AADSTS50125: Password reset registration interrupt

What does AADSTS50125 mean?

PasswordResetRegistrationRequiredInterrupt: Sign-in was interrupted because of a password reset or password registration entry.

Microsoft’s description is all the official text there is. In practice this is the self-service password reset (SSPR) registration prompt (today part of combined security info registration): the user signed in successfully and is asked to set up or confirm the details used to reset their password later. That reading is from how the prompt behaves, not from a Microsoft statement.

Is it an attack?

For a real user it is routine. It matters when the sign-in is not the user’s.

The same logic as 50079 applies. Whoever completes this step chooses the recovery details. An attacker with a working password who reaches 50125 can register their own phone or email as recovery info, and later use it to reset the password after the real user changes it. This is reasoning from what the prompt does, not a Microsoft statement.

Pattern	Likely meaning
50125, then 0 from the user’s usual IP and device	Normal SSPR registration or reconfirmation. Benign.
50125 from an IP that produced many 50126 failures	A spray found a working password, and the account is being asked for recovery info.
50125 from an unfamiliar IP, then a security info registration event, then 0	Likely account takeover with attacker-controlled recovery details.

How do I find it in my logs (KQL)?

50125 from IPs the user has not had a successful sign-in from in the last 14 days:

let knownIPs =
    SigninLogs
    | where TimeGenerated > ago(14d)
    | where ResultType == "0"
    | distinct UserPrincipalName, IPAddress;
SigninLogs
| where TimeGenerated > ago(1d)
| where ResultType == "50125"
| join kind=leftanti knownIPs on UserPrincipalName, IPAddress
| project TimeGenerated, UserPrincipalName, IPAddress, AppDisplayName,
          ClientAppUsed, UserAgent
| sort by TimeGenerated asc

50125 followed within an hour by a security info registration in AuditLogs for the same user:

let interrupts =
    SigninLogs
    | where TimeGenerated > ago(7d)
    | where ResultType == "50125"
    | project InterruptTime = TimeGenerated,
              UserPrincipalName = tolower(UserPrincipalName),
              SigninIP = IPAddress;
AuditLogs
| where TimeGenerated > ago(7d)
| where OperationName has "security info"
| extend UserPrincipalName = tolower(tostring(InitiatedBy.user.userPrincipalName)),
         AuditIP = tostring(InitiatedBy.user.ipAddress)
| join kind=inner interrupts on UserPrincipalName
| where TimeGenerated between (InterruptTime .. (InterruptTime + 1h))
| project InterruptTime, RegisteredAt = TimeGenerated, UserPrincipalName,
          SigninIP, AuditIP, OperationName, Result
| sort by RegisteredAt desc

Verify the exact OperationName values for security info and password reset registration in your own workspace before relying on the has "security info" filter, and check that InitiatedBy carries the user and IP fields for those events. ResultType is a string column, so compare it with "50125".

How do Conditional Access and MFA affect it?

• 50125 comes from SSPR registration, not from a Conditional Access grant. It shows up after the password has been accepted.
• Microsoft documents that an interrupted sign-in “appears on the logs but shows Not applied for Conditional Access.” Look at the follow-up row for the policy result.
• If your tenant lets users register security info from anywhere, this prompt is an opportunity for whoever holds the password. Restricting registration to trusted locations or devices with Conditional Access closes that path for this prompt and for 50079.

How do I fix AADSTS50125?

For the user: complete or confirm your password reset details. If you get the prompt on a device or at a time you don’t recognise, contact IT.

For admins:

1. For a 50125 from an unfamiliar IP, review the user’s registered recovery methods and remove any you can’t tie to the user.
2. If an attacker registered details, reset the password, remove the methods, and revoke sessions (Revoke-MgUserSignInSession).
3. Restrict security info registration to trusted locations or devices.