AADSTS50126: Invalid username or password

What does AADSTS50126 mean?

InvalidUserNameOrPassword: Error validating credentials due to invalid username or password. The user didn’t enter the right credentials. Expect to see some number of these errors in your logs due to users making mistakes.

The request reached the password check and failed. Nothing after that ran: no MFA prompt and no Conditional Access evaluation.

Is it an attack?

Microsoft itself says a baseline of 50126 is expected. The signal is the distribution, not the presence. The password spray guide turns the patterns below into a step-by-step investigation.

Pattern	Likely meaning
1–3 failures, then a success from the same IP and device	A user typo. Benign.
Many different users, few attempts each, from one IP or a small IP range	Password spraying (T1110.003)
Many attempts against one user	Brute force / password guessing (T1110.001)
Failures via ClientAppUsed = IMAP, POP, SMTP, Exchange ActiveSync, other legacy clients	Spray tooling using legacy protocols, which can’t do MFA
50126 followed by 50053 for the same accounts	The spray tripped smart lockout
50126 followed by 50076/50074 or 53003 from the same IP	The password was correct on a later try. MFA or Conditional Access is now the only barrier. Treat it as a compromised password.

Two details from Microsoft’s documentation matter when you read these rows:

• Conditional Access never ran. CA only evaluates after the first factor succeeds, so 50126 rows show ConditionalAccessStatus = notApplied. That doesn’t mean your policies are missing.
• AuthenticationRequirement shows singleFactorAuthentication even in an MFA-enforced tenant, because MFA was never reached. Don’t use it as evidence that MFA is off.

How do I find it in my logs (KQL)?

Spray pattern: one IP, many distinct users failing, over the last day.

SigninLogs
| where TimeGenerated > ago(1d)
| where ResultType == "50126"
| summarize FailedUsers = dcount(UserPrincipalName),
            Attempts = count(),
            Apps = make_set(AppDisplayName, 5),
            Clients = make_set(ClientAppUsed, 5)
          by IPAddress
| where FailedUsers >= 10
| sort by FailedUsers desc

Did any of those IPs also get a correct password? That is the row that matters:

let sprayIPs =
    SigninLogs
    | where TimeGenerated > ago(1d)
    | where ResultType == "50126"
    | summarize FailedUsers = dcount(UserPrincipalName) by IPAddress
    | where FailedUsers >= 10
    | project IPAddress;
SigninLogs
| where TimeGenerated > ago(1d)
| where IPAddress in (sprayIPs)
| where ResultType in ("0", "50076", "50074", "50079", "53003", "50055")
| project TimeGenerated, UserPrincipalName, IPAddress, ResultType, ResultDescription,
          ConditionalAccessStatus, AppDisplayName, ClientAppUsed
| sort by TimeGenerated asc

ResultType is a string column, so compare it with "50126", not 50126. Legacy-protocol sign-ins that replay a stored password can also show up in AADNonInteractiveUserSignInLogs; run the same query there if you allow legacy auth.

How do Conditional Access and MFA affect it?

• CA can’t stop a 50126. It happens before CA runs. What CA controls is what happens after a correct password (MFA, compliant device, block).
• Blocking legacy authentication removes the protocols most spray tools use, and those protocols can’t do MFA.
• Smart lockout is always on. By default it locks after 10 failed attempts (Azure public cloud), with separate counters for familiar and unfamiliar locations, which then turns the errors into 50053.

How do I fix AADSTS50126?

For the user: check the account name and keyboard layout, then reset the password with self-service password reset if needed.

For admins:

1. If it’s a spray, check whether any targeted account succeeded or reached MFA (second query above). Reset those passwords and revoke sessions.
2. Block legacy authentication with Conditional Access.
3. Make sure every account has a registered phishing-resistant MFA method, so a correct password alone isn’t enough.
4. Consider custom banned passwords. Spray lists use seasonal and company-name passwords.