New and re-verified pages on AADSTS codes, KQL and Entra ID investigations.https://brambrinkmeier.com/enhttps://brambrinkmeier.com/entra/aadsts/50011/https://brambrinkmeier.com/entra/aadsts/50011/AADSTS50011 means the redirect (reply) URI in the sign-in request doesn't exactly match one registered for the application. It is almost always a configuration mistake: http instead of https, a trailing slash, a wrong port. The exact-match rule is also what stops attackers redirecting authorization codes and tokens to their own server.Sun, 11 Oct 2026 00:00:00 GMThttps://brambrinkmeier.com/entra/aadsts/50020/https://brambrinkmeier.com/entra/aadsts/50020/AADSTS50020 means an account from another identity provider or tenant tried to sign in to an app in your tenant, and that account isn't a user or guest there. It is usually a B2B or app misconfiguration: wrong tenant, uninvited guest, single-tenant app. Repeated hits can also reveal orphaned guest accounts that need cleanup.Sun, 11 Oct 2026 00:00:00 GMThttps://brambrinkmeier.com/entra/aadsts/50034/https://brambrinkmeier.com/entra/aadsts/50034/AADSTS50034 means the username doesn't exist in the Microsoft Entra tenant the sign-in went to. Usually it's a typo or the wrong tenant. The security signal is volume from one source: many different non-existent usernames from one IP suggests an attacker testing a guessed or leaked user list. Hunt it with ResultType == "50034".Sun, 11 Oct 2026 00:00:00 GMThttps://brambrinkmeier.com/entra/aadsts/50053/https://brambrinkmeier.com/entra/aadsts/50053/AADSTS50053 covers two different blocks. Smart lockout locked the account after too many wrong passwords, or Microsoft's built-in protections blocked a high-confidence risky sign-in regardless of the password. The failure reason tells them apart. A burst across many accounts usually means a password spray tripped lockout.Sun, 11 Oct 2026 00:00:00 GMThttps://brambrinkmeier.com/entra/aadsts/50055/https://brambrinkmeier.com/entra/aadsts/50055/AADSTS50055 means the user's password has expired, so Microsoft Entra ID ended the sign-in and offers a reset. For a real user it is routine. During a password spray it matters more: the wording implies the password entered was correct, just expired, so the attacker likely holds a valid credential.Sun, 11 Oct 2026 00:00:00 GMThttps://brambrinkmeier.com/entra/aadsts/50057/https://brambrinkmeier.com/entra/aadsts/50057/AADSTS50057 means the user account is disabled in Microsoft Entra ID, so sign-in was refused. After an offboarding it is expected. The security signal is volume and source: many disabled accounts tried from one IP suggests a password spray working from an old user list. Hunt it with ResultType == "50057".Sun, 11 Oct 2026 00:00:00 GMThttps://brambrinkmeier.com/entra/aadsts/50074/https://brambrinkmeier.com/entra/aadsts/50074/AADSTS50074 means MFA was required and the user did not pass the challenge. The password stage had already succeeded. One or two are normal. Many for one user in a short window from an unfamiliar IP is the MFA fatigue pattern: someone with the correct password is pushing prompts and waiting for an approval.Sun, 11 Oct 2026 00:00:00 GMThttps://brambrinkmeier.com/entra/aadsts/50076/https://brambrinkmeier.com/entra/aadsts/50076/AADSTS50076 means the password was accepted but the sign-in now needs multifactor authentication, usually because of a Conditional Access policy, per-user MFA, or a new location. It is an expected interrupt. The signal is who reached it: a 50076 from an IP that was just failing passwords means an attacker has a working password.Sun, 11 Oct 2026 00:00:00 GMThttps://brambrinkmeier.com/entra/aadsts/50079/https://brambrinkmeier.com/entra/aadsts/50079/AADSTS50079 means MFA is required but the user has not registered security info yet, so Entra ID sends them to register. For a real new user it is expected. If the sign-in came from an attacker IP, the attacker has a correct password and is being invited to register their own MFA method on the account.Sun, 11 Oct 2026 00:00:00 GMThttps://brambrinkmeier.com/entra/aadsts/50097/https://brambrinkmeier.com/entra/aadsts/50097/AADSTS50097 means Microsoft Entra ID asked the client to prove the device's identity because a device-based Conditional Access policy applies. Managed clients answer it silently. Clients that can't prove a device identity stop here. A spike for one user from a new IP can mean a valid credential is being used on an unmanaged device.Sun, 11 Oct 2026 00:00:00 GMThttps://brambrinkmeier.com/entra/aadsts/50105/https://brambrinkmeier.com/entra/aadsts/50105/AADSTS50105 means the user signed in successfully but isn't assigned to the application, and the app has "Assignment required" set to Yes. That is least privilege working. Fix it by assigning the user or a group, not by switching assignment off. Watch for repeated 50105 on sensitive apps.Sun, 11 Oct 2026 00:00:00 GMThttps://brambrinkmeier.com/entra/aadsts/50125/https://brambrinkmeier.com/entra/aadsts/50125/AADSTS50125 means sign-in was paused so the user could register for, or go through, self-service password reset. It is an expected interrupt and the password had already been accepted. If the sign-in came from an attacker IP, the attacker may be choosing the recovery details for the account.Sun, 11 Oct 2026 00:00:00 GMThttps://brambrinkmeier.com/entra/aadsts/50126/https://brambrinkmeier.com/entra/aadsts/50126/AADSTS50126 means Microsoft Entra ID rejected the username or password. A few per day are normal typos. The security signal is the shape: many accounts failing from one IP is password spraying, many failures on one account is brute force. Hunt it in SigninLogs with ResultType == "50126".Sun, 11 Oct 2026 00:00:00 GMThttps://brambrinkmeier.com/entra/aadsts/50133/https://brambrinkmeier.com/entra/aadsts/50133/AADSTS50133 means Microsoft Entra ID rejected an existing sign-in session because the user's password expired or was recently changed. It is normally a one-off after a password change. After a compromise, rows from IPs or devices the user doesn't own show where an old session was still in use. Hunt it in SigninLogs and AADNonInteractiveUserSignInLogs.Sun, 11 Oct 2026 00:00:00 GMThttps://brambrinkmeier.com/entra/aadsts/50140/https://brambrinkmeier.com/entra/aadsts/50140/AADSTS50140 is the "Keep me signed in?" prompt, logged as an interrupt. Microsoft calls it an expected part of the sign-in flow, so it is noise on failure dashboards. Its one investigative use: the prompt comes after authentication, so a 50140 from an attacker IP almost certainly means the password and any required MFA were accepted.Sun, 11 Oct 2026 00:00:00 GMThttps://brambrinkmeier.com/entra/aadsts/50158/https://brambrinkmeier.com/entra/aadsts/50158/AADSTS50158 means the user was redirected to satisfy an extra requirement, such as terms of use or a third-party MFA provider, before sign-in could finish. Microsoft says the code alone does not indicate a failure. Read it like an MFA interrupt: from an attacker IP, it means the password worked and the external challenge is the remaining barrier.Sun, 11 Oct 2026 00:00:00 GMThttps://brambrinkmeier.com/entra/aadsts/50173/https://brambrinkmeier.com/entra/aadsts/50173/AADSTS50173 means a refresh token was rejected because it was issued before the user's TokensValidFrom date, usually after a password change, reset or admin session revocation. After an incident it is the row you want: each client still holding an old token, attacker included, fails with 50173 in AADNonInteractiveUserSignInLogs, exposing its IP and device.Sun, 11 Oct 2026 00:00:00 GMThttps://brambrinkmeier.com/entra/aadsts/53000/https://brambrinkmeier.com/entra/aadsts/53000/AADSTS53000 means a Conditional Access policy requires a compliant device and the device signing in isn't compliant. The password was already accepted. Usually it is a user on a personal or unenrolled device. For a privileged account on a new device or IP, treat it as a valid credential in the wrong hands.Sun, 11 Oct 2026 00:00:00 GMThttps://brambrinkmeier.com/entra/aadsts/53001/https://brambrinkmeier.com/entra/aadsts/53001/AADSTS53001 means a Conditional Access policy requires a domain-joined (hybrid joined) device and the device signing in isn't one. The password was already accepted. Usually it is a user on a personal or cloud-only device. From an unknown device on an unfamiliar IP, it means a working credential is being used outside your estate.Sun, 11 Oct 2026 00:00:00 GMThttps://brambrinkmeier.com/entra/aadsts/53003/https://brambrinkmeier.com/entra/aadsts/53003/AADSTS53003 means a Conditional Access policy blocked the sign-in or its grant controls weren't met. The password was already accepted, because Conditional Access only runs after the first factor succeeds. From an unknown IP or country, read it as a valid password in someone else's hands, stopped by policy. The ConditionalAccessPolicies column names the policy.Sun, 11 Oct 2026 00:00:00 GMThttps://brambrinkmeier.com/entra/aadsts/65001/https://brambrinkmeier.com/entra/aadsts/65001/AADSTS65001 means an app asked for a token for permissions that no user or admin has consented to. For a new or misconfigured app it is routine. The security angle is consent phishing: watch for an unfamiliar app that flips from 65001 to success, then check the audit log for "Consent to application" and IsAdminConsent.Sun, 11 Oct 2026 00:00:00 GMThttps://brambrinkmeier.com/entra/aadsts/70043/https://brambrinkmeier.com/entra/aadsts/70043/AADSTS70043 means a refresh token was refused because a Conditional Access sign-in frequency policy says the user must authenticate again. It is the session control working as configured, so it is expected and has low attack value. Volume tracks how strict your policy is. Hunt it in AADNonInteractiveUserSignInLogs with ResultType == "70043".Sun, 11 Oct 2026 00:00:00 GMThttps://brambrinkmeier.com/entra/aadsts/90094/https://brambrinkmeier.com/entra/aadsts/90094/AADSTS90094 means a user tried to consent to an app, but the permissions it asks for need an administrator. Your user-consent restriction is holding. Usually it is a legitimate new app. The security signal is an unfamiliar app hitting 90094 for several users, which fits a consent-phishing attempt. Hunt it in SigninLogs by AppId.Sun, 11 Oct 2026 00:00:00 GMThttps://brambrinkmeier.com/entra/aadsts/90095/https://brambrinkmeier.com/entra/aadsts/90095/AADSTS90095 is an interrupt: a user hit a consent prompt for permissions that need an admin, and because the admin consent workflow is on, they are told to request approval. This is the recommended setup. The review queue becomes your consent-phishing triage queue. Hunt unfamiliar apps in SigninLogs with ResultType == "90095".Sun, 11 Oct 2026 00:00:00 GMThttps://brambrinkmeier.com/entra/aadsts/135011/https://brambrinkmeier.com/entra/aadsts/135011/AADSTS135011 means the device used for the sign-in is disabled in Microsoft Entra ID. Usually an admin disabled it during cleanup or incident response, and something on that device still tries to get tokens. After an incident, these rows show where the quarantined device is and when it reconnects.Sun, 11 Oct 2026 00:00:00 GMThttps://brambrinkmeier.com/entra/aadsts/500121/https://brambrinkmeier.com/entra/aadsts/500121/AADSTS500121 means the user didn't complete the MFA prompt: it was denied, ignored, timed out, or MFA setup was unfinished. The password had already been accepted. A few are normal. Many for one user in a short window, especially from an unfamiliar IP, is the MFA fatigue pattern.Sun, 11 Oct 2026 00:00:00 GMThttps://brambrinkmeier.com/entra/aadsts/530032/https://brambrinkmeier.com/entra/aadsts/530032/AADSTS530032 means a security policy set at the tenant level blocked the request, rather than a named Conditional Access policy. Microsoft's spray playbook lists it among events to review. Its sibling 530035 is the security defaults block, which legacy-auth sprays hit in tenants that use security defaults.Sun, 11 Oct 2026 00:00:00 GMThttps://brambrinkmeier.com/entra/aadsts/700016/https://brambrinkmeier.com/entra/aadsts/700016/AADSTS700016 means the client application ID in the request isn't found in the tenant the request was sent to. It is almost always a developer error: wrong client ID, wrong tenant, or an app never added to the tenant. Unknown client IDs or a deleted malicious app still trying to sign in are worth a look.Sun, 11 Oct 2026 00:00:00 GMThttps://brambrinkmeier.com/entra/aadsts/700082/https://brambrinkmeier.com/entra/aadsts/700082/AADSTS700082 means an app tried to use a refresh token that expired because nobody used it for too long. Microsoft calls it an expected part of the token lifecycle, so it has low attack value. One useful reading: a stolen refresh token that sat unused long enough fails here too. Hunt it in AADNonInteractiveUserSignInLogs with ResultType == "700082".Sun, 11 Oct 2026 00:00:00 GMThttps://brambrinkmeier.com/entra/aadsts/7000215/https://brambrinkmeier.com/entra/aadsts/7000215/AADSTS7000215 means an app or service principal sent a client secret that Microsoft Entra ID didn't accept. Usually it is a developer or rotation mistake. The security signal is repeated failures for one app ID from an IP you don't own, which suggests someone trying a leaked or old secret. Hunt it in AADServicePrincipalSignInLogs.Sun, 11 Oct 2026 00:00:00 GMThttps://brambrinkmeier.com/guides/detect-mfa-fatigue-entra-id/https://brambrinkmeier.com/guides/detect-mfa-fatigue-entra-id/Detect MFA fatigue in Entra ID: read 500121, 50074, 50076 and 50079, parse AuthenticationDetails with KQL, spot an approved prompt, and respond.Sun, 11 Oct 2026 00:00:00 GMThttps://brambrinkmeier.com/guides/detect-password-spray-entra-id/https://brambrinkmeier.com/guides/detect-password-spray-entra-id/Find password spraying in Entra ID sign-in logs: which AADSTS codes to read, how smart lockout behaves, four KQL queries, and how to respond.Sun, 11 Oct 2026 00:00:00 GMThttps://brambrinkmeier.com/guides/investigate-consent-phishing-entra-id/https://brambrinkmeier.com/guides/investigate-consent-phishing-entra-id/Find the consent event, read the sign-in codes around it, and remove an attacker's app from Entra ID. Why a password reset and MFA don't fix it.Sun, 11 Oct 2026 00:00:00 GMThttps://brambrinkmeier.com/guides/revoke-sessions-and-verify-entra-id/https://brambrinkmeier.com/guides/revoke-sessions-and-verify-entra-id/Revoke a compromised user's Entra ID sessions, disable their devices, and use 50173, 50133 and 135011 sign-in rows to prove the attacker was cut off.Sun, 11 Oct 2026 00:00:00 GMT