Microsoft Entra user sign-in and session errors (AADSTS)
Look up an AADSTS error raised for a signed-in user — account not found or not in the tenant, not assigned to the app, MFA or conditional access required or blocking, compliant device required, locked or disabled accounts, expired or revoked sessions and refresh tokens, authorization codes reused — with the cause, the check and the fix, and why automation should not sign in as a user.
markdownreferencev1978F-F4CYstage: operatetrust: officialservice: entrainterface: anyAADSTS50034AADSTS50020AADSTS50105AADSTS50076AADSTS50079AADSTS53003AADSTS53000AADSTS50126AADSTS50053AADSTS50057AADSTS50055AADSTS50058AADSTS50173AADSTS70043AADSTS700082AADSTS70008AADSTS54005AADSTS50133AADSTS500021AADSTS70016interaction_requiredconditional access blockedMFA requiredrefresh token expireduser not assigned to applicationguest user not in tenant
Microsoft Entra user sign-in and session errors
These errors are about a person, their session or a tenant policy, so most can't be fixed in code. What code can do: interactively request the token when the OAuth error is interaction_required, and stop using user credentials for automation. A script, pipeline or service should sign in as a managed identity or a workload identity (guides/entra/github-actions-oidc.md), because MFA and conditional access apply to users and will break an unattended user sign-in the day an admin turns them on.
Check for every row: the Microsoft Entra sign-in logs (admin center → Sign-in logs), filtered by the correlation_id from the error response. The entry names the user, the app, the conditional access policies applied and the failure reason.
Account and assignment
| Code | Cause → fix | Check |
|---|---|---|
AADSTS50034 UserAccountNotFound | The account isn't in this directory: mistyped name, or the wrong tenant in the URL | The sign-in log shows the tenant the request went to |
AADSTS50020 UserUnauthorized | The account from that identity provider doesn't exist in this tenant: invite it as an external (B2B) user first, or sign in with an account of this tenant | The sign-in log; for your own app, az ad app show --id <client-id> --query signInAudience |
AADSTS50105 EntitlementGrantsNotFound | The app requires assignment and this user (or their group) isn't assigned to it | The enterprise app's Users and groups |
AADSTS50126 InvalidUserNameOrPassword | Wrong username or password | — |
AADSTS50053 | The account is locked after repeated failed attempts, or the sign-in came from an IP address with malicious activity | Sign-in log failure reason |
AADSTS50057 UserDisabled | The account is disabled | User's Account enabled in the admin center |
AADSTS50055 InvalidPasswordExpiredPassword | The password expired; the user must reset it | — |
AADSTS500021 | Tenant restrictions block access to that tenant from this network | Proxy / tenant restriction settings of the user's network |
MFA and conditional access
| Code | Cause → fix | Check |
|---|---|---|
AADSTS50076 UserStrongAuthClientAuthNRequired | MFA is required (a policy, per-user MFA, or a new location). Sign in interactively; for automation, switch to a workload identity | Sign-in log → Conditional Access tab |
AADSTS50079 UserStrongAuthEnrollmentRequired | The user must register for MFA first | Same |
AADSTS53003 BlockedByConditionalAccess | A conditional access policy blocked token issuance | The sign-in log names the policy |
AADSTS53000 DeviceNotCompliant | A policy requires a compliant (managed) device | Device's compliance state |
AADSTS50058 UserInformationNotProvided | No session for silent sign-in: expected when the user isn't signed in. Fall back to interactive sign-in | — |
Sessions and tokens
| Code | Cause → fix | Check |
|---|---|---|
AADSTS700082 ExpiredOrRevokedGrantInactiveToken | The refresh token expired from inactivity: sign in again | — |
AADSTS70008 ExpiredOrRevokedGrant | The refresh token or grant expired or was revoked | — |
AADSTS50173 | The grant was revoked, often after a password change or reset. Get a fresh token | — |
AADSTS50133 SsoArtifactRevoked | The session ended after a password change or expiry | — |
AADSTS70043 BadTokenDueToSignInFrequency | A conditional access sign-in frequency limit ended the refresh token | Sign-in log → policy with sign-in frequency |
AADSTS54005 | An authorization code was redeemed twice. Each code is single-use: use the refresh token afterwards | Does your code exchange the same code on retry? |
AADSTS70016 AuthorizationPending | Device code flow: the user hasn't finished yet. Keep polling: this is not a failure | — |
For CLI users, az login (or az login --tenant <tenant-id>) clears most session errors; az account show confirms who is signed in.
When none of these fits
Look the code up at https://login.microsoftonline.com/error?code=<n> and read the sign-in log entry for its correlation ID. App and credential errors are in reference/entra/errors.md.