Microsoft's AADSTS table is long, and the code on your screen is often one of the rarer ones. This page is part 1 of a complete, five-part version of that table: all 72 codes from AADSTS16000 to AADSTS50079, in Microsoft's order, each with a plain-English meaning, the usual cause and the first thing to check.
Codes in this quick reference
AADSTS16000 InteractionRequired: account from another identity provider doesn't exist in the tenantSign-in page / Microsoft Entra sign-in logAADSTS16001 UserAccountSelectionInvalid: the account tile the user picked was rejectedSign-in page (account picker)AADSTS16002 AppSessionSelectionInvalid: the app's session (SID) requirement wasn't metSign-in page / app errorAADSTS160021 AppSessionSelectionInvalidSessionNotExist: the requested user session doesn't existSign-in page / app errorAADSTS17003 CredentialKeyProvisioningFailed: Entra ID can't provision the user keyMicrosoft Entra sign-in logAADSTS20001 WsFedSignInResponseError: problem with the federated identity providerSign-in page / Microsoft Entra sign-in logAADSTS20012 WsFedMessageInvalid: invalid WS-Federation message from the federated identity providerSign-in page / Microsoft Entra sign-in logAADSTS20033 FedMetadataInvalidTenantName: problem with the federated identity providerSign-in page / Microsoft Entra sign-in log
+ 45 more codes in the tables below.
Note: The series covers Microsoft's whole AADSTS table: part 1 (16000–50079, this page), part 2 (50085–54005), part 3 (65001–81012), part 4 (90002–90130) and part 5 (120000 and above). Codes with a detailed guide on this site link to it.
How to read these codes#
- Sign-in page: the message starts with the AADSTS number; the technical details below it carry the request ID, correlation ID and timestamp. Ask users for those too.
- Sign-in logs: in the Microsoft Entra admin center, open Entra ID › Monitoring & health › Sign-in logs (Reports Reader is enough). The sign-in error code is the number without the prefix; on a failed entry, Launch the Sign-in diagnostic runs Microsoft's guided analysis. Users can see their own attempts at mysignins.microsoft.com.
- Apps and scripts: the token endpoint returns JSON with
error,error_description(which starts with the AADSTS code),error_codes,timestamp,trace_id,correlation_idand often anerror_uri.
Microsoft calls the table preliminary: codes and messages can change, so apps shouldn't depend on them. For the current wording of one code, add its number to https://login.microsoftonline.com/error?code=. Some codes aren't failures: 50058 is expected when a silent request finds no session, and interrupts such as 50072 and 50074 usually precede a success with the same correlation ID. Recent entries for any code:
PowerShell
Connect-MgGraph -Scopes "AuditLog.Read.All","Directory.Read.All"
$code = 50014
Get-MgAuditLogSignIn -Filter "status/errorCode eq $code" -Top 25 |
Select-Object CreatedDateTime, UserPrincipalName, AppDisplayName, CorrelationId,
@{n='Reason';e={$_.Status.FailureReason}}Related: the AADSTS quick reference (common codes by area), the Intune and Jamf AADSTS reference (device-state codes) and Reading Microsoft Entra sign-in logs like an engineer.
AADSTS16000 to AADSTS40015: account picker, federation and scopes#
The 20xxx and 40xxx codes come from a federated identity provider, so the fix is usually on the IdP side; for AD FS, see the AD FS errors and event IDs reference.
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
AADSTS16000 InteractionRequired | Account from another identity provider doesn't exist in the tenant, so it can't use the app | No guest account; also common when a personal Microsoft account without a directory opens the Entra admin center | Sign in with an account from the tenant, or invite the user as a guest |
AADSTS16001 UserAccountSelectionInvalid | The account tile the user picked was rejected | A code defect or race condition (Microsoft's wording) | Pick from the refreshed list or choose another account |
AADSTS16002 AppSessionSelectionInvalid | The app's session (SID) requirement wasn't met | App asks for a session that doesn't match the signed-in one | Interactive sign-in; developers check the session hint the app sends |
AADSTS160021 AppSessionSelectionInvalidSessionNotExist | The user session the app requested doesn't exist | Session ended before the app asked for it | Fresh interactive sign-in (Microsoft's note also mentions creating a new Azure account) |
AADSTS16003 SsoUserAccountNotFoundInResourceTenant | User hasn't been explicitly added to the tenant | Guest not invited or not redeemed | Guest sign-in errors guide |
AADSTS17003 CredentialKeyProvisioningFailed | Entra ID can't provision the user key | Service-side failure; Microsoft gives no more detail | Retry; keep the correlation ID for a support case |
AADSTS20001 WsFedSignInResponseError | Problem with the federated identity provider's WS-Federation response | Error at the federation server (AD FS or a third-party IdP) | The IdP's logs; contact the IdP owner |
AADSTS20012 WsFedMessageInvalid | Invalid WS-Federation message from the federated identity provider | Malformed or unexpected IdP response | IdP configuration and logs |
AADSTS20033 FedMetadataInvalidTenantName | Problem with the federated identity provider (the name points to an invalid tenant name in federation metadata) | Federation settings that don't match the tenant | Get-MgDomainFederationConfiguration -DomainId output vs. the IdP's settings |
AADSTS230109 CachedCredentialNonGWAuthNRequestsNotSupported | Request bypassed the Microsoft Entra gateway, which the backup authentication service requires | Traffic sent straight to the backup service instead of through the reverse proxy | DNS overrides, hosts files or proxy rules for sign-in endpoints |
AADSTS28002 | Invalid scope value in the access token request | Mistyped or unknown scope | The scope string the app sends |
AADSTS28003 | Scope can't be empty when redeeming an authorization code | Token request without a scope | Add the scope to the code redemption |
AADSTS399284 InboundIdTokenIssuerInvalid | Federated ID token issuer is empty or doesn't match the realm identifier | Issuer configured for the external provider differs from the token's iss | Issuer in the provider's token vs. your configuration |
AADSTS40008 OAuth2IdPUnretryableServerError | Federated identity provider error (not retryable) | Failure at the external OAuth 2.0 identity provider | The IdP's status; contact the IdP |
AADSTS40009 OAuth2IdPRefreshTokenRedemptionUserError | Federated identity provider error while redeeming a refresh token | IdP-side session or token problem for the user | User signs in again; contact the IdP if it repeats |
AADSTS40010 OAuth2IdPRetryableServerError | Federated identity provider error (retryable) | Temporary IdP-side failure | Retry; check the IdP's status |
AADSTS40015 OAuth2IdPAuthCodeRedemptionUserError | Federated identity provider error while redeeming an authorization code | IdP rejected the code exchange | IdP-side app configuration and logs |
AADSTS50000 to AADSTS50015: resources, tenants, SAML and assertions#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
AADSTS50000 TokenIssuanceError | Problem with the sign-in service | Service-side issue | Retry; service health; support case with the correlation ID |
AADSTS50001 InvalidResource | The resource is disabled or doesn't exist | Wrong resource URL or App ID URI in the app | The exact resource identifier the app requests |
AADSTS50002 NotAllowedTenant | Sign-in blocked by restricted proxy access on the tenant | Tenant restrictions on the network or in your own tenant policy | Your restricted-tenant settings and the proxy's allowed list |
AADSTS500011 InvalidResourceServicePrincipalNotFound | Resource principal not found in the tenant | App not added or consented, or the wrong tenant | App sign-in errors guide |
AADSTS500014 InvalidResourceServicePrincipalDisabled | The resource's service principal is disabled | Lapsed subscription or an admin disabled the app | AADSTS quick reference |
AADSTS500021 | Access to the tenant denied by tenant restrictions | Tenant not in the allowed list | Guest sign-in errors guide |
AADSTS500022 | Access to the tenant is denied by tenant restrictions (Microsoft describes it like 500021) | Target tenant missing from the Restrict-Access-To-Tenant header | The header your proxy injects; add the tenant if access is intended |
AADSTS50003 MissingSigningKey | No signing key or certificate configured for the app | SAML app without a usable signing certificate; Microsoft also cites a corrupted application object | Create a new SAML signing certificate, make it active, remove the unused one |
AADSTS50005 DevicePolicyError | Device platform not supported by Conditional Access | Device-based policy met an unsupported or unrecognized platform | Device platforms condition; user agent in the log |
AADSTS50006 InvalidSignature | Signature verification failed | Signed request or token whose signature doesn't verify | App's signing certificate vs. the registered one |
AADSTS50007 PartnerEncryptionCertificateMissing | Partner encryption certificate not found for the app | Encryption certificate missing for the app | Support case, as Microsoft advises |
AADSTS50008 InvalidSamlToken | SAML assertion missing or misconfigured | The federation provider issued a bad token | AADSTS quick reference |
AADSTS5000224 NotAllowedTenantBlockedTenantFraud | This resource isn't available | Tenant blocked by Microsoft (the name refers to fraud) | Contact Microsoft support |
AADSTS5000819 InvalidSamlTokenEmailMissingOrInvalid | Email claim missing or wrong domain in the SAML assertion | Partner's SAML/WS-Fed IdP sends no email in the federated domain | The email claim the partner's IdP issues |
AADSTS50010 AudienceUriValidationFailed | No token audiences configured for the app | App has no identifier (audience) set | Identifier (Entity ID) or App ID URI |
AADSTS50011 InvalidReplyTo | Reply address missing or doesn't match the app's reply URLs | Redirect URI mismatch | App sign-in errors guide |
AADSTS50012 AuthenticationFailed | Certificate or client assertion validation failed | Unauthorized subject or thumbprint, untrusted or invalid certificate chain, bad assertion signature | Presented certificate vs. the app registration |
AADSTS50013 InvalidAssertion | Assertion invalid, expired or malformed | Issuer and API version mismatch, expiry, or a refresh token that isn't a primary refresh token | Decode the token the app passes; check iss, aud, exp |
AADSTS500133 | Assertion isn't within its valid time range | Expired access token used as the user assertion (on-behalf-of) | Get a fresh token before the assertion call |
AADSTS50014 GuestUserInPendingState | User account doesn't exist in the directory (the name refers to a guest in pending state) | Wrong tenant, or a guest who hasn't finished redemption | externalUserState; add or re-invite. Guest guide |
AADSTS50015 ViralUserLegalAgeConsentRequiredState | Legal age group consent required | Account classified as a minor without consent | ageGroup and consentProvidedForMinor on the user |
AADSTS50017 to AADSTS50050: certificates, guests, cross-tenant and tokens#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
AADSTS50017 CertificateValidationFailed | Certificate validation failed | Issuing CA not trusted, or CRL problems | CBA errors guide |
AADSTS500141 | Redemption complete, but the request wasn't started by the target app | Guest redeemed outside the app's sign-in flow | Open the app directly now. Guest guide |
AADSTS5001256 | Invalid id_token from the external identity provider | External OIDC provider returned a token Entra ID rejects | Failure details in the message; the provider's issuer, audience and keys |
AADSTS50020 UserUnauthorized | Account from another identity provider isn't in the tenant | External user never invited | Guest sign-in errors guide |
AADSTS500207 | Account type can't be used for this resource | The resource doesn't support that account type | The app's supported account types (signInAudience) |
AADSTS500208 | Domain isn't a valid sign-in domain for the account type | For example, a personal Microsoft account on a work-or-school-only tenant | Sign in with the expected account type |
AADSTS500212 NotAllowedByOutboundPolicyTenant | The user's tenant blocks outbound access | Home tenant's outbound cross-tenant settings | Guest sign-in errors guide |
AADSTS500213 NotAllowedByInboundPolicyTenant | The resource tenant blocks this user | Resource tenant's inbound cross-tenant settings | Guest sign-in errors guide |
AADSTS50027 InvalidJwtToken | JWT failed validation | Missing nonce or sub, duplicate claims, wrong issuer or audience, expiry, bad format or signature | Decode the token; compare iss, aud, exp and nonce |
AADSTS50029 | Invalid URI: the domain name contains invalid characters | Typo or unsupported characters in a URL or domain | The URLs and domains in the request |
AADSTS50032 WeakRsaKey | Attempt to use a weak RSA key | Certificate or key Entra ID considers too weak | Replace it with a stronger key |
AADSTS50033 RetryableError | Transient error not related to database operations | Temporary service condition | Retry with back-off |
AADSTS50034 UserAccountNotFound | The account isn't in this directory | Mistyped username or the wrong tenant | AADSTS quick reference |
AADSTS50042 UnableToGeneratePairwiseIdentifierWithMissingSalt | Salt for a pairwise identifier is missing | Not documented beyond the missing salt | Support case with the correlation ID |
AADSTS50043 UnableToGeneratePairwiseIdentifierWithMultipleSalts | Pairwise identifier can't be generated because of multiple salts (no description in Microsoft's table) | Not documented | Support case with the correlation ID |
AADSTS50048 SubjectMismatchesIssuer | Client assertion subject doesn't match its issuer | sub and iss differ in the client assertion | Both must carry the app's client ID |
AADSTS50049 NoSuchInstanceForDiscovery | Unknown or invalid instance | Wrong authority host in the app or library | The authority URL, including the cloud |
AADSTS50050 MalformedDiscoveryRequest | The discovery request is malformed | App or library built a bad discovery request | Authority configuration and library version |
AADSTS50053 to AADSTS50079: account state, sessions, sign-out and MFA#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
AADSTS50053 IdsLocked | Account locked by smart lockout, or sign-in from a malicious IP address | Repeated bad passwords or an attack | Smart lockout guide |
AADSTS50055 InvalidPasswordExpiredPassword | The password has expired | Password expiration policy | AADSTS quick reference |
AADSTS50056 | Invalid or null password: no password exists in the directory for this user | Empty password sent, or no password stored for the account | User re-enters it; for hybrid users, check how passwords are validated |
AADSTS50057 UserDisabled | The account is disabled | Disabled in Entra ID, or in AD and synced | Smart lockout guide |
AADSTS50058 UserInformationNotProvided | Session information not sufficient for single sign-on; the user isn't signed in | Expected when a silent request (prompt=none) finds no session | Whether the app falls back to interactive sign-in |
AADSTS50059 MissingTenantRealmAndNoUserInformationProvided | No tenant information in the request or credentials | Common endpoint used without a username or tenant | Tenant-specific endpoint, or pass the UPN |
AADSTS50061 SignoutInvalidRequest | Unable to complete sign-out; the request was invalid | Malformed logout request | The app's logout URL and parameters |
AADSTS50064 CredentialAuthenticationError | Username or password validation failed | Wrong credentials, or a failure in hybrid validation | Same checks as 50126; PTA agents or federation for hybrid users |
AADSTS50068 SignoutInitiatorNotParticipant | The app that started sign-out isn't in the current session | Logout started by an app the user didn't use in this session | The app's single logout configuration |
AADSTS50070 SignoutUnknownSessionIdentifier | Sign-out name identifier doesn't match an existing session | App sends a different NameID than it received | NameID in the logout request |
AADSTS50071 SignoutMessageExpired | The logout request has expired | Old request, or clock skew on the app server | App server time; send a fresh request |
AADSTS50072 UserStrongAuthEnrollmentRequiredInterrupt | User must register for MFA (interactive) | MFA registration required | MFA errors guide |
AADSTS50074 UserStrongAuthClientAuthNRequiredInterrupt | MFA required and not passed | Interrupt before the MFA step | MFA errors guide |
AADSTS50076 UserStrongAuthClientAuthNRequired | MFA required for this resource | Conditional Access, per-user MFA or a new location | MFA errors guide |
AADSTS50078 UserStrongAuthExpired | Presented MFA has expired under your policies | Sign-in frequency or MFA lifetime | MFA errors guide |
AADSTS50079 UserStrongAuthEnrollmentRequired | MFA required; security info must be registered (federated users bring the MFA claim) | First sign-in after MFA enforcement | MFA errors guide |
How to verify a fix#
- Reproduce with the same user, app and device, then open the new sign-in log entry. Success, or a different code, shows the original cause is gone.
- For interrupts and silent-SSO codes (50058, 50072, 50074), check the next entry with the same correlation ID; a success there means the flow worked.
- For app codes (28002, 50012, 50013, 50048), request a token again; app-only attempts appear under service principal sign-ins.
- If you stream sign-in logs to Log Analytics, confirm the code stops appearing:
KQL
SigninLogs
| where TimeGenerated > ago(7d)
| where ResultType in ("50014", "50056", "50059")
| summarize Attempts = count(), Users = dcount(UserPrincipalName) by ResultType, AppDisplayName
| order by Attempts descApp-only failures land in AADServicePrincipalSignInLogs. When Microsoft's own advice is to contact support (50000, 50007, 50042, 5000224), open the case with the correlation ID, request ID and timestamp.
References#
- Microsoft Entra authentication and authorization error codes (source of the codes and their order)
- How to troubleshoot Microsoft Entra sign-in errors
- Error AADSTS50003 - No signing key configured
