AADSTS error codes 65001–81012: the complete list with fixes (part 3 of 5)

This is part 3 of my complete AADSTS reference: every code Microsoft lists from AADSTS65001 to AADSTS81012, in the order of Microsoft's table. The range covers consent, client credentials and token grants, SAML requests, pass-through authentication and Seamless single sign-on. Each row gives the meaning in plain English, the usual cause and the first thing to check, and links to a detailed guide where this site already has one.

How to read these codes#

• Consent, client and grant codes (65xxx–70xxx) usually surface in the app: an error page after the Microsoft sign-in screen, or the error_description in the token endpoint's JSON response. App-only sign-ins appear on the Service principal sign-ins tab of the sign-in logs, not on the user tab.
• SAML codes (75xxx–76xxx) appear on the Microsoft sign-in page when someone opens a SAML app. The fix is nearly always in the service provider's settings, so capture the SAML request in the browser's developer tools and compare it with the app's Single sign-on page in Entra.
• Pass-through authentication (80xxx) and Seamless SSO (81xxx) codes come from your on-premises side: the Authentication Agent or Kerberos. Users see them on the sign-in page; the sign-in log shows the number as the sign-in error code.

Microsoft notes that codes and messages can change. For the current wording of one code, add its number to https://login.microsoftonline.com/error?code=. To find who is hitting a code, query the sign-in logs:

Connect-MgGraph -Scopes "AuditLog.Read.All","Directory.Read.All"
Get-MgAuditLogSignIn -Filter "status/errorCode eq 80002" -Top 25 |
    Select-Object CreatedDateTime, UserPrincipalName, AppDisplayName,
        @{n='Reason';e={$_.Status.FailureReason}}

Consent and permissions (65001–650057)#

Clients, grants and tokens (67003–70043)#

SAML requests (75001–76026)#

Pass-through authentication (80001–80014)#

Agent events are in Event Viewer under Applications and Services Logs › Microsoft › AzureAdConnect › AuthenticationAgent › Admin; per-sign-in reasons are in the trace logs under %ProgramData%\Microsoft\Azure AD Connect Authentication Agent\Trace\.

Also listed on Microsoft's pass-through authentication troubleshooting page#

Seamless single sign-on (81004–81012)#

Microsoft's Seamless SSO checklist: the device is joined to AD and on the corporate network; the user signed in with a domain account from a forest where the feature is enabled; https://autologon.microsoftazuread-sso.com is in the Local intranet zone (not Trusted sites); clocks are within five minutes; and the AZUREADSSOACC computer account exists and is enabled. The same page also lists sign-in codes 81001 (Kerberos ticket too large: reduce group memberships) and 81002, 81003 and 81008 (ticket can't be validated), which the Seamless SSO guide above covers.

How to verify a fix#

1. Repeat the same sign-in with the same user, app and client, then find the new attempt by correlation ID. Good: Success, or a different code if one problem was hiding another.
2. Consent: the app's Permissions page under Enterprise apps lists the granted permissions, and the next sign-in shows no consent prompt.
3. Client credentials: request a token with the app's own credential and confirm a success on the Service principal sign-ins tab.
4. Pass-through authentication: on an agent server, test the same credentials outside the cloud flow:
   PowerShell

   Import-Module "C:\Program Files\Microsoft Azure AD Connect Authentication Agent\Modules\PassthroughAuthPSModule\PassthroughAuthPSModule.psd1"
   Invoke-PassthroughAuthOnPremLogonTroubleshooter

   If it returns the same username or password error, the agent works; Microsoft points to a non-routable on-premises UPN as the likely cause.
5. Seamless SSO: run klist purge, browse to the app again, then klist should list a ticket issued for the AZUREADSSOACC account.
6. If sign-in logs go to Log Analytics, watch the codes fall away:
   KQL

   SigninLogs
   | where TimeGenerated > ago(7d)
   | where ResultType in ("80002", "80005", "80013", "81006", "81010")
   | summarize Failures = count() by ResultType, ResultDescription, bin(TimeGenerated, 1d)

For the fields in each entry, see Reading Microsoft Entra sign-in logs like an engineer.

References#

• Microsoft Entra authentication and authorization error codes (Microsoft Learn): the source table for every code on this page.
• Troubleshoot Microsoft Entra pass-through authentication (Microsoft Learn): sign-in failure reasons, agent logs and the troubleshooter.
• Troubleshoot Microsoft Entra seamless single sign-on (Microsoft Learn): failure codes and the client checklist.