Part 5 closes my complete AADSTS reference: every code in Microsoft's table from AADSTS120000 onward, plus the codes Microsoft lists at the end of the table out of numeric order. They cover password change and self-service password reset, Windows Hello for Business (NGC) and device keys, device registration and certificates, and a set of newer app, scope and external identity provider codes. Each row gives the meaning in plain English, the usual cause and the first check.
Codes in this quick reference
AADSTS120000 PasswordChangeIncorrectCurrentPassword: the current password was entered incorrectlyPassword change or reset pageAADSTS120002 PasswordChangeInvalidNewPasswordWeak: the new password is too weakPassword change or reset pageAADSTS120003 PasswordChangeInvalidNewPasswordContainsMemberName: new password contains the user's namePassword change or reset pageAADSTS120004 PasswordChangeOnPremComplexity: new password fails on-premises AD complexity rulesPassword change or reset pageAADSTS120005 PasswordChangeOnPremSuccessCloudFail: changed on-premises but the cloud step failedPassword change or reset pageAADSTS120008 PasswordChangeAsyncJobStateTerminated: a non-retryable error occurredPassword change or reset pageAADSTS120011 PasswordChangeAsyncUpnInferenceFailed: the user's UPN couldn't be inferredPassword change or reset pageAADSTS120012 PasswordChangeNeedsToHappenOnPrem: the password must be changed on-premisesPassword change or reset page
+ 44 more codes in the tables below.
Note: The series: part 1 (16000–50079), part 2 (50085–54005), part 3 (65001–81012), part 4 (90002–90130) and part 5 (this page). The everyday codes are also on one page in the AADSTS quick reference.
How to read these codes#
- Password change codes (120xxx) appear while a user changes or resets a password: after an expiry prompt at sign-in, on the change-password page or in self-service password reset (SSPR). For synced users with password writeback, many start on-premises: AD password policy, a locked account or the writeback connection. New passwords are also checked against Microsoft Entra Password Protection's banned password lists.
- Windows Hello for Business and device codes (130xxx–135xxx) come from device-based sign-ins on Windows. Start on the device:
dsregcmd /statusshows the device state, the SSO state and the Windows Hello prerequisite check. - The codes at the end of Microsoft's table were added out of numeric order. Most are app and token errors that come back in the token response or show on the Service principal sign-ins tab.
Command Prompt
dsregcmd /status | findstr /i "AzureAdJoined DomainJoined AzureAdPrt NgcSet DeviceAuthStatus"On a healthy joined device with Windows Hello set up, AzureAdPrt and NgcSet read YES and DeviceAuthStatus reads SUCCESS.
Password change and SSPR (120000–120021)#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
AADSTS120000 PasswordChangeIncorrectCurrentPassword | The current password entered for the change is wrong | Typo, or the user forgot it | Retry, or reset it with SSPR |
AADSTS120002 PasswordChangeInvalidNewPasswordWeak | The new password is too weak | Fails the strength or banned-password checks | A longer, less predictable password |
AADSTS120003 PasswordChangeInvalidNewPasswordContainsMemberName | The new password contains the user's name | Name or account name in the password | A password without name parts |
AADSTS120004 PasswordChangeOnPremComplexity | The new password fails on-premises AD complexity rules | Domain or fine-grained password policy | Length, complexity, history and minimum age in AD |
AADSTS120005 PasswordChangeOnPremSuccessCloudFail | The change succeeded on-premises but failed in the cloud | Sync or writeback problem after the AD change | Entra Connect health; test which password works. Guide |
AADSTS120008 PasswordChangeAsyncJobStateTerminated | A non-retryable error occurred | The change job was terminated | Audit log entry; support case if it repeats |
AADSTS120011 PasswordChangeAsyncUpnInferenceFailed | The user's UPN couldn't be inferred for the change | Unexpected user name or UPN | The UPN in Entra ID and in AD |
AADSTS120012 PasswordChangeNeedsToHappenOnPrem | The password has to be changed on-premises | Writeback not available for this user | Change it in AD, or enable writeback. Guide |
AADSTS120013 PasswordChangeOnPremisesConnectivityFailure | The on-premises side couldn't be reached for the change | Writeback connectivity from the sync server | Entra Connect or Cloud Sync health. Guide |
AADSTS120014 PasswordChangeOnPremUserAccountLockedOutOrDisabled | The on-premises account is locked out or disabled | AD lockout or a disabled account | Unlock or enable it in AD |
AADSTS120015 PasswordChangeADAdminActionRequired | An Active Directory administrator must act on the account | An AD-side condition the user can't fix | The AD account and the writeback account's permissions |
AADSTS120016 PasswordChangeUserNotFoundBySspr | SSPR couldn't find the user | Wrong user name, or the user isn't in Entra ID | The user exists and is in scope for SSPR |
AADSTS120018 PasswordChangePasswordDoesnotComplyFuzzyPolicy | The password fails the fuzzy-matching policy | Too close to a banned password | Avoid banned terms and simple variations of them |
AADSTS120020 PasswordChangeFailure | The password change failed | Generic failure | Audit log details |
AADSTS120021 PartnerServiceSsprInternalServiceError | Internal error in the SSPR partner service | Service-side | Retry; support case if it persists |
For SSPR and writeback event IDs, see the SSPR and password writeback error codes.
Windows Hello for Business and device keys (130004–135011)#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
AADSTS130004 NgcKeyNotFound | The user has no NGC (Windows Hello) ID key configured | Windows Hello key not registered for the user | NgcSet in dsregcmd /status; set up Windows Hello again |
AADSTS130005 NgcInvalidSignature | NGC key signature verification failed | A problem with the Windows Hello key on the device | Reset Windows Hello on the device and provision it again |
AADSTS130006 NgcTransportKeyNotFound | The NGC transport key isn't configured on the device | Incomplete device registration | Device state in dsregcmd /status; re-register if broken |
AADSTS130007 NgcDeviceIsDisabled | The device is disabled | Device object disabled in Entra ID | Enable it under Entra ID › Devices › All devices |
AADSTS130008 NgcDeviceIsNotFound | The device referenced by the NGC key wasn't found | Device object deleted from Entra ID | Rejoin the device, then set up Windows Hello again. Guide |
AADSTS135010 KeyNotFound | Key not found; Microsoft gives no more detail | Not documented | Device details in the sign-in log and dsregcmd /status |
AADSTS135011 | The device used during authentication is disabled | Device object disabled in Entra ID | Enable it; the audit log shows who disabled it. See the Intune device AADSTS codes |
Tip: If you run a stale-device clean-up, check it didn't disable or delete devices people still use before you rejoin anything. The device clean-up guide covers the safe order, and the PRT guide explains the SSO state.
Requests, sessions, devices and certificates (140000–240004)#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
AADSTS140000 InvalidRequestNonce | The request nonce wasn't provided | Client or broker sent an incomplete request | Update the client app or broker and retry |
AADSTS140001 InvalidSessionKey | The session key isn't valid | Not documented further | On Windows, AzureAdPrt in dsregcmd /status |
AADSTS165004 | The message content is runtime specific; see the returned exception | Varies | Read the full exception text |
AADSTS165900 InvalidApiRequest | Invalid request | Malformed request | Capture the request |
AADSTS220450 UnsupportedAndroidWebViewVersion | The Chrome WebView version isn't supported | Outdated Android System WebView | Update Android System WebView and Chrome from Google Play |
AADSTS220501 InvalidCrlDownload | Invalid certificate revocation list (CRL) download during certificate-based authentication | CRL distribution point unreachable or a bad response | CRL URL reachability. Guide |
AADSTS221000 DeviceOnlyTokensNotSupportedByResource | The resource isn't configured to accept device-only tokens | A device-only token sent to that resource | Whether the resource supports device-only tokens |
AADSTS240001 BulkAADJTokenUnauthorized | The user isn't authorized to register devices in Entra ID | The account behind the bulk enrollment token can't join devices | Device settings: who may join devices and the maximum number of devices per user |
AADSTS240002 RequiredClaimIsMissing | An id_token can't be used as a jwt-bearer grant | On-behalf-of exchange started with an ID token | Send the access token issued to the middle-tier API |
AADSTS240003 | Unexpected result from the authorize endpoint call | Not documented further | Capture the authorize request and response |
AADSTS240004 | No authorization code came back from the authorize endpoint (the message carries the error) | The authorize step failed first | The error details in the message |
Codes at the end of Microsoft's table#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
AADSTS501621 ClaimsTransformationTimeoutRegularExpressionTimeout | A regular-expression replacement in a claims transformation timed out | Regex too complex | Simplify it under Attributes & Claims; a retry may succeed |
AADSTS530032 BlockedByConditionalAccessOnSecurityPolicy | A security policy the tenant admin configured blocks the request | Tenant-level security policy | Which policy applied, in the sign-in log entry |
AADSTS700016 UnauthorizedClient_DoesNotMatchRequest | The app wasn't found in the directory or tenant | Wrong client ID or tenant, or the app was never added | Client ID and tenant. Guide |
AADSTS700020 InteractionRequired | The access grant requires interaction | A silent request needs the user | Fall back to interactive sign-in |
AADSTS700022 InvalidMultipleResourcesScope | The scope contains more than one resource | Scopes for two APIs in one request | One resource per token request |
AADSTS700023 InvalidResourcelessScope | The scope value isn't valid for an access token request | Scope without a resource | Fully qualified scopes, such as https://graph.microsoft.com/User.Read |
AADSTS7000215 | Invalid client secret | Wrong or expired secret value | The secret in the app's settings. Guide |
AADSTS7000218 | The request body must contain client_assertion or client_secret | A confidential-client request without a credential, or a public-client flow the app doesn't allow | Add the credential, or set Allow public client flows under Authentication. Example: Jamf Connect |
AADSTS7000222 InvalidClientSecretExpiredKeysProvided | The client secret keys have expired | Secret past its end date | New secret, or a certificate. Guide |
AADSTS700229 ForbiddenTokenType | Only app-only tokens can be federated identity credentials for a Microsoft Entra issuer | A user-delegated token used as the assertion | Use a token from the client credentials flow |
AADSTS700005 InvalidGrantRedeemAgainstWrongTenant | The authorization code was meant for another tenant | Code redeemed against a different tenant | Redeem it at the authority used to get it |
AADSTS1000000 UserNotBoundError | The Bind API needs the user to also authenticate with an external identity provider, which hasn't happened yet | External sign-in step not completed | Complete the external provider's sign-in |
AADSTS1000002 BindCompleteInterruptError | The bind succeeded, but the user must be informed | Informational interrupt | No fix needed |
AADSTS100007 | Microsoft Entra Regional only supports managed identities, or MSAL requests using subject name and issuer (SN+I) for first-party apps or apps in Microsoft infrastructure tenants | Another kind of app sent to a regional endpoint | Use the standard sign-in endpoint |
AADSTS1000031 | The application can't be accessed at this time; contact your administrator | Not documented further | The enterprise app's status and the sign-in log details |
AADSTS7000112 UnauthorizedClientApplicationDisabled | The application is disabled | App disabled for sign-in | Enabled for users to sign in? in the enterprise app's Properties |
AADSTS7000114 | The app isn't allowed to make application on-behalf-of calls | An on-behalf-of exchange started from an app-only token | OBO needs a user's token; for app-only access use client credentials |
AADSTS7500529 | The value isn't a valid SAML ID: an ID must not begin with a number | The app generates IDs that start with a digit | Prefix the ID, for example "id" followed by a GUID |
AADSTS9002341 | V2Error invalid_grant: the user is required to permit single sign-on | The user hasn't granted the app the permissions SSO needs | Let the user complete the consent screen |
AADSTS901011 NoEmailAddressCollectedFromExternalOidcIDP | No email address came from the external OpenID Connect provider | The user chose "Hide my email" at sign-up | The user shares an email address; the provider's email claim |
AADSTS901012 EmailAddressCollectedFromExternalOidcIDPNotVerified | The email address in the provider's ID token isn't verified | Unverified address at the provider | The user verifies it with the provider |
AADSTS901014 NoExternalIdentifierCollectedFromExternalOidcIDP | The external identifier is missing from the provider's ID token | Claim not issued or not mapped | The provider's claims and the mapping in Entra |
AADSTS650059 | The app isn't configured for use in this tenant: signInAudience AzureADMyOrg limits it to its home tenant | A single-tenant app opened from another tenant | Make it multitenant, or sign in through its home tenant |
How to verify a fix#
- Password codes: repeat the change. Good: it succeeds, and synced users can sign in with the new password both in the cloud and on a domain-joined PC. For writeback problems, Microsoft's general steps are to reproduce one exact scenario (reset and change are different operations), compare a working and a failing user, use the same domain controller as Microsoft Entra Connect, and read the Application events in Event Viewer.
- Device and Windows Hello codes: after enabling or rejoining the device, run
dsregcmd /statusagain, sign out and back in with the PIN, and confirm a success in the sign-in log for that device. - App codes: request a token again and confirm a success on the Service principal sign-ins tab, or in the user tab for delegated flows.
- With sign-in logs in Log Analytics, confirm device failures stop:
KQL
SigninLogs | where TimeGenerated > ago(7d) | where ResultType in ("130004", "130007", "130008", "135011") | extend DeviceName = tostring(DeviceDetail.displayName) | summarize Failures = count() by ResultType, DeviceName
Related guides: Windows Hello for Business with cloud Kerberos trust and App registrations and service principals.
References#
- Microsoft Entra authentication and authorization error codes (Microsoft Learn): the source table for every code on this page.
- General password writeback troubleshooting steps (Microsoft Learn).
- Microsoft identity platform and OAuth 2.0 On-Behalf-Of flow (Microsoft Learn): why the flow needs a user's access token.
