
- AADSTS90033 MsodsServiceUnavailable
- AADSTS90036 MsodsServiceUnretryableFailure
- AADSTS90043 NationalCloudAuthCodeRedirection
- AADSTS90051 InvalidNationalCloudId
- AADSTS90055 TenantThrottlingError
- AADSTS90056 BadResourceRequest
- AADSTS90086 OrgIdWsTrustDaTokenExpired
- AADSTS90090 GraphRetryableError
- AADSTS90091 GraphServiceUnreachable
- AADSTS90092 GraphNonRetryableError
- AADSTS90093 GraphUserUnauthorized
- AADSTS90100 InvalidRequestParameter
- AADSTS90101 InvalidEmailAddress
- AADSTS90102 InvalidUriParameter
- AADSTS90107 InvalidXml
- AADSTS90112
- AADSTS90114 InvalidExpiryDate
- AADSTS90117 InvalidRequestInput
- AADSTS90120 InvalidDeviceFlowRequest
- AADSTS90121 InvalidEmptyRequest
- AADSTS90123 IdentityProviderAccessDenied
- AADSTS90124 V1ResourceV2GlobalEndpointNotSupported
- AADSTS90130 NonConvergedAppV2GlobalEndpointNotSupported
- AADSTS100007
- AADSTS120021 PartnerServiceSsprInternalServiceError
- AADSTS130004 NgcKeyNotFound
- AADSTS130005 NgcInvalidSignature
- AADSTS130006 NgcTransportKeyNotFound
- AADSTS130008 NgcDeviceIsNotFound
- AADSTS135010 KeyNotFound
- AADSTS135011
- AADSTS140000 InvalidRequestNonce
- AADSTS140001 InvalidSessionKey
- AADSTS160021 AppSessionSelectionInvalidSessionNotExist
- AADSTS165004
- AADSTS165900 InvalidApiRequest
- AADSTS220450 UnsupportedAndroidWebViewVersion
- AADSTS220501 InvalidCrlDownload
- AADSTS221000 DeviceOnlyTokensNotSupportedByResource
- AADSTS230109 CachedCredentialNonGWAuthNRequestsNotSupported
- AADSTS240001 BulkAADJTokenUnauthorized
- AADSTS240002 RequiredClaimIsMissing
- AADSTS240003
- AADSTS240004
- AADSTS500021
- AADSTS500022
- AADSTS500133
- AADSTS500141
- AADSTS500207
- AADSTS500212 NotAllowedByOutboundPolicyTenant
- AADSTS500213 NotAllowedByInboundPolicyTenant
- AADSTS501461
- AADSTS501481
- AADSTS501491 InvalidCodeChallengeMethodInvalidSize
- AADSTS501621 ClaimsTransformationTimeoutRegularExpressionTimeout
- AADSTS501631
- AADSTS501632
- AADSTS530035 BlockedBySecurityDefaults
- AADSTS650052
- AADSTS650059
- AADSTS700005 InvalidGrantRedeemAgainstWrongTenant
- AADSTS700011 UnauthorizedClientAppNotFoundInOrgIdTenant
- AADSTS700020 InteractionRequired
- AADSTS700025 InvalidClientPublicClientWithCredential
- AADSTS700030
- AADSTS700084
- AADSTS900382
- AADSTS900384
- AADSTS900432
- AADSTS900561 BadResourceRequestInvalidRequest
- AADSTS900612
- AADSTS901002
- AADSTS901012 EmailAddressCollectedFromExternalOidcIDPNotVerified
- AADSTS901014 NoExternalIdentifierCollectedFromExternalOidcIDP
- AADSTS1000031
- AADSTS1000104 XCB2BResourceCloudNotAllowedOnIdentityTenant
- AADSTS5000224 NotAllowedTenantBlockedTenantFraud
- AADSTS5001256
- AADSTS7000112 UnauthorizedClientApplicationDisabled
- AADSTS7000114
- AADSTS7000215
- AADSTS7000218
- AADSTS7000222 InvalidClientSecretExpiredKeysProvided
- AADSTS9001023
- AADSTS9002332