TOOLBOX · TOOL
AADSTS50126, 53003 or 65001? Paste an error code and read what is behind the Microsoft Entra ID sign-in error and who can fix it.
Account and Password · action: user
Meaning: The user name or password is wrong. A few of these errors are normal because people mistype.
Next step: Check the sign-in name and password. Many of these errors for one account in a short time are a reason to review the sign-in logs.
Current text at MicrosoftAccount and Password · action: user
Meaning: The account does not exist in this directory. Often the sign-in name is mistyped or the application asks the wrong tenant.
Next step: Check the sign-in name. If the person should have access, create the account or invite them as a guest.
Current text at MicrosoftAccount and Password · action: administrator
Meaning: The sign-in was locked: either after too many wrong attempts or because it came from an IP address with malicious activity.
Next step: Read the reason for error 50053 in the sign-in logs. If many failed attempts come from unknown addresses, review the account and have the password changed.
Current text at MicrosoftAccount and Password · action: user
Meaning: The password has expired and the session was ended.
Next step: Reset the password yourself if self-service is enabled, or have an administrator reset it.
Current text at MicrosoftAccount and Password · action: user
Meaning: No password is stored for this account in the directory, or none was submitted.
Next step: Enter the password again. If the error persists, an administrator checks how the account was created or synchronized.
Current text at MicrosoftAccount and Password · action: administrator
Meaning: The user account is disabled.
Next step: Check whether the block is intended (employee left, incident). Otherwise re-enable the account, for synchronized accounts in the on-premises Active Directory.
Current text at MicrosoftAccount and Password · action: user
Meaning: The password in the on-premises Active Directory has expired.
Next step: Set a new password with self-service password reset or have an administrator assign one.
Current text at MicrosoftAccount and Password · action: user
Meaning: A detected risk for the account requires a password change.
Next step: Change the password. An administrator should check why the account is considered at risk.
Current text at MicrosoftAccount and Password · action: user
Meaning: A Conditional Access policy requires a password change.
Next step: Change the password and sign in again.
Current text at MicrosoftMultifactor Authentication · action: user
Meaning: This access requires multifactor authentication, for example because of a new policy or a new location.
Next step: Sign in again and confirm the second factor; the application must request a new sign-in for this.
Current text at MicrosoftMultifactor Authentication · action: user
Meaning: The account must first register security information for multifactor authentication.
Next step: Follow the registration steps and, for example, set up the Authenticator app.
Current text at MicrosoftMultifactor Authentication · action: user
Meaning: Strong authentication is required, but the second factor could not be confirmed.
Next step: Sign in again and confirm the second factor.
Current text at MicrosoftMultifactor Authentication · action: user
Meaning: The last multifactor authentication has expired under the tenant’s policies.
Next step: Sign in again and confirm the second factor.
Current text at MicrosoftMultifactor Authentication · action: user
Meaning: Registration for multifactor authentication must be completed before access; the identifier names a risk as the reason.
Next step: Register for multifactor authentication. If that fails, an administrator reviews the risk for the account.
Current text at MicrosoftMultifactor Authentication · action: user
Meaning: An additional check outside the sign-in is pending, for example terms of use or another vendor’s MFA service. On its own, this is not an error.
Next step: Follow the redirect. The sign-in log shows whether the check succeeded.
Current text at MicrosoftConditional Access and Devices · action: administrator
Meaning: A Conditional Access policy blocks access.
Next step: Check in the sign-in log which policy applied. If the block is unexpected, review that policy or ask an administrator.
Current text at MicrosoftConditional Access and Devices · action: user
Meaning: The policy requires a compliant device, and this device is not compliant.
Next step: Register the device in device management (for example Microsoft Intune) and fix the reported settings.
Current text at MicrosoftConditional Access and Devices · action: user
Meaning: The policy requires a domain-joined device.
Next step: Use a company device or ask an administrator.
Current text at MicrosoftConditional Access and Devices · action: user
Meaning: Only approved apps may access this resource, and this app is not one of them.
Next step: Use one of the approved apps; an administrator defines which ones.
Current text at MicrosoftConditional Access and Devices · action: administrator
Meaning: A tenant-level security policy blocks the request.
Next step: Check whether the request can meet the tenant’s security policies.
Current text at MicrosoftConditional Access and Devices · action: user
Meaning: The device must identify itself during sign-in, and it did not.
Next step: Check whether the device is registered in Microsoft Entra ID; otherwise ask an administrator.
Current text at MicrosoftGuests and Tenant · action: administrator
Meaning: The account from another identity provider does not exist in this tenant and has no access to the application.
Next step: Invite the person as a guest. They sign out and sign in again with the correct account.
Current text at MicrosoftGuests and Tenant · action: administrator
Meaning: The external account does not exist in this tenant and therefore cannot meet the MFA requirements. For synchronized accounts, the ImmutableID may also not match.
Next step: Add the person as a guest. For synchronized accounts, align the source anchor attribute (sourceAnchor).
Current text at MicrosoftGuests and Tenant · action: user
Meaning: The account does not exist in the application’s tenant. Common when signing in with a personal Microsoft account that has no directory.
Next step: Sign out and sign in with the work account, or ask to be invited to the tenant as a guest.
Current text at MicrosoftGuests and Tenant · action: developer
Meaning: The specified tenant does not exist. Often the domain is not registered or the application asks the wrong cloud.
Next step: Check the tenant ID or domain in the application.
Current text at MicrosoftSession and Token · action: user
Meaning: The session is not enough for a sign-in without a prompt (single sign-on): nobody is signed in. This is common before someone signs in.
Next step: Sign in normally. If the error occurs despite being signed in, the session was not found or is invalid: sign in again.
Current text at MicrosoftSession and Token · action: user
Meaning: The session is no longer valid because the password expired or was changed recently.
Next step: Sign in again with the current password.
Current text at MicrosoftSession and Token · action: user
Meaning: The grant was revoked, usually after a password change or reset. A new token is required.
Next step: Sign in again.
Current text at MicrosoftSession and Token · action: user
Meaning: The refresh token expired after a longer period of inactivity.
Next step: Sign in again.
Current text at MicrosoftSession and Token · action: user
Meaning: The sign-in took too long and its intermediate state expired.
Next step: Start the sign-in from the beginning.
Current text at MicrosoftSession and Token · action: user
Meaning: The “Stay signed in?” prompt briefly interrupted the sign-in. This is part of the normal flow.
Next step: Nothing to do: answer the prompt and the sign-in continues.
Current text at MicrosoftApps and Consent · action: administrator
Meaning: Neither the person nor an administrator has granted the application the required permissions.
Next step: Consent to the application; for organization-wide permissions, an administrator does this.
Current text at MicrosoftApps and Consent · action: user
Meaning: Consent to the application’s permissions was declined.
Next step: Sign in again and consent if the application is trustworthy.
Current text at MicrosoftApps and Consent · action: administrator
Meaning: An administrator must consent to this application.
Next step: An administrator reviews the application and grants or declines consent.
Current text at MicrosoftApps and Consent · action: administrator
Meaning: The signed-in person is not assigned to the application.
Next step: Assign the person or their group to the enterprise application.
Current text at MicrosoftApps and Consent · action: developer
Meaning: The application is not known in this tenant: not set up, wrong application ID or wrong tenant.
Next step: Check the application (client) ID and tenant in the configuration.
Current text at MicrosoftApps and Consent · action: administrator
Meaning: The requested resource (API) is not set up in this tenant.
Next step: Check that the request goes to the correct tenant and that the application is installed there.
Current text at MicrosoftApps and Consent · action: developer
Meaning: The reply address (redirect URI) is missing or does not match the addresses in the app registration.
Next step: Add the exact address from the request in the app registration under “Authentication”.
Current text at MicrosoftApps and Consent · action: developer
Meaning: The application’s client secret is wrong.
Next step: Check the stored secret or create a new one.
Current text at MicrosoftApps and Consent · action: developer
Meaning: The application’s client secret has expired.
Next step: Create a new secret or, more securely, use a certificate as the credential.
Current text at MicrosoftSource: Microsoft Learn, “Microsoft Entra authentication and authorization error codes”, taken on Oct 25, 2026. Microsoft may change codes and texts at any time; Microsoft’s error page for each code is authoritative.
HOW TO READ THE ERROR
For each of the 40 codes you see what it means, who can typically act and what to do next. Our glossary explains the basics: Microsoft Entra ID, Conditional Access, multifactor authentication and single sign-on; for repeated sign-in errors, credential stuffing and MFA fatigue.
Source: Microsoft Learn, “Microsoft Entra authentication and authorization error codes”, taken on Oct 25, 2026. Microsoft Entra is a trademark of Microsoft Corporation; this tool is not a Microsoft offering.
MORE ON MICROSOFT 365
When sign-in errors pile up, the cause often lies in policies, devices or guest access. More tools and support:
The token decoder shows what a Microsoft Entra ID access token contains, with claims and expiration. Browser only.
Open Token DecoderYour domain’s tenant, Exchange Online, SPF, DKIM and DMARC checked from the outside.
Open Domain Check (German)Review access policies, devices and licenses, run a pilot and plan the rollout.
Learn MoreQUESTIONS
When a sign-in to Microsoft Entra ID fails, Microsoft’s sign-in service (Security Token Service, STS) returns a code made of AADSTS and a number, such as AADSTS50126 for a wrong user name or password. The code appears in the error message in the browser, in the app or in the sign-in logs.
No. The explainer only looks up a table that was loaded with the page. Only when you click “Current text at Microsoft” does Microsoft’s error page open with the code in its address.
Microsoft has a great many codes, and many of them only concern developers of specific sign-in flows. We explain a selection of 40 codes that occur frequently during sign-ins in organizations. For any other code, the link leads directly to Microsoft’s error page.
Taken on Oct 25, 2026 from the Microsoft Learn page “Microsoft Entra authentication and authorization error codes”. Microsoft notes there that codes and messages can change at any time and refers to login.microsoftonline.com/error for the current status. The explanations here are our own short summaries, not translations.
In the Microsoft Entra admin center under Monitoring & health, Sign-in logs. Each failed sign-in lists the error code, the reason and, for Conditional Access, which policy applied. For Microsoft support, the Trace ID and Correlation ID from the error message help with diagnosis.
TOOLBOX
Tenant, Exchange Online, DKIM
View (German)URLs and IP ranges for firewall and proxy
View (German)What is in an access token? Read JWT headers and payloads, with claim explanations and expiration in Vienna time. Browser only; signatures are not verified.
ViewYOUR NEXT STEP
We assess findings, prioritize by risk and put changes into practice on request: as a project with EXPERTS or as ongoing operations with GRID.
