{"generated":"2026-10-18T01:50:41.425Z","source":"https://azureblog.co.uk","count":61,"codes":[{"code":"AADSTS16000","name":"InteractionRequired","meaning":"The account doesn't exist in this tenant and can't access the app.","fix":"Add the user as a guest (B2B) or check they're signing in with the right account.","url":"https://azureblog.co.uk/errors/aadsts16000/"},{"code":"AADSTS50011","name":"InvalidReplyTo","meaning":"The reply URL in the request doesn't match any reply URL configured on the app.","fix":"Compare the redirect URI or ACS URL the app sends with the app registration or Enterprise App, including trailing slashes, http vs https and case.","url":"https://azureblog.co.uk/errors/aadsts50011/"},{"code":"AADSTS50020","name":"UserUnauthorized","meaning":"The user's account isn't from this tenant and can't access the app.","fix":"Invite the user as a guest, or point the app at the right tenant (or the common or organizations endpoint).","url":"https://azureblog.co.uk/errors/aadsts50020/"},{"code":"AADSTS50034","name":"UserAccountNotFound","meaning":"The account doesn't exist in the directory.","fix":"Check for a typo in the username, or a missing or wrong UPN suffix.","url":"https://azureblog.co.uk/errors/aadsts50034/"},{"code":"AADSTS50053","name":"IdsLocked","meaning":"The account is locked after too many failed sign-ins, or the sign-in came from an IP with malicious activity.","fix":"Wait for Smart Lockout to clear and investigate the source IPs in the sign-in logs for password spray.","url":"https://azureblog.co.uk/errors/aadsts50053/"},{"code":"AADSTS50055","name":"InvalidPasswordExpiredPassword","meaning":"The password has expired.","fix":"Have the user reset it with SSPR, or reset it for them.","url":"https://azureblog.co.uk/errors/aadsts50055/"},{"code":"AADSTS50056","name":"Invalid or null password","meaning":"No password exists in the directory for this user.","fix":"Common with federated or passwordless-only accounts. Check the authentication method the app is trying to use.","url":"https://azureblog.co.uk/errors/aadsts50056/"},{"code":"AADSTS50057","name":"UserDisabled","meaning":"The user account is disabled.","fix":"Check whether that's intended (a leaver, or HR-driven provisioning) before re-enabling.","url":"https://azureblog.co.uk/errors/aadsts50057/"},{"code":"AADSTS50058","name":"UserInformationNotProvided","meaning":"There wasn't enough session information for single sign-on. The user usually isn't signed in.","fix":"Usually harmless in silent sign-in attempts. Apps should fall back to an interactive sign-in.","url":"https://azureblog.co.uk/errors/aadsts50058/"},{"code":"AADSTS50064","name":"CredentialAuthenticationError","meaning":"Credential validation on the username or password failed.","fix":"Check the credentials, and for hybrid users check the on-premises agent or federation service.","url":"https://azureblog.co.uk/errors/aadsts50064/"},{"code":"AADSTS50072","name":"UserStrongAuthEnrollmentRequiredInterrupt","meaning":"The user needs to register for MFA.","fix":"Expected during first sign-in. Make sure registration isn't blocked by a Conditional Access policy on security info registration.","url":"https://azureblog.co.uk/errors/aadsts50072/"},{"code":"AADSTS50074","name":"UserStrongAuthClientAuthNRequiredInterrupt","meaning":"Strong authentication was required and the user didn't pass the MFA challenge.","fix":"Often expected mid-flow. If it repeats, check the user's registered methods.","url":"https://azureblog.co.uk/errors/aadsts50074/"},{"code":"AADSTS50076","name":"UserStrongAuthClientAuthNRequired","meaning":"MFA is required because of an admin configuration such as Conditional Access.","fix":"Expected when the user hasn't done MFA yet. Non-interactive clients must do an interactive sign-in.","url":"https://azureblog.co.uk/errors/aadsts50076/"},{"code":"AADSTS50079","name":"UserStrongAuthEnrollmentRequired","meaning":"The user must register security info because of an admin configuration change.","fix":"Guide the user through registration, or issue a Temporary Access Pass.","url":"https://azureblog.co.uk/errors/aadsts50079/"},{"code":"AADSTS50089","name":"Flow token expired","meaning":"The sign-in took too long and the flow token expired.","fix":"Ask the user to sign in again without leaving the page open.","url":"https://azureblog.co.uk/errors/aadsts50089/"},{"code":"AADSTS50097","name":"DeviceAuthenticationRequired","meaning":"Device authentication is required.","fix":"Check the device's registration state (dsregcmd /status on Windows) and its Primary Refresh Token.","url":"https://azureblog.co.uk/errors/aadsts50097/"},{"code":"AADSTS50105","name":"EntitlementGrantsNotFound","meaning":"The user isn't assigned to the app, and the app requires assignment.","fix":"Assign the user or a group they're in on the Enterprise App's Users and groups blade.","url":"https://azureblog.co.uk/errors/aadsts50105/"},{"code":"AADSTS50107","name":"Federation realm not found","meaning":"The requested federation realm object doesn't exist.","fix":"Check the domain's federation configuration, or the issuer the SAML app sends.","url":"https://azureblog.co.uk/errors/aadsts50107/"},{"code":"AADSTS50126","name":"InvalidUserNameOrPassword","meaning":"The username or password is wrong.","fix":"Some are normal user error. Many from one IP across many users suggests password spray.","url":"https://azureblog.co.uk/errors/aadsts50126/"},{"code":"AADSTS50128","name":"Invalid domain name","meaning":"No tenant-identifying information was found in the request.","fix":"Check the username's domain is verified in a tenant, and the app uses the right authority URL.","url":"https://azureblog.co.uk/errors/aadsts50128/"},{"code":"AADSTS50131","name":"ConditionalAccessFailed","meaning":"A Conditional Access failure such as bad device state, suspicious activity or a policy decision.","fix":"Open the sign-in log entry's Conditional Access tab to see which policy failed and why.","url":"https://azureblog.co.uk/errors/aadsts50131/"},{"code":"AADSTS50132","name":"SsoArtifactInvalidOrExpired","meaning":"The session isn't valid because of password expiry or a recent password change.","fix":"Sign in again with the new password.","url":"https://azureblog.co.uk/errors/aadsts50132/"},{"code":"AADSTS50133","name":"SsoArtifactRevoked","meaning":"The session isn't valid because of password expiry or a recent password change.","fix":"Sign in again. Sessions may also have been revoked by an admin.","url":"https://azureblog.co.uk/errors/aadsts50133/"},{"code":"AADSTS50135","name":"PasswordChangeCompromisedPassword","meaning":"A password change is required because of account risk.","fix":"Review the risk in ID Protection and have the user change their password securely.","url":"https://azureblog.co.uk/errors/aadsts50135/"},{"code":"AADSTS50140","name":"KmsiInterrupt","meaning":"The 'Keep me signed in?' prompt.","fix":"Expected and harmless. It appears in logs as an interrupt, not a failure.","url":"https://azureblog.co.uk/errors/aadsts50140/"},{"code":"AADSTS50144","name":"InvalidPasswordExpiredOnPremPassword","meaning":"The user's Active Directory password has expired.","fix":"Reset it on-premises, or enable password writeback so SSPR can reset it.","url":"https://azureblog.co.uk/errors/aadsts50144/"},{"code":"AADSTS50146","name":"MissingCustomSigningKey","meaning":"The app needs an app-specific signing key, which is missing, expired or not yet valid.","fix":"Check the SAML signing certificate on the Enterprise App and its expiry.","url":"https://azureblog.co.uk/errors/aadsts50146/"},{"code":"AADSTS50155","name":"DeviceAuthenticationFailed","meaning":"Device authentication failed for this user.","fix":"Re-register the device or check that the device object is enabled in Entra.","url":"https://azureblog.co.uk/errors/aadsts50155/"},{"code":"AADSTS50158","name":"External security challenge","meaning":"The user was sent to an external challenge such as terms of use or third-party MFA.","fix":"Expected in the flow. On its own it doesn't mean the sign-in failed.","url":"https://azureblog.co.uk/errors/aadsts50158/"},{"code":"AADSTS50173","name":"Grant expired","meaning":"The grant was revoked, often because the user changed or reset their password.","fix":"Sign in again to get a fresh token.","url":"https://azureblog.co.uk/errors/aadsts50173/"},{"code":"AADSTS50196","name":"LoopDetected","meaning":"The app made too many of the same request in a short time.","fix":"A bug in the app's token handling. Check that it caches tokens.","url":"https://azureblog.co.uk/errors/aadsts50196/"},{"code":"AADSTS50199","name":"CmsiInterrupt","meaning":"User confirmation is needed because a system webview requested a token for a native app.","fix":"Expected anti-spoofing prompt. The user should confirm.","url":"https://azureblog.co.uk/errors/aadsts50199/"},{"code":"AADSTS51004","name":"UserAccountNotInDirectory","meaning":"The user account doesn't exist in the directory.","fix":"Check the username and tenant.","url":"https://azureblog.co.uk/errors/aadsts51004/"},{"code":"AADSTS53000","name":"DeviceNotCompliant","meaning":"Conditional Access requires a compliant device and this one isn't compliant.","fix":"Check the device in Intune's compliance report, and that the user is signing in from a managed, registered device.","url":"https://azureblog.co.uk/errors/aadsts53000/"},{"code":"AADSTS53001","name":"DeviceNotDomainJoined","meaning":"Conditional Access requires a hybrid joined device.","fix":"Check the device's join state with dsregcmd /status.","url":"https://azureblog.co.uk/errors/aadsts53001/"},{"code":"AADSTS53002","name":"ApplicationUsedIsNotAnApprovedApp","meaning":"The app used isn't an approved app for Conditional Access.","fix":"Use an approved client app, such as Outlook mobile instead of a native mail app.","url":"https://azureblog.co.uk/errors/aadsts53002/"},{"code":"AADSTS53003","name":"BlockedByConditionalAccess","meaning":"Access was blocked by a Conditional Access policy.","fix":"Open the sign-in log entry's Conditional Access tab to find the blocking policy, then use What If to test.","url":"https://azureblog.co.uk/errors/aadsts53003/"},{"code":"AADSTS53004","name":"ProofUpBlockedDueToRisk","meaning":"The user must complete MFA registration first, but registration is blocked because of risk.","fix":"Investigate the user's risk, then issue a Temporary Access Pass if appropriate.","url":"https://azureblog.co.uk/errors/aadsts53004/"},{"code":"AADSTS54005","name":"Authorization code already redeemed","meaning":"The OAuth2 authorization code was already used.","fix":"An app bug. Each code can be redeemed once; use the refresh token instead.","url":"https://azureblog.co.uk/errors/aadsts54005/"},{"code":"AADSTS65001","name":"DelegationDoesNotExist","meaning":"The user or an admin hasn't consented to the app.","fix":"Grant admin consent, or let the user consent if your consent settings allow it.","url":"https://azureblog.co.uk/errors/aadsts65001/"},{"code":"AADSTS65004","name":"UserDeclinedConsent","meaning":"The user declined consent.","fix":"Expected if the user chose to. If they need the app, use the admin consent workflow.","url":"https://azureblog.co.uk/errors/aadsts65004/"},{"code":"AADSTS70000","name":"InvalidGrant","meaning":"Authentication failed because the refresh token isn't valid.","fix":"Sign in again.","url":"https://azureblog.co.uk/errors/aadsts70000/"},{"code":"AADSTS70008","name":"ExpiredOrRevokedGrant","meaning":"The refresh token expired due to inactivity.","fix":"Sign in again. This is expected after long inactivity.","url":"https://azureblog.co.uk/errors/aadsts70008/"},{"code":"AADSTS70011","name":"InvalidScope","meaning":"The scope the app requested is invalid.","fix":"Check the scope format in the app, such as https://graph.microsoft.com/.default for client credentials.","url":"https://azureblog.co.uk/errors/aadsts70011/"},{"code":"AADSTS70043","name":"BadTokenDueToSignInFrequency","meaning":"The refresh token is invalid because of Conditional Access sign-in frequency.","fix":"Expected when the sign-in frequency is reached. The user signs in again.","url":"https://azureblog.co.uk/errors/aadsts70043/"},{"code":"AADSTS75005","name":"Saml2MessageInvalid","meaning":"Entra doesn't support the SAML request the app sent.","fix":"Decode the request (try the SAML decoder) and check the binding and format.","url":"https://azureblog.co.uk/errors/aadsts75005/"},{"code":"AADSTS75011","name":"NoMatchedAuthnContextInOutputClaims","meaning":"The authentication method used doesn't match the one the app requested.","fix":"The app sent a RequestedAuthnContext with an exact comparison. Ask the vendor to remove it or use minimum.","url":"https://azureblog.co.uk/errors/aadsts75011/"},{"code":"AADSTS81010","name":"DesktopSsoAuthTokenInvalid","meaning":"Seamless SSO failed because the Kerberos ticket is expired or invalid.","fix":"Check the AZUREADSSOACC computer account and roll its Kerberos decryption key if it's overdue.","url":"https://azureblog.co.uk/errors/aadsts81010/"},{"code":"AADSTS90072","name":"PassThroughUserMfaError","meaning":"The external account doesn't exist in the tenant, so it can't satisfy the tenant's MFA.","fix":"Invite the user as a guest, or check cross-tenant trust settings for MFA.","url":"https://azureblog.co.uk/errors/aadsts90072/"},{"code":"AADSTS90094","name":"AdminConsentRequired","meaning":"Admin consent is required.","fix":"An admin must grant consent, or the user can request it via the admin consent workflow.","url":"https://azureblog.co.uk/errors/aadsts90094/"},{"code":"AADSTS500011","name":"InvalidResourceServicePrincipalNotFound","meaning":"The resource the app asked for wasn't found in the tenant.","fix":"Check the resource or scope URI, and that the resource app is installed and consented in this tenant.","url":"https://azureblog.co.uk/errors/aadsts500011/"},{"code":"AADSTS500014","name":"InvalidResourceServicePrincipalDisabled","meaning":"The resource's service principal is disabled.","fix":"Check whether the Enterprise App was disabled on purpose. A lapsed subscription can also disable it.","url":"https://azureblog.co.uk/errors/aadsts500014/"},{"code":"AADSTS530032","name":"BlockedByConditionalAccessOnSecurityPolicy","meaning":"A tenant security policy blocks the request.","fix":"Check Conditional Access and security defaults in the sign-in log entry.","url":"https://azureblog.co.uk/errors/aadsts530032/"},{"code":"AADSTS650056","name":"Misconfigured application","meaning":"The app is misconfigured: missing permissions, missing admin consent, or a mismatched client ID or certificate.","fix":"Review the app registration's API permissions and consent status.","url":"https://azureblog.co.uk/errors/aadsts650056/"},{"code":"AADSTS700016","name":"UnauthorizedClient_DoesNotMatchRequest","meaning":"The application wasn't found in the directory.","fix":"Check the client ID and that the app is signing in to the right tenant.","url":"https://azureblog.co.uk/errors/aadsts700016/"},{"code":"AADSTS700027","name":"Client assertion signature failed","meaning":"The client assertion failed signature validation.","fix":"The certificate used to sign doesn't match one uploaded to the app registration, or it has expired.","url":"https://azureblog.co.uk/errors/aadsts700027/"},{"code":"AADSTS700054","name":"ID token implicit grant not enabled","meaning":"response_type 'id_token' isn't enabled for the app.","fix":"Enable ID tokens for implicit grant on the app registration, or better, move to the authorization code flow.","url":"https://azureblog.co.uk/errors/aadsts700054/"},{"code":"AADSTS700082","name":"ExpiredOrRevokedGrantInactiveToken","meaning":"The refresh token expired due to inactivity.","fix":"Expected. The user signs in again.","url":"https://azureblog.co.uk/errors/aadsts700082/"},{"code":"AADSTS900144","name":"Missing required parameter","meaning":"The request body is missing a required parameter.","fix":"A developer error. Check the request against the OAuth or OpenID Connect spec.","url":"https://azureblog.co.uk/errors/aadsts900144/"},{"code":"AADSTS900971","name":"No reply address","meaning":"No reply address was provided.","fix":"Add a redirect URI to the request and the app registration.","url":"https://azureblog.co.uk/errors/aadsts900971/"},{"code":"AADSTS9002313","name":"InvalidRequest","meaning":"The request is malformed or invalid.","fix":"Capture the request (browser dev tools or Fiddler) and check its format.","url":"https://azureblog.co.uk/errors/aadsts9002313/"}]}