Microsoft Entra AADSTS error codes: a quick reference with meanings and fixes

Every refused or interrupted Microsoft Entra sign-in comes with an AADSTS code, and the code usually tells you which side to look at: the user, the policy, the app or the partner tenant. This quick reference covers 56 common codes, grouped by area, with Microsoft's meaning, the usual cause and the first thing to check.

How to read these codes#

• Sign-in page: the code and a short message. More details adds the request ID, correlation ID and timestamp; ask users for them.
• Sign-in logs (Entra ID › Monitoring & health › Sign-in logs): the number without the prefix, the failure reason and the Conditional Access and Authentication Details tabs. App-only sign-ins are on the Service principal sign-ins tab.
• Apps and scripts: the token endpoint returns JSON with error, error_description, error_codes, correlation_id and an error_uri.

Some codes are interrupts, not failures: Entra ID asks for MFA, consent or a device proof and a success often follows, so check the next entry first. Microsoft says codes and messages can change; for the current text, add the number to https://login.microsoftonline.com/error?code=. Device-state codes (53000, 53001, 50155, 135011 and others) are in the Intune and Jamf AADSTS quick reference.

Connect-MgGraph -Scopes "AuditLog.Read.All","Directory.Read.All"
Get-MgAuditLogSignIn -Filter "status/errorCode eq 50126" -Top 20 |
    Select-Object CreatedDateTime, UserPrincipalName, AppDisplayName, IPAddress,
        @{n='Reason';e={$_.Status.FailureReason}}

Accounts, passwords and lockout#

MFA and authentication methods#

Conditional Access, security defaults and risk#

Consent and permissions#

App registrations and client credentials#

Tokens and sessions#

B2B, tenants and cross-tenant access#

Federation, pass-through authentication and certificates#

How to verify a fix#

1. Reproduce with the same user, app and client, then find the new entry by correlation ID. It should show Success, or a different code if one problem was hiding another.
2. For interrupts (MFA, consent), confirm the next entry completes without the same code.
3. For apps, request a token again and check the Service principal sign-ins tab.
4. If sign-in logs are sent to Log Analytics, watch the code disappear:

SigninLogs
| where TimeGenerated > ago(2d)
| where ResultType == "50126"
| summarize Failures = count() by bin(TimeGenerated, 1h)

For app-only codes, use the AADServicePrincipalSignInLogs table instead. Reading Microsoft Entra sign-in logs like an engineer explains the fields.

References#

• Microsoft Entra authentication and authorization error codes (source of the meanings)
• How to troubleshoot Microsoft Entra sign-in errors
• Unexpected error when performing consent to an application