Microsoft Entra ID errors
Exact Microsoft Entra ID error codes and states, explained from the emitting component outward. Start with evidence; follow the deeper links only when the first checks support them.
Open the Microsoft Entra ID technology indexAADSTS50011: redirect URI doesn't match the app registration
Sign-in fails because the redirect URI the app sent doesn't match any redirect URI registered for the app in Microsoft Entra ID.
AADSTS700016: application not found in the directory
Entra ID can't find the application named in the sign-in request in the tenant the request was sent to.
AADSTS53003: blocked by Conditional Access
A Conditional Access policy blocked token issuance for this sign-in. The sign-in log records which policy applied and why.
AADSTS50076: multifactor authentication required
The user must complete multifactor authentication to reach the resource, because of a Conditional Access policy, per-user MFA or a new location.
AADSTS50126: invalid username or password
Entra ID couldn't validate the credentials because the username or password was wrong. Some of these are expected in any tenant's logs.
AADSTS50053: account locked or sign-in blocked
The account is locked after too many failed sign-ins, or the sign-in was blocked because it came from an IP address with malicious activity.
AADSTS50158: external security challenge not satisfied
The user was sent to satisfy an extra requirement, such as terms of use or a third-party MFA provider. On its own this code isn't a failure.
AADSTS53000: device not compliant
A Conditional Access policy requires a compliant device and the device signing in isn't marked compliant.
AADSTS65001: consent not granted for the application
Neither the user nor an administrator has consented to the application using the permissions it asked for.
AADSTS700082: refresh token expired due to inactivity
The app's refresh token expired because it wasn't used for too long, so the user has to sign in interactively again.
AADSTS90072: external account doesn't exist in the tenant
The external account the user signed in with doesn't exist in the tenant, so the user can't satisfy that tenant's MFA requirements.
AADSTS50020: user from another identity provider doesn't exist in the tenant
A user from another identity provider tried to sign in to a tenant where their account doesn't exist, typically a guest or multitenant sign-in problem.
AADSTS7000215: invalid client secret
The app tried to authenticate to Entra ID with a client secret that isn't valid, so it can't get a token.
AADSTS500011: resource principal not found
The app asked for a token to a resource (an API or service) that Entra ID can't find in the tenant.
Follow Microsoft Entra ID failures and fixes
A short email about twice a week with new runbooks, configuration traps and fixes from KBY Technologies.