AADSTS50158: External security challenge not satisfied

What does AADSTS50158 mean?

External security challenge not satisfied: User will be redirected to another page or authentication provider to satisfy additional authentication challenges. The user is required to satisfy additional requirements before finishing authentication, and was redirected to another page (such as terms of use or a third party MFA provider). This code alone doesn’t indicate a failure on your users’ part to sign in. The sign in logs may indicate that this challenge was successfully passed or failed.

The reference table gives this code no PascalCase name, so the description is used as its name here.

Is it an attack?

Microsoft says directly that the code alone is not a failure. What happened next is in the following sign-in rows. Read it the same way as 50076: the first factor was accepted and an extra step is pending.

Pattern	Likely meaning
50158, then 0 from the same IP and device	The user accepted the terms of use or passed the external MFA. Benign.
50158 with no later success, for a user who is not complaining	The user abandoned the sign-in, or the external provider rejected the challenge. Check the provider’s own logs.
50158 from an IP that also produced many 50126 failures	A spray found a correct password. The external MFA or terms-of-use step is the only thing left.
Repeated 50158 for one user from an unfamiliar IP	Someone with the password retrying against the external MFA. Same reading as repeated 50074.

If you use an external MFA integration, the Entra sign-in log only shows the redirect. Whether the user approved, denied or ignored the challenge is recorded by that provider. TokenIssuerType can tell you whether federation services or an MFA adapter were involved (documented values include ADFederationServicesMFAAdapter and NPSExtension).

How do I find it in my logs (KQL)?

50158 rows with whether the same user and IP had a success in the next 30 minutes:

let challenges =
    SigninLogs
    | where TimeGenerated > ago(1d)
    | where ResultType == "50158"
    | project ChallengeTime = TimeGenerated, UserPrincipalName, IPAddress,
              AppDisplayName, TokenIssuerType;
let successes =
    SigninLogs
    | where TimeGenerated > ago(1d)
    | where ResultType == "0"
    | project SuccessTime = TimeGenerated, UserPrincipalName, IPAddress;
challenges
| join kind=leftouter successes on UserPrincipalName, IPAddress
| extend Followed = isnotnull(SuccessTime)
                    and SuccessTime between (ChallengeTime .. (ChallengeTime + 30m))
| summarize Successes = countif(Followed)
          by ChallengeTime, UserPrincipalName, IPAddress, AppDisplayName, TokenIssuerType
| extend Completed = Successes > 0
| sort by ChallengeTime desc

50158 from IPs that were failing passwords against several users the same day:

let sprayIPs =
    SigninLogs
    | where TimeGenerated > ago(1d)
    | where ResultType == "50126"
    | summarize FailedUsers = dcount(UserPrincipalName) by IPAddress
    | where FailedUsers >= 5
    | project IPAddress;
SigninLogs
| where TimeGenerated > ago(1d)
| where ResultType == "50158"
| where IPAddress in (sprayIPs)
| project TimeGenerated, UserPrincipalName, IPAddress, AppDisplayName,
          ClientAppUsed, TokenIssuerType, UserAgent
| sort by TimeGenerated asc

The 30-minute window and the threshold of 5 are starting points, not Microsoft numbers. ResultType is a string column, so compare it with "50158".

How do Conditional Access and MFA affect it?

• 50158 shows up when a Conditional Access terms of use control or an external or third-party MFA provider has to run before the sign-in finishes.
• Microsoft documents that an interrupted sign-in “appears on the logs but shows Not applied for Conditional Access.” Look at the follow-up row for the policy result.
• When MFA is handled outside Entra ID, Entra’s sign-in logs can’t show whether a push was denied or approved. MFA fatigue against an external provider has to be hunted in that provider’s logs.

How do I fix AADSTS50158?

For the user: finish the step you were sent to: accept the terms of use or complete the external MFA prompt. If it keeps failing, contact IT with the time of the sign-in.

For admins:

1. Don’t alert on 50158 alone. Alert on 50158 from IPs you already consider hostile.
2. For a 50158 from a spray IP, treat the password as compromised and reset it, even if the external MFA held.
3. Check the external MFA provider’s logs for the same user and time to see whether the challenge was denied, ignored or approved.