Microsoft Entra AADSTS error codes 50085–54005: the complete list with fixes (part 2 of 5)

Part 2 of the complete AADSTS reference covers the longest stretch of Microsoft's table: all 99 codes from AADSTS50085 to AADSTS54005, in Microsoft's order. It spans MFA service errors, device proof, claims transformations, PKCE, external providers and the core Conditional Access blocks, each with a plain-English meaning, the usual cause and the first check.

How to read these codes#

• Where they appear: the sign-in page (with a correlation ID), Entra ID › Monitoring & health › Sign-in logs (the error code without the prefix) and the token endpoint's JSON for apps and scripts. For Microsoft's current wording, add the number to https://login.microsoftonline.com/error?code=.
• Interrupts: 50097, 50125, 50140, 50168 and 50199 normally precede a success with the same correlation ID. Investigate only when no success follows.
• Developer codes: PKCE, claims transformation and token-format codes are fixed in the app or its claims configuration, not in Conditional Access.

This query lists sign-ins where an interrupt never turned into a success:

let interrupts = dynamic(["50097", "50125", "50140", "50168", "50199"]);
SigninLogs
| where TimeGenerated > ago(1d)
| summarize Codes = make_set(ResultType), Successes = countif(ResultType == "0")
    by CorrelationId, UserPrincipalName, AppDisplayName
| where array_length(set_intersect(Codes, interrupts)) > 0 and Successes == 0

Related: the AADSTS quick reference (common codes by area), the Intune and Jamf AADSTS reference and the device registration error codes.

AADSTS50085 to AADSTS50124: MFA service, device proof and claims transformations#

Claims codes point at the app's claims configuration: Entra ID › Enterprise apps › your app › Single sign-on › User Attributes & Claims, or a claims mapping policy set through Microsoft Graph.

AADSTS501241 to AADSTS50144: credentials, devices, sessions and passwords#

AADSTS50147 to AADSTS50158: PKCE, signing keys and device tokens#

PKCE codes are developer fixes: the app sends a code_challenge with the authorization request and the matching code_verifier when it redeems the code. Microsoft's table lists 50147 twice; both entries describe an invalid code challenge.

AADSTS50159 to AADSTS50180: external providers, claims limits and passthrough users#

Several codes here involve external providers that Entra ID calls during sign-in, such as third-party MFA integrations. The regex codes come from regex-based claims transformations.

AADSTS50187 to AADSTS54005: device information, Conditional Access and authorization codes#

How to verify a fix#

1. Reproduce with the same user, app and client, then open the new sign-in log entry: success or a different code means the cause is gone.
2. For interrupts, run the query above again; the correlation ID should now include a success.
3. For Conditional Access codes (50131, 53002, 53010), the entry's Conditional Access tab should no longer show a failed policy.
4. For 50146 and 501461, confirm the app's identifier and mapped-claims setting, then sign in again:

Connect-MgGraph -Scopes "Application.Read.All"
Get-MgApplication -Filter "appId eq '00001111-aaaa-2222-bbbb-3333cccc4444'" -Property displayName,identifierUris,api |
    Select-Object DisplayName, IdentifierUris, @{n='AcceptMappedClaims';e={$_.Api.AcceptMappedClaims}}

Where Microsoft documents no cause (50108, 50138, 50141, 51000), open a support case with the correlation ID, request ID and timestamp.

References#

• Microsoft Entra authentication and authorization error codes (source of the codes and their order)
• Customize claims with the claims mapping policy in Microsoft Graph
• Enable B2B collaboration across Microsoft clouds