Changelog
- : AADSTS135011: Device used during authentication is disabled
- : AADSTS50011: Reply URL does not match
- : AADSTS500121: User didn't complete the MFA prompt
- : AADSTS50020: Account from identity provider not in tenant
- : AADSTS50034: User account not found in the directory
- : AADSTS50053: Account locked or sign-in blocked
- : AADSTS50055: Password expired
- : AADSTS50057: User account is disabled
- : AADSTS50074: Strong authentication required, MFA not passed
- : AADSTS50076: MFA required to access the resource
- : AADSTS50079: User must register for MFA
- : AADSTS50097: Device authentication required
- : AADSTS50105: User not assigned to a role for the app
- : AADSTS50125: Password reset registration interrupt
- : AADSTS50126: Invalid username or password
- : AADSTS50133: Session invalid after password change or expiry
- : AADSTS50140: Keep me signed in interrupt
- : AADSTS50158: External security challenge not satisfied
- : AADSTS50173: Grant expired because it was revoked
- : AADSTS53000: Device not compliant
- : AADSTS53001: Device not domain joined
- : AADSTS53003: Access blocked by Conditional Access
- : AADSTS530032: Blocked by a tenant security policy
- : AADSTS65001: User or admin has not consented to the app
- : AADSTS700016: Application not found in the directory
- : AADSTS7000215: Invalid client secret is provided
- : AADSTS700082: The refresh token has expired due to inactivity
- : AADSTS70043: Refresh token expired due to sign-in frequency checks
- : AADSTS90094: Administrator consent is required
- : AADSTS90095: Admin consent required, request access
- : How to detect MFA fatigue (push bombing) in Microsoft Entra ID
- : How to detect password spraying in Microsoft Entra ID (with KQL)
- : How to investigate consent phishing (illicit consent grants) in Entra ID
- : After a compromise: revoke Entra ID sessions and prove it worked