AADSTS50053: account locked or sign-in blocked
The account is locked after too many failed sign-ins, or the sign-in was blocked because it came from an IP address with malicious activity.
From Microsoft's documentation, checked 9 Nov 2026.
AADSTS50053: IdsLocked - The account is locked because the user tried to sign in too many times with an incorrect user ID or password.Also searched as: IdsLocked · account is locked · smart lockout
What it means
Microsoft documents two reasons for this code. Either smart lockout locked the account after repeated sign-ins with a wrong user ID or password, or the sign-in was blocked because it came from an IP address with malicious activity. The Failure reason on the sign-in event tells you which.
Common causes
- Too many sign-in attempts with an incorrect user ID or password.
- A sign-in from an IP address with malicious activity.
How to fix it
Find the failing sign-in
In the Microsoft Entra admin center, go to Entra ID > Monitoring & health > Sign-in logs and filter by user, date and correlation ID. Or query the logs with Microsoft Graph PowerShell (needs AuditLog.Read.All); Microsoft recommends a time range so the request doesn't time out. Open the event and read the Failure reason to see which of the two causes applies.
$since = (Get-Date).ToUniversalTime().AddDays(-7).ToString("yyyy-MM-ddTHH:mm:ssZ")
Get-MgAuditLogSignIn -Filter "status/errorCode eq 50053 and createdDateTime ge $since" -Top 10Check smart lockout settings
Smart lockout locks an account after the lockout threshold (10 failed attempts by default in Azure Public tenants) for the lockout duration (60 seconds by default). If an account locks repeatedly, the duration increases.
Unlock or let the user reset
An administrator can unlock a cloud account without waiting for the lockout to expire by resetting the user's password. After a lockout the user can also use self-service password reset.
How to confirm it's fixed
- The user signs in successfully after the reset or lockout period, and no new 50053 events appear.
Related notes
With password hash sync or pass-through authentication, Microsoft recommends a Microsoft Entra lockout threshold lower than the AD DS threshold, and a Microsoft Entra lockout duration longer than the AD DS duration.
Related engineering templates
Follow Microsoft Entra ID failures and fixes
A short email about twice a week with new runbooks, configuration traps and fixes from KBY Technologies.