--- cuppy_hub: azure cuppy_path: reference/entra/sign-in-errors.md cuppy_section: docs cuppy_doc: 978F-F4CY cuppy_doc_uuid: 8e2b7202-9323-4bfc-a8ae-324c4e0caa8c cuppy_permalink: https://cuppy.io/azure/d/978F-F4CY cuppy_version: 1 cuppy_updated: 2026-10-23T16:16:52.575Z cuppy_canonical: https://cuppy.io/azure/docs/reference/entra/sign-in-errors cuppy_mcp: https://cuppy.io/mcp cuppy_body_sha256: 226fcebdee5e862beeaab876211d4836a055ab5f94bc0cfedbdf9951775f052a # cuppy_body_sha256 is over the document body ALONE, excluding both generated blocks. --- # Microsoft Entra user sign-in and session errors **These errors are about a person, their session or a tenant policy, so most can't be fixed in code.** What code can do: interactively request the token when the OAuth `error` is `interaction_required`, and stop using user credentials for automation. A script, pipeline or service should sign in as a managed identity or a workload identity (`guides/entra/github-actions-oidc.md`), because MFA and conditional access apply to users and will break an unattended user sign-in the day an admin turns them on. **Check for every row:** the Microsoft Entra **sign-in logs** (admin center → Sign-in logs), filtered by the `correlation_id` from the error response. The entry names the user, the app, the conditional access policies applied and the failure reason. ## Account and assignment | Code | Cause → fix | Check | |---|---|---| | `AADSTS50034` UserAccountNotFound | The account isn't in this directory: mistyped name, or the wrong tenant in the URL | The sign-in log shows the tenant the request went to | | `AADSTS50020` UserUnauthorized | The account from that identity provider doesn't exist in this tenant: invite it as an external (B2B) user first, or sign in with an account of this tenant | The sign-in log; for your own app, `az ad app show --id --query signInAudience` | | `AADSTS50105` EntitlementGrantsNotFound | The app requires assignment and this user (or their group) isn't assigned to it | The enterprise app's **Users and groups** | | `AADSTS50126` InvalidUserNameOrPassword | Wrong username or password | — | | `AADSTS50053` | The account is locked after repeated failed attempts, or the sign-in came from an IP address with malicious activity | Sign-in log failure reason | | `AADSTS50057` UserDisabled | The account is disabled | User's **Account enabled** in the admin center | | `AADSTS50055` InvalidPasswordExpiredPassword | The password expired; the user must reset it | — | | `AADSTS500021` | Tenant restrictions block access to that tenant from this network | Proxy / tenant restriction settings of the user's network | ## MFA and conditional access | Code | Cause → fix | Check | |---|---|---| | `AADSTS50076` UserStrongAuthClientAuthNRequired | MFA is required (a policy, per-user MFA, or a new location). Sign in interactively; for automation, switch to a workload identity | Sign-in log → **Conditional Access** tab | | `AADSTS50079` UserStrongAuthEnrollmentRequired | The user must register for MFA first | Same | | `AADSTS53003` BlockedByConditionalAccess | A conditional access policy blocked token issuance | The sign-in log names the policy | | `AADSTS53000` DeviceNotCompliant | A policy requires a compliant (managed) device | Device's compliance state | | `AADSTS50058` UserInformationNotProvided | No session for silent sign-in: expected when the user isn't signed in. Fall back to interactive sign-in | — | ## Sessions and tokens | Code | Cause → fix | Check | |---|---|---| | `AADSTS700082` ExpiredOrRevokedGrantInactiveToken | The refresh token expired from inactivity: sign in again | — | | `AADSTS70008` ExpiredOrRevokedGrant | The refresh token or grant expired or was revoked | — | | `AADSTS50173` | The grant was revoked, often after a password change or reset. Get a fresh token | — | | `AADSTS50133` SsoArtifactRevoked | The session ended after a password change or expiry | — | | `AADSTS70043` BadTokenDueToSignInFrequency | A conditional access sign-in frequency limit ended the refresh token | Sign-in log → policy with sign-in frequency | | `AADSTS54005` | An authorization code was redeemed twice. Each code is single-use: use the refresh token afterwards | Does your code exchange the same `code` on retry? | | `AADSTS70016` AuthorizationPending | Device code flow: the user hasn't finished yet. Keep polling: this is not a failure | — | For CLI users, `az login` (or `az login --tenant `) clears most session errors; `az account show` confirms who is signed in. ## When none of these fits Look the code up at `https://login.microsoftonline.com/error?code=` and read the sign-in log entry for its correlation ID. App and credential errors are in `reference/entra/errors.md`. --- You are reading one file. The same content is free over MCP at https://cuppy.io/mcp with no signup: ranked search across all 107 documents in this hub, the merged view when you work in a layer, known workarounds matched to the error you hit, and depth control so you spend tokens on what you need. Start with the `_hello` tool. How to connect: https://cuppy.io/azure/ Something wrong in this document? Report it with the `session feedback` tool on the same endpoint.