Entra ID, Active Directory, Defender, Exchange Online and Microsoft 365 errors — and how to fix them
Search 1659 error codes and messages from 157 guides for Microsoft Entra ID, Active Directory, Microsoft Defender, Exchange Online and Microsoft 365 — AADSTS sign-in errors, Conditional Access blocks, Entra Connect sync errors, Active Directory and domain controller errors, Defender onboarding and sensor errors, Exchange Online NDRs and licensing errors. Paste the code or message you see and open the guide that fixes it.
Exchange Server error library (857) Intune error library (844) Configuration Manager error library (340) Purview error library (234) Download all as CSVJSON
Area
Code lists
Showing all 1659 errors
Entra ID
Sign-in and AADSTS errors, Conditional Access, Active Directory and domain controllers, Entra Connect sync, device registration and hybrid identity
0x801c001ddsregcmd /status (Client ErrorCode)Troubleshooting Microsoft Entra hybrid join with dsregcmd /status
0x801c03f2dsregcmd /status (Client ErrorCode)Troubleshooting Microsoft Entra hybrid join with dsregcmd /status
0x801c0021 / 0x80072ee2dsregcmd /status (Client ErrorCode)Troubleshooting Microsoft Entra hybrid join with dsregcmd /status
0x80090016dsregcmd /status (Client ErrorCode)Troubleshooting Microsoft Entra hybrid join with dsregcmd /status
0xc000006ddsregcmd /status (Attempt Status)Primary Refresh Token (PRT) explained: fixing SSO and repeated sign-in prompts
0xE0474352Entra Connect Sync setup (2.6.84.0)Keeping Microsoft Entra Connect Sync supported: versions, auto-upgrade, in-place upgrades
1002 No Microsoft Entra device stateMicrosoft Entra sign-in log (token protection)Token protection in Conditional Access: binding sign-in sessions to the device
1003 Device state doesn't meet requirementsMicrosoft Entra sign-in log (token protection)Token protection in Conditional Access: binding sign-in sessions to the device
1004 Apple: registration isn't hardware-backedMicrosoft Entra sign-in log (token protection)Token protection in Conditional Access: binding sign-in sessions to the device
1006 OS version unsupportedMicrosoft Entra sign-in log (token protection)Token protection in Conditional Access: binding sign-in sessions to the device
1008 Client isn't using the platform broker (WAM or the SSO plug-in)Microsoft Entra sign-in log (token protection)Token protection in Conditional Access: binding sign-in sessions to the device
12002 / 12007 / 12029 / 12030 (WinHTTP)dsregcmd /status (SSO State)Primary Refresh Token (PRT) explained: fixing SSO and repeated sign-in prompts
50053Microsoft Entra sign-in logReading Microsoft Entra sign-in logs like an engineer
50058Microsoft Entra sign-in logReading Microsoft Entra sign-in logs like an engineer
50126Microsoft Entra sign-in logReading Microsoft Entra sign-in logs like an engineer
50140 / 50074 / 50125 / 50199Microsoft Entra sign-in log (Interrupted)Reading Microsoft Entra sign-in logs like an engineer
70043 / 70046Microsoft Entra sign-in logReading Microsoft Entra sign-in logs like an engineer
81001Microsoft Entra sign-in logSeamless SSO not working: the AZUREADSSOACC account, Kerberos and the intranet zone
81002 / 81003 / 81008 / 81009Microsoft Entra sign-in logSeamless SSO not working: the AZUREADSSOACC account, Kerberos and the intranet zone
81004Microsoft Entra sign-in logSeamless SSO not working: the AZUREADSSOACC account, Kerberos and the intranet zone
81010Microsoft Entra sign-in logSeamless SSO not working: the AZUREADSSOACC account, Kerberos and the intranet zone
81011 / 81013Microsoft Entra sign-in logSeamless SSO not working: the AZUREADSSOACC account, Kerberos and the intranet zone
81012Microsoft Entra sign-in logSeamless SSO not working: the AZUREADSSOACC account, Kerberos and the intranet zone
500121Microsoft Entra sign-in logReading Microsoft Entra sign-in logs like an engineer
AADSTS50011: The redirect URI '...' specified in the request does not match the redirect URIs configured for the application '...'.Sign-in pageApp sign-in errors in Microsoft Entra ID: AADSTS7000215, AADSTS700016, AADSTS50011 and more
AADSTS50020: User account '...' from identity provider '...' does not exist in tenant '...' and cannot access the applicationSign-in pageGuest sign-in errors in Microsoft Entra ID: AADSTS90072, AADSTS50020 and cross-tenant blocks
AADSTS50034 / 0xc000005fdsregcmd /status (SSO State)Primary Refresh Token (PRT) explained: fixing SSO and repeated sign-in prompts
AADSTS50053Sign-in page / Microsoft Entra sign-in logMicrosoft Entra ID Protection: risk policies, self-remediation and false positives
AADSTS50053 IdsLockedSign-in page / Microsoft Entra sign-in logAADSTS50053 account locked in Microsoft Entra ID: smart lockout and on-premises lockouts
AADSTS50057: The user account is disabled.Sign-in page / Microsoft Entra sign-in logAADSTS50053 account locked in Microsoft Entra ID: smart lockout and on-premises lockouts
AADSTS50072 UserStrongAuthEnrollmentRequiredInterruptMicrosoft Entra sign-in logAADSTS50076, AADSTS50079 and AADSTS50158: fixing MFA and authentication-strength sign-in errors
AADSTS50074 UserStrongAuthClientAuthNRequiredInterruptMicrosoft Entra sign-in logAADSTS50076, AADSTS50079 and AADSTS50158: fixing MFA and authentication-strength sign-in errors
AADSTS50076 UserStrongAuthClientAuthNRequiredMicrosoft Entra sign-in logAADSTS50076, AADSTS50079 and AADSTS50158: fixing MFA and authentication-strength sign-in errors
AADSTS50078 UserStrongAuthExpiredMicrosoft Entra sign-in logAADSTS50076, AADSTS50079 and AADSTS50158: fixing MFA and authentication-strength sign-in errors
AADSTS50078: Presented multifactor authentication has expired due to policies configured by your administrator.Microsoft Entra sign-in logUsers keep being asked to sign in again: Entra sign-in frequency and AADSTS70043
AADSTS50079 UserStrongAuthEnrollmentRequiredMicrosoft Entra sign-in logAADSTS50076, AADSTS50079 and AADSTS50158: fixing MFA and authentication-strength sign-in errors
AADSTS50126: Error validating credentials due to invalid username or password.dsregcmd /status (SSO State)Primary Refresh Token (PRT) explained: fixing SSO and repeated sign-in prompts
AADSTS50126: Error validating credentials due to invalid username or password.Sign-in page / Microsoft Entra sign-in logAADSTS50053 account locked in Microsoft Entra ID: smart lockout and on-premises lockouts
AADSTS50133: The session isn't valid due to password expiration or recent password change.Sign-in page / Microsoft Entra sign-in logUsers keep being asked to sign in again: Entra sign-in frequency and AADSTS70043
AADSTS50140: This error occurred due to "Keep me signed in" interrupt when the user was signing-in.Microsoft Entra sign-in log (Interrupted)Users keep being asked to sign in again: Entra sign-in frequency and AADSTS70043
AADSTS50144 InvalidPasswordExpiredOnPremPasswordMicrosoft Entra sign-in logAADSTS50053 account locked in Microsoft Entra ID: smart lockout and on-premises lockouts
AADSTS50155dsregcmd /status (SSO State)Primary Refresh Token (PRT) explained: fixing SSO and repeated sign-in prompts
AADSTS50158 ExternalSecurityChallengeMicrosoft Entra sign-in logAADSTS50076, AADSTS50079 and AADSTS50158: fixing MFA and authentication-strength sign-in errors
AADSTS50173: The provided grant has expired due to it being revoked, a fresh auth token is needed.App sign-in / Microsoft Entra sign-in logUsers keep being asked to sign in again: Entra sign-in frequency and AADSTS70043
AADSTS50192: No Credential was included in the sign-in request.Sign-in page / Microsoft Entra sign-in logMicrosoft Entra CBA sign-in errors: trust store, CRL checks, bindings and AADSTS500173
AADSTS53000 DeviceNotCompliantSign-in page / Microsoft Entra sign-in logAADSTS53000 vs AADSTS53003: troubleshooting Conditional Access sign-in blocks
AADSTS53001Sign-in page / Microsoft Entra sign-in logTroubleshooting Microsoft Entra hybrid join with dsregcmd /status
AADSTS53001 DeviceNotDomainJoinedSign-in page / Microsoft Entra sign-in logAADSTS53000 vs AADSTS53003: troubleshooting Conditional Access sign-in blocks
AADSTS53003 BlockedByConditionalAccessSign-in page / Microsoft Entra sign-in logAADSTS53000 vs AADSTS53003: troubleshooting Conditional Access sign-in blocks
AADSTS53004Microsoft Entra sign-in logA Conditional Access baseline: the first policies every tenant should deploy
AADSTS53004 ProofUpBlockedDueToRiskMicrosoft Entra sign-in logAADSTS50076, AADSTS50079 and AADSTS50158: fixing MFA and authentication-strength sign-in errors
AADSTS65001: The user or administrator has not consented to use the application with ID '...' named '...'.App error / Microsoft Entra sign-in log"Need admin approval": AADSTS65001 and AADSTS90094 consent errors in Microsoft Entra ID
AADSTS65004 UserDeclinedConsentMicrosoft Entra sign-in log"Need admin approval": AADSTS65001 and AADSTS90094 consent errors in Microsoft Entra ID
AADSTS70043: The refresh token has expired or is invalid due to sign-in frequency checks by Conditional Access.Microsoft Entra sign-in logUsers keep being asked to sign in again: Entra sign-in frequency and AADSTS70043
AADSTS90071: An admin from ... must update their access settings to accept inbound multifactor authentication.Teams shared channel sign-inGuest sign-in errors in Microsoft Entra ID: AADSTS90072, AADSTS50020 and cross-tenant blocks
AADSTS90072: User account '...' from identity provider '...' does not exist in tenant '...' and cannot access the applicationSign-in pageGuest sign-in errors in Microsoft Entra ID: AADSTS90072, AADSTS50020 and cross-tenant blocks
AADSTS90094: ... needs permission to access resources in your organization that only an admin can grant.Consent prompt"Need admin approval": AADSTS65001 and AADSTS90094 consent errors in Microsoft Entra ID
AADSTS220501: Unable to download Certificate Revocation List (CRL). Invalid response or no response from CRL Distribution PointSign-in page / Microsoft Entra sign-in logMicrosoft Entra CBA sign-in errors: trust store, CRL checks, bindings and AADSTS500173
AADSTS500011: The resource principal named ... was not found in the tenant named ...Sign-in page / token responseApp sign-in errors in Microsoft Entra ID: AADSTS7000215, AADSTS700016, AADSTS50011 and more
AADSTS500171: Certificate has been revoked. Please contact your administrator.Sign-in page / Microsoft Entra sign-in logMicrosoft Entra CBA sign-in errors: trust store, CRL checks, bindings and AADSTS500173
AADSTS500172: Certificate '{name}' issued by '{issuer}' is not valid.Sign-in page / Microsoft Entra sign-in logMicrosoft Entra CBA sign-in errors: trust store, CRL checks, bindings and AADSTS500173
AADSTS500173: Unable to download a Certificate Revocation List (CRL). Invalid status code {code} from CRL distribution point.Sign-in page / Microsoft Entra sign-in logMicrosoft Entra CBA sign-in errors: trust store, CRL checks, bindings and AADSTS500173
AADSTS500176: The certificate authority that issued your certificate hasn't been set up in the tenant.Sign-in page / Microsoft Entra sign-in logMicrosoft Entra CBA sign-in errors: trust store, CRL checks, bindings and AADSTS500173
AADSTS500179: CRL validation timed out. Please try again later.Sign-in page / Microsoft Entra sign-in logMicrosoft Entra CBA sign-in errors: trust store, CRL checks, bindings and AADSTS500173
AADSTS500212 NotAllowedByOutboundPolicyTenantSign-in page / Microsoft Entra sign-in logGuest sign-in errors in Microsoft Entra ID: AADSTS90072, AADSTS50020 and cross-tenant blocks
AADSTS500213 NotAllowedByInboundPolicyTenantSign-in page / Microsoft Entra sign-in logGuest sign-in errors in Microsoft Entra ID: AADSTS90072, AADSTS50020 and cross-tenant blocks
AADSTS700016: Application with identifier '...' was not found in the directory '...'.Sign-in page / token responseApp sign-in errors in Microsoft Entra ID: AADSTS7000215, AADSTS700016, AADSTS50011 and more
AADSTS700027: Client assertion failed signature validation.Token response / service principal sign-insApp sign-in errors in Microsoft Entra ID: AADSTS7000215, AADSTS700016, AADSTS50011 and more
AADSTS700082: The refresh token has expired due to inactivity.App sign-in / Microsoft Entra sign-in logUsers keep being asked to sign in again: Entra sign-in frequency and AADSTS70043
AADSTS2205015: The Certificate Revocation List (CRL) failed signature validation.Sign-in page / Microsoft Entra sign-in logMicrosoft Entra CBA sign-in errors: trust store, CRL checks, bindings and AADSTS500173
AADSTS7000215: Invalid client secret provided.Token response / service principal sign-insApp sign-in errors in Microsoft Entra ID: AADSTS7000215, AADSTS700016, AADSTS50011 and more
AADSTS7000222: The provided client secret keys for app '...' are expired.Token response / service principal sign-insApp sign-in errors in Microsoft Entra ID: AADSTS7000215, AADSTS700016, AADSTS50011 and more
AttributeValueMustBeUniqueSynchronization Service ManagerEntra Connect sync errors: duplicates, InvalidSoftMatch and objects that never sync
AzureAdPrt : NO AcquirePrtDiagnostics : PRESENTdsregcmd /status (SSO State)Primary Refresh Token (PRT) explained: fixing SSO and repeated sign-in prompts
completed-export-errorsSynchronization Service Manager (export run)Entra Connect sync errors: duplicates, InvalidSoftMatch and objects that never sync
Connection to Microsoft Entra ID failed due to authentication failureMicrosoft Entra Connect HealthMicrosoft Entra Connect Health: installing the agents and acting on sync alerts
Device is either disabled or deleteddsregcmd /status (DeviceAuthStatus)Troubleshooting Microsoft Entra hybrid join with dsregcmd /status
DomainJoined : YES but AzureAdJoined : NOdsregcmd /statusTroubleshooting Microsoft Entra hybrid join with dsregcmd /status
Event ID 304 / 305 / 307 (User Device Registration)Event Viewer (User Device Registration Admin)Troubleshooting Microsoft Entra hybrid join with dsregcmd /status
Event ID 1081 (AAD)Event Viewer (AAD Operational)Primary Refresh Token (PRT) explained: fixing SSO and repeated sign-in prompts
Event ID 1088 (AAD)Event Viewer (AAD Operational)Primary Refresh Token (PRT) explained: fixing SSO and repeated sign-in prompts
Event ID 4740: A user account was locked out.Security log (domain controller)AADSTS50053 account locked in Microsoft Entra ID: smart lockout and on-premises lockouts
Event ID 6329 (ADSync): 0x80230619Application log (Entra Connect server)Self-service password reset and password writeback: fixing the usual failures
Event ID 32002 / 32009 (PasswordResetService)Application log (Entra Connect server)Self-service password reset and password writeback: fixing the usual failures
Event ID 33004 / 33005 / 33006 / 33008 (PasswordResetService)Application log (Entra Connect server)Self-service password reset and password writeback: fixing the usual failures
Existing Admin Role ConflictSynchronization Service ManagerEntra Connect sync errors: duplicates, InvalidSoftMatch and objects that never sync
Export to Microsoft Entra ID was Stopped. Accidental delete threshold was reachedMicrosoft Entra Connect HealthMicrosoft Entra Connect Health: installing the agents and acting on sync alerts
FileLoadException for System.Diagnostics.DiagnosticSourceSync cycle after a Connect Sync upgradeKeeping Microsoft Entra Connect Sync supported: versions, auto-upgrade, in-place upgrades
Health Service data is not up to dateMicrosoft Entra Connect HealthMicrosoft Entra Connect Health: installing the agents and acting on sync alerts
IdentityDataValidationFailed / DataValidationFailedSynchronization Service ManagerEntra Connect sync errors: duplicates, InvalidSoftMatch and objects that never sync
insufficient_claimsHTTP 401 claim challenge (WWW-Authenticate)Continuous access evaluation in Entra ID: how it works, strict location and IP mismatches
InvalidHardMatchSynchronization Service ManagerEntra Connect sync errors: duplicates, InvalidSoftMatch and objects that never sync
InvalidSoftMatchSynchronization Service ManagerEntra Connect sync errors: duplicates, InvalidSoftMatch and objects that never sync
Invitee's Admin has disallowed EmailVerified Users from being created in their tenantInvitation redemptionGuest sign-in errors in Microsoft Entra ID: AADSTS90072, AADSTS50020 and cross-tenant blocks
LargeObject / ExceededAllowedLengthSynchronization Service ManagerEntra Connect sync errors: duplicates, InvalidSoftMatch and objects that never sync
Need admin approvalConsent prompt"Need admin approval": AADSTS65001 and AADSTS90094 consent errors in Microsoft Entra ID
ObjectTypeMismatchSynchronization Service ManagerEntra Connect sync errors: duplicates, InvalidSoftMatch and objects that never sync
Password Hash Synchronization has stopped workingMicrosoft Entra Connect HealthMicrosoft Entra Connect Health: installing the agents and acting on sync alerts
Report-only: FailureMicrosoft Entra sign-in log (Report-only tab)Test before you enforce: Conditional Access What If and report-only mode
Report-only: User action requiredMicrosoft Entra sign-in log (Report-only tab)Test before you enforce: Conditional Access What If and report-only mode
reportOnlyFailureLog Analytics (SigninLogs)Test before you enforce: Conditional Access What If and report-only mode
reportOnlyInterruptedLog Analytics (SigninLogs)Test before you enforce: Conditional Access What If and report-only mode
Roles are being assigned outside of Privileged Identity ManagementPrivileged Identity Management alertsPrivileged Identity Management: just-in-time Microsoft Entra roles done properly
Sign-in was blocked by built-in protections due to high confidence of riskMicrosoft Entra sign-in logMicrosoft Entra ID Protection: risk policies, self-remediation and false positives
SSPR_0013SSPR portal (aka.ms/sspr)Self-service password reset and password writeback: fixing the usual failures
SSPR_0014SSPR portal (aka.ms/sspr)Self-service password reset and password writeback: fixing the usual failures
SSPR_0029SSPR portal (aka.ms/sspr)Self-service password reset and password writeback: fixing the usual failures
SSPR_0030SSPR portal (aka.ms/sspr)Self-service password reset and password writeback: fixing the usual failures
stopped-deletion-threshold-exceededSynchronization Service Manager (export run)Filtering Microsoft Entra Connect Sync by OU, group and attribute without deleting users
The passkey already existsMicrosoft Authenticator (passkey registration)Rolling out passkeys in Microsoft Authenticator: policy, registration and the errors users hit
The sync service isn't runningMicrosoft Entra Connect HealthMicrosoft Entra Connect Health: installing the agents and acting on sync alerts
There are too many Global AdministratorsPrivileged Identity Management alertsPrivileged Identity Management: just-in-time Microsoft Entra roles done properly
This invitation is blocked by cross-tenant access settings.Invite user (Entra admin center)Guest sign-in errors in Microsoft Entra ID: AADSTS90072, AADSTS50020 and cross-tenant blocks
Unfamiliar sign-in propertiesID Protection risk detectionsMicrosoft Entra ID Protection: risk policies, self-remediation and false positives
WorkplaceJoined : YES in User Statedsregcmd /status on a hybrid joined PCDual state, Pending and duplicate device objects in Microsoft Entra ID: a clean-up guide
You can't get there from hereSign-in pageDual state, Pending and duplicate device objects in Microsoft Entra ID: a clean-up guide
Your account is temporarily locked to prevent unauthorized use. Try again later, and if you still have trouble, contact your admin.Sign-in pageAADSTS50053 account locked in Microsoft Entra ID: smart lockout and on-premises lockouts
Your administrator has not enabled you to use this featureSSPR portal (aka.ms/sspr)Self-service password reset and password writeback: fixing the usual failures
Your network administrator has restricted what organizations can be accessed.Sign-in pageGuest sign-in errors in Microsoft Entra ID: AADSTS90072, AADSTS50020 and cross-tenant blocks
Your organization has deleted the deviceWindows / Office sign-in promptDual state, Pending and duplicate device objects in Microsoft Entra ID: a clean-up guideExchange Online
NDRs, mail flow, connectors, message trace and mailbox management
5.1.10 Recipient not foundNDRNDR 550 5.1.10 RESOLVER.ADR.RecipientNotFound in Exchange Online: causes and fixes
5.1.90 Your message can't be sent because you've reached your daily limit for message recipientsNDRUsers blocked from sending in Exchange Online: Restricted entities and NDR 550 5.1.8
5.7.60 Client doesn't have permissions to send as this senderSMTP response (device or app log)Printers and apps can't send via Microsoft 365: SMTP AUTH, relay connectors and 5.7.57
5.7.60 SMTP; Client does not have permissions to send as this senderSMTP client / applicationExchange Online mailbox permissions: fixing Full Access, Send As and Send on Behalf errors
5.7.124 Sender not in allowed-senders listNDRNDR 550 5.7.1 Delivery not authorized, message refused: fixing it in Exchange Online
5.7.134 Sender was not authenticated for mailboxNDRNDR 550 5.7.1 Delivery not authorized, message refused: fixing it in Exchange Online
5.7.705 Access denied, tenant has exceeded thresholdNDRNDR 550 5.7.708 in Exchange Online: Access denied, traffic not accepted from this IP
5.7.708 Access denied, traffic not accepted from this IPNDRNDR 550 5.7.708 in Exchange Online: Access denied, traffic not accepted from this IP
5.7.750 Client blocked from sending from unregistered domainNDRNDR 550 5.7.750 in Exchange Online: Client blocked from sending from unregistered domains
530 5.7.57 SMTP; Client was not authenticated to send anonymous mail during MAIL FROMSMTP response (device or app log)Printers and apps can't send via Microsoft 365: SMTP AUTH, relay connectors and 5.7.57
535 5.7.139 Authentication unsuccessful, basic authentication is disabledSMTP response (device or app log)Printers and apps can't send via Microsoft 365: SMTP AUTH, relay connectors and 5.7.57
550 5.1.8 Access denied, bad outbound senderNDRUsers blocked from sending in Exchange Online: Restricted entities and NDR 550 5.1.8
550 5.1.10 RESOLVER.ADR.RecipientNotFound; Recipient not found by SMTP address lookupNDR / message traceNDR 550 5.1.10 RESOLVER.ADR.RecipientNotFound in Exchange Online: causes and fixes
550 5.4.1 Recipient address rejected: Access denied. AS(201806281)NDRNDR 550 5.4.1 “Recipient address rejected: Access denied”: Directory-Based Edge Blocking
550 5.4.1 Recipient address rejected: Access denied. AS(201806281)NDRMoving from a third-party email gateway to Exchange Online Protection: a cutover runbook
550 5.5.0 Requested action not taken: mailbox unavailableNDR (Outlook.com and Hotmail recipients)NDR 550 5.1.10 RESOLVER.ADR.RecipientNotFound in Exchange Online: causes and fixes
550 5.7.1 RESOLVER.RST.AuthRequired; authentication required [Stage: CreateMessage]NDR (diagnostic information)NDR 550 5.7.1 Delivery not authorized, message refused: fixing it in Exchange Online
550 5.7.51 TenantInboundAttribution; There is a partner connector configured that matched the message's recipient domainNDRMoving from a third-party email gateway to Exchange Online Protection: a cutover runbook
550 5.7.57 Client not authenticated to send mail. Error: 535 5.7.139 Authentication unsuccessful, basic authentication is disabledSMTP response (device or app log)Printers and apps can't send via Microsoft 365: SMTP AUTH, relay connectors and 5.7.57
550 5.7.64 TenantAttribution; Relay Access DeniedNDR / SMTP logMoving from a third-party email gateway to Exchange Online Protection: a cutover runbook
550 5.7.68 TenantInboundAttribution; Direct Send not allowed for this organization from unauthorized sourcesNDRMoving from a third-party email gateway to Exchange Online Protection: a cutover runbook
550 5.7.133 RESOLVER.RST.SenderNotAuthenticatedForGroup; authentication requiredNDR / message traceNDR 550 5.7.1 Delivery not authorized, message refused: fixing it in Exchange Online
550 5.7.520 Access denied, Your organization does not allow external forwarding.NDRNDR 550 5.7.520: fixing “Your organization does not allow external forwarding”
550 5.7.708 Service unavailable. Access denied, traffic not accepted from this IPNDR (diagnostic information)NDR 550 5.7.708 in Exchange Online: Access denied, traffic not accepted from this IP
550 5.7.750 Service unavailable. Client blocked from sending from unregistered domainsNDRNDR 550 5.7.750 in Exchange Online: Client blocked from sending from unregistered domains
554 5.2.0 STOREDRV.Submission.Exception:SendAsDeniedException.MapiExceptionSendAsDeniedNDR (diagnostic information)Exchange Online mailbox permissions: fixing Full Access, Send As and Send on Behalf errors
554 5.2.2 mailbox full; STOREDRV.Deliver.Exception:QuotaExceededException.MapiExceptionQuotaExceededNDR (diagnostic information for admins)“Mailbox full” in Exchange Online: quotas, Recoverable Items and the 554 5.2.2 NDR
AS(7555)NDRNDR 550 5.7.520: fixing “Your organization does not allow external forwarding”
AzureRMSLicensingEnabled : FalseGet-IRMConfigurationMicrosoft Purview Message Encryption not working in Exchange Online: test, fix and verify
Cannot expand the folder. The set of folders cannot be opened. You do not have permission to log on.OutlookExchange Online mailbox permissions: fixing Full Access, Send As and Send on Behalf errors
CAT:BULK with SRV:BULKMessage header (X-Forefront-Antispam-Report)Legitimate email landing in Junk: how EOP decides and the right way to fix it
CAT:PHSH / CAT:HPHSH / CAT:SPOOFMessage header (X-Forefront-Antispam-Report)Legitimate email landing in Junk: how EOP decides and the right way to fix it
CAT:SPM / CAT:HSPMMessage header (X-Forefront-Antispam-Report)Legitimate email landing in Junk: how EOP decides and the right way to fix it
compauth=fail reason=001Message header (Authentication-Results)Legitimate email landing in Junk: how EOP decides and the right way to fix it
Creation of forwarding/redirect ruleMicrosoft Defender portal (alert)Investigating a compromised Exchange Online mailbox: rules, forwarding, sign-ins and audit
Delivery not authorized, message refusedNDRNDR 550 5.7.1 Delivery not authorized, message refused: fixing it in Exchange Online
Email sending limit exceededMicrosoft Defender portal (alert)Users blocked from sending in Exchange Online: Restricted entities and NDR 550 5.1.8
Failed to acquire RMS templatesTest-IRMConfigurationMicrosoft Purview Message Encryption not working in Exchange Online: test, fix and verify
OVERALL RESULT: FAILTest-IRMConfigurationMicrosoft Purview Message Encryption not working in Exchange Online: test, fix and verify
permerrorSPF result (Authentication-Results header)SPF, DKIM and DMARC for your Microsoft 365 custom domain: a practical setup guide
reason=000Message header (Authentication-Results)Legitimate email landing in Junk: how EOP decides and the right way to fix it
SFTY:9.19 or 9.20Message header (X-Forefront-Antispam-Report)Legitimate email landing in Junk: how EOP decides and the right way to fix it
SFV:BLK / SFV:SKBMessage header (X-Forefront-Antispam-Report)Legitimate email landing in Junk: how EOP decides and the right way to fix it
SFV:SPMMessage header (X-Forefront-Antispam-Report)Legitimate email landing in Junk: how EOP decides and the right way to fix it
Something went wrong and Outlook couldn't set up your accountOutlook (add account)Outlook can't connect or set up the account: Autodiscover troubleshooting for Exchange Online
Suspicious email forwarding activityMicrosoft Defender portal (alert)Investigating a compromised Exchange Online mailbox: rules, forwarding, sign-ins and audit
Suspicious email sending patterns detectedMicrosoft Defender portal (alert)Users blocked from sending in Exchange Online: Restricted entities and NDR 550 5.1.8
The action couldn't be completedOutlook on the web (when deleting items)“Mailbox full” in Exchange Online: quotas, Recoverable Items and the 554 5.2.2 NDR
The message can't be submitted because the sender's submission quota was exceededNDRUsers blocked from sending in Exchange Online: Restricted entities and NDR 550 5.1.8
The message store has reached its maximum sizeOutlook (when deleting items)“Mailbox full” in Exchange Online: quotas, Recoverable Items and the 554 5.2.2 NDR
The recipient's mailbox is full and can't accept messages now. Please try resending this message later or contact the recipient directly.NDR (user-facing text)“Mailbox full” in Exchange Online: quotas, Recoverable Items and the 554 5.2.2 NDR
This cmdlet is deprecated. The Trusted Publishing Domain (TPD) for your organization is managed in Microsoft Azure Rights Management.Exchange Online PowerShellMicrosoft Purview Message Encryption not working in Exchange Online: test, fix and verify
TRANSPORT.RULES.RejectMessage; the message was rejected by organization policyNDR (diagnostic information)NDR 550 5.7.1 Delivery not authorized, message refused: fixing it in Exchange Online
User restricted from sending emailMicrosoft Defender portal (alert)Investigating a compromised Exchange Online mailbox: rules, forwarding, sign-ins and audit
User restricted from sending emailMicrosoft Defender portal (alert)Users blocked from sending in Exchange Online: Restricted entities and NDR 550 5.1.8
You do not have the permission to send the message on behalf of the specified user.NDR (Outlook)Exchange Online mailbox permissions: fixing Full Access, Send As and Send on Behalf errors
Your message couldn't be delivered because you weren't recognized as a valid sender.NDR (user text)Users blocked from sending in Exchange Online: Restricted entities and NDR 550 5.1.8Defender
Defender for Endpoint, Defender for Office 365, Defender XDR and Defender for Identity
0x87D1FDE8Intune admin center (EDR policy status)Defender for Endpoint onboarding failures: SENSE event IDs, script errors and what they mean
0x87D1FDE8 (remediation failed)Intune EDR policy (onboarding setting)Onboarding Windows devices to Defender for Endpoint with Intune (and proving it worked)
0x87D101A9Intune EDR policy (device status)Onboarding Windows devices to Defender for Endpoint with Intune (and proving it worked)
0x87D101A9Intune admin center (EDR policy status)Defender for Endpoint onboarding failures: SENSE event IDs, script errors and what they mean
550 5.7.703 Your message can't be delivered because messages to XXX, YYY are blocked by your organization using Tenant Allow Block List.NDRTenant Allow/Block List in Defender for Office 365: senders, URLs, files and spoofing
"code":"AF20012","message":"Specified tenant ID (...) is incorrectly configured in the system."App connectors (Microsoft 365)Defender for Cloud Apps app connectors: connect Microsoft 365 and fix connector errors
AADSTS70008: The provided authorization code or refresh token is expired.App connectors (Microsoft 365)Defender for Cloud Apps app connectors: connect Microsoft 365 and fix connector errors
Antimalware Service ExecutableTask Manager (high CPU)Defender Antivirus high CPU (MsMpEng.exe): find the cause with the performance analyzer
App is not recognizedBrowser (proxied session)Defender for Cloud Apps Conditional Access app control: session policies and common errors
AsrOfficeChildProcessAuditedAdvanced hunting (DeviceEvents)Rolling out ASR rules safely: audit mode, exclusions and advanced hunting
Blocked by tenant adminURL protection report (click action)Safe Links and Safe Attachments: troubleshooting blocked links, missing rewrites and delays
Cannot start performance recording because Windows Performance Recorder is already recordingPowerShell (New-MpPerformanceRecording)Defender Antivirus high CPU (MsMpEng.exe): find the cause with the performance analyzer
CasbPolicyAdvanced hunting (ResponseCategory)Web content filtering in Defender for Endpoint: network protection, categories and indicators
compauth=failMessage header (Authentication-Results)Handling false-positive quarantined email in Defender for Office 365 the right way
Connection blockedWindows toast (network protection)Web content filtering in Defender for Endpoint: network protection, categories and indicators
Connection status: UnavailableIntune admin center (Defender for Endpoint)Defender for Endpoint on iOS and Android: Intune onboarding, VPN, MTD and sign-in errors
Continue SetupBrowser / app status (non-Microsoft IdP app)Defender for Cloud Apps Conditional Access app control: session policies and common errors
Couldn't find c:\program files\windows defender\mpasdesc.dll, - 310 WinDefendmd4ws.msi installationOnboarding Windows Server 2012 R2 and 2016 to Defender for Endpoint: the unified solution
CustomPolicyAdvanced hunting (ResponseCategory)Web content filtering in Defender for Endpoint: network protection, categories and indicators
Data currently isn't availableMicrosoft Defender portalDefender XDR unified RBAC: workload activation, custom roles and portal access errors
definitions_status: unavailableTerminal (mdatp health)Defender for Endpoint on Linux: installation, onboarding and mdatp health errors
Device is managed by SCCM AgentMDE Enrollment status (code 4)Security settings management enrollment errors: decoding SenseCM EnrollmentStatus codes
Device is not enrolled and has never been enrolledMDE Enrollment status (code 2)Security settings management enrollment errors: decoding SenseCM EnrollmentStatus codes
Directory services user credentials are incorrectDefender portal (Global health issues)Defender for Identity sensors: installation and health issues on domain controllers
Download restrictedBrowser (session policy block)Defender for Cloud Apps Conditional Access app control: session policies and common errors
engine_load_status: Engine not loadedTerminal (mdatp health)Defender for Endpoint on Linux: installation, onboarding and mdatp health errors
EUS:Win32/CustomCertEnterpriseBlock!clAdvanced hunting (AdditionalFields)Defender for Endpoint custom indicators: block or allow files, IPs, URLs and certificates
EUS:Win32/CustomEnterpriseBlock!clAdvanced hunting (AdditionalFields)Defender for Endpoint custom indicators: block or allow files, IPs, URLs and certificates
EUS:Win32/CustomEnterpriseNoAlertBlock!clAdvanced hunting (AdditionalFields)Defender for Endpoint custom indicators: block or allow files, IPs, URLs and certificates
Event ID 4 (SENSE)Event Viewer (Microsoft-Windows-SENSE)Moving Defender for Endpoint to streamlined connectivity: URLs, proxies and validation
Event ID 5 (SENSE)Event Viewer (Microsoft-Windows-SENSE)Onboarding Windows devices to Defender for Endpoint with Intune (and proving it worked)
Event ID 5 (SENSE)Event Viewer (Microsoft-Windows-SENSE)Device shows "Inactive" or "No sensor data" in Microsoft Defender: how to troubleshoot
Event ID 5 (SENSE)Event Viewer (Microsoft-Windows-SENSE)Defender for Endpoint onboarding failures: SENSE event IDs, script errors and what they mean
Event ID 5 (SENSE)Event Viewer (Microsoft-Windows-SENSE)Moving Defender for Endpoint to streamlined connectivity: URLs, proxies and validation
Event ID 6 (SENSE)Event Viewer (Microsoft-Windows-SENSE)Defender for Endpoint onboarding failures: SENSE event IDs, script errors and what they mean
Event ID 7 (SENSE)Event Viewer (Microsoft-Windows-SENSE)Defender for Endpoint onboarding failures: SENSE event IDs, script errors and what they mean
Event ID 15 (SENSE)Event Viewer (Microsoft-Windows-SENSE)Onboarding Windows devices to Defender for Endpoint with Intune (and proving it worked)
Event ID 15 (SENSE)Event Viewer (Microsoft-Windows-SENSE)Device shows "Inactive" or "No sensor data" in Microsoft Defender: how to troubleshoot
Event ID 15 (SENSE)Event Viewer (Microsoft-Windows-SENSE)Defender for Endpoint onboarding failures: SENSE event IDs, script errors and what they mean
Event ID 15 (WDATPOnboarding)Event Viewer (Application log)Defender for Endpoint onboarding failures: SENSE event IDs, script errors and what they mean
Event ID 30 (WDATPOnboarding)Event Viewer (Application log)Defender for Endpoint onboarding failures: SENSE event IDs, script errors and what they mean
Event ID 1000 (Windows Defender): An antimalware scan started.Event Viewer (Windows Defender/Operational)Defender Antivirus high CPU (MsMpEng.exe): find the cause with the performance analyzer
Event ID 1001 (Windows Defender): An antimalware scan finished.Event Viewer (Windows Defender/Operational)Defender Antivirus high CPU (MsMpEng.exe): find the cause with the performance analyzer
Event ID 1121 (Windows Defender)Event Viewer (Windows Defender/Operational)Rolling out ASR rules safely: audit mode, exclusions and advanced hunting
Event ID 1122 (Windows Defender)Event Viewer (Windows Defender/Operational)Rolling out ASR rules safely: audit mode, exclusions and advanced hunting
Event ID 1125 (Windows Defender)Event Viewer (Windows Defender/Operational)Web content filtering in Defender for Endpoint: network protection, categories and indicators
Event ID 1126 (Windows Defender)Event Viewer (Windows Defender/Operational)Web content filtering in Defender for Endpoint: network protection, categories and indicators
Event ID 1129 (Windows Defender)Event Viewer (Windows Defender/Operational)Rolling out ASR rules safely: audit mode, exclusions and advanced hunting
Event ID 5007 (Windows Defender)Event Viewer (Windows Defender/Operational)Rolling out ASR rules safely: audit mode, exclusions and advanced hunting
Event ID 5007 (Windows Defender)Event Viewer (Windows Defender/Operational)Defender Antivirus settings not applying from Intune: a troubleshooting checklist
Event ID 5013 (Windows Defender)Event Viewer (Windows Defender/Operational)Defender Antivirus settings not applying from Intune: a troubleshooting checklist
Event ID 5013 (Windows Defender)Event Viewer (Windows Defender/Operational)Tamper protection and Intune: why a Defender setting won't change, and how to fix it
ExploitGuardNetworkProtectionBlockedAdvanced hunting (DeviceEvents ActionType)Web content filtering in Defender for Endpoint: network protection, categories and indicators
ExploitGuardNetworkProtectionBlockedAdvanced hunting (DeviceEvents)Shadow IT with Defender for Cloud Apps and Defender for Endpoint: discover, warn, block
FAILED 1060: The specified service does not exist as an installed service.Command Prompt (sc.exe query windefend)Onboarding Windows Server 2012 R2 and 2016 to Defender for Endpoint: the unified solution
Failed to start mdatp.service: Unit mdatp.service not found.Terminal (systemctl)Defender for Endpoint on Linux: installation, onboarding and mdatp health errors
General Hybrid join failureMDE Enrollment status (codes 10, 42)Security settings management enrollment errors: decoding SenseCM EnrollmentStatus codes
Get Permissions: NoHttpResponseException: *******.salesforce.com:443 failed to respondApp connectors (Salesforce)Defender for Cloud Apps app connectors: connect Microsoft 365 and fix connector errors
GoogleJsonResponseException: 401 UnauthorizedApp connectors (Google Workspace)Defender for Cloud Apps app connectors: connect Microsoft 365 and fix connector errors
GoogleJsonResponseException: 403 ForbiddenApp connectors (Google Workspace)Defender for Cloud Apps app connectors: connect Microsoft 365 and fix connector errors
healthy: falseTerminal (mdatp health)Defender for Endpoint on Linux: installation, onboarding and mdatp health errors
HttpRequestFailure: Server returned: 500 Internal server errorApp connectors (all apps)Defender for Cloud Apps app connectors: connect Microsoft 365 and fix connector errors
Hybrid error - Service Connection PointMDE Enrollment status (codes 16, 17)Security settings management enrollment errors: decoding SenseCM EnrollmentStatus codes
Impaired CommunicationsMicrosoft Defender portal (sensor health)Defender for Endpoint client analyzer: run it, read the results and fix connectivity
licensed: falseTerminal (mdatp health)Defender for Endpoint on Linux: installation, onboarding and mdatp health errors
mdatp: command not foundTerminalDefender for Endpoint on Linux: installation, onboarding and mdatp health errors
Microsoft Defender Antivirus scanning for spyware and other potentially unwanted software is disabled.Windows Defender/Operational log (event 5010)From Symantec Endpoint Protection to Defender for Endpoint: prepare, set up, onboard
Microsoft Entra Connect misconfigurationMDE Enrollment status (codes 36, 37)Security settings management enrollment errors: decoding SenseCM EnrollmentStatus codes
Microsoft Intune Configuration issueMDE Enrollment status (codes 8, 44)Security settings management enrollment errors: decoding SenseCM EnrollmentStatus codes
Microsoft.Office.Compliance.Audit.DataServiceException: Tenant ... does not existApp connectors (Microsoft 365)Defender for Cloud Apps app connectors: connect Microsoft 365 and fix connector errors
Misconfigured: Impaired communicationsMicrosoft Defender portal (Sensor health state)Device shows "Inactive" or "No sensor data" in Microsoft Defender: how to troubleshoot
Misconfigured: No sensor dataMicrosoft Defender portal (Sensor health state)Device shows "Inactive" or "No sensor data" in Microsoft Defender: how to troubleshoot
No apps connectedDefender portal (CA App Control apps page)Defender for Cloud Apps Conditional Access app control: session policies and common errors
No license foundMicrosoft Defender app on macOSOnboarding macOS to Defender for Endpoint with Intune: profiles, app and onboarding package
No Sensor DataMicrosoft Defender portal (sensor health)Defender for Endpoint client analyzer: run it, read the results and fix connectivity
No subscriptions foundMicrosoft Defender portalDefender XDR unified RBAC: workload activation, custom roles and portal access errors
NTLM Auditing is not enabledDefender portal (Identities › Health issues)Defender for Identity sensors: installation and health issues on domain controllers
org_id: unavailableTerminal (mdatp health)Defender for Endpoint on Linux: installation, onboarding and mdatp health errors
Power mode isn't configured for optimal processor performanceDefender portal (Identities › Health issues)Defender for Identity sensors: installation and health issues on domain controllers
real_time_protection_subsystem: unavailableTerminal (mdatp health)Defender for Endpoint on Linux: installation, onboarding and mdatp health errors
RemovableStoragePolicyTriggeredAdvanced hunting (DeviceEvents)Controlling USB and removable storage with Defender device control and Intune
Request session controlDefender portal (CA App Control apps page)Defender for Cloud Apps Conditional Access app control: session policies and common errors
Sensor has issues with packet capturing componentDefender portal (Identities › Health issues)Defender for Identity sensors: installation and health issues on domain controllers
Sensor reached a memory resource limitDefender portal (Identities › Health issues)Defender for Identity sensors: installation and health issues on domain controllers
Sensor service failed to startDefender portal (Identities › Health issues)Defender for Identity sensors: installation and health issues on domain controllers
Sensor stopped communicatingDefender portal (Identities › Health issues)Defender for Identity sensors: installation and health issues on domain controllers
Sensor v3.x RPC Audit MisconfiguredDefender portal (Identities › Health issues)Defender for Identity sensors: installation and health issues on domain controllers
Sign in failed: Invalid license, contact administratorMicrosoft Defender app (Android)Defender for Endpoint on iOS and Android: Intune onboarding, VPN, MTD and sign-in errors
Sign in failed: Unexpected error, try laterMicrosoft Defender app (Android)Defender for Endpoint on iOS and Android: Intune onboarding, VPN, MTD and sign-in errors
SmartScreenUrlWarningAdvanced hunting (DeviceEvents)Shadow IT with Defender for Cloud Apps and Defender for Endpoint: discover, warn, block
Specify an email address in your domain.User reported settings (no EXO PowerShell)Defender for Office 365 user-reported messages: Report button, reporting mailbox, triage
TamperingAttemptAdvanced hunting (DeviceEvents)Tamper protection and Intune: why a Defender setting won't change, and how to fix it
Tenant mismatchMDE Enrollment status (code 15)Security settings management enrollment errors: decoding SenseCM EnrollmentStatus codes
The Microsoft Defender Antivirus Service service on Local Computer started and then stopped.Services app (services.msc)From Symantec Endpoint Protection to Defender for Endpoint: prepare, set up, onboard
This content is blockedWindows toast (network protection)Web content filtering in Defender for Endpoint: network protection, categories and indicators
This site isn't secureBrowser (proxied session)Defender for Cloud Apps Conditional Access app control: session policies and common errors
this website has been classified as maliciousSafe Links warning pageSafe Links and Safe Attachments: troubleshooting blocked links, missing rewrites and delays
This website is blocked by your organizationBrowser (user session)Defender for Cloud Apps Conditional Access app control: session policies and common errors
TokenResponseException: 400 Bad RequestApp connectors (Google Workspace)Defender for Cloud Apps app connectors: connect Microsoft 365 and fix connector errors
Updated Windows Defender status successfully to SECURITY_PRODUCT_STATE_OFF.Application log (Security Center, event 15)From Symantec Endpoint Protection to Defender for Endpoint: prepare, set up, onboard
You are not authorized to access the portalMicrosoft Defender portalDefender XDR unified RBAC: workload activation, custom roles and portal access errors
You don't have any apps deployed with conditional access app controlMicrosoft Defender portal (create policy)Defender for Cloud Apps Conditional Access app control: session policies and common errorsMicrosoft 365
Licensing, Microsoft 365 Apps, SharePoint, OneDrive, Teams and tenant administration
0x8004de42OneDrive sign-inOneDrive sync stuck on "Processing changes": causes and fixes for work and school accounts
AllowCloudRecording : FalseGet-CsTeamsMeetingPolicyTeams meeting recording or transcription not available: policy, storage and license checks
AllowCloudRecordingForCalls : FalseGet-CsTeamsCallingPolicyTeams meeting recording or transcription not available: policy, storage and license checks
AllowTranscription : FalseGet-CsTeamsMeetingPolicyTeams meeting recording or transcription not available: policy, storage and license checks
ChannelRecordingDownload : BlockGet-CsTeamsMeetingPolicyTeams meeting recording or transcription not available: policy, storage and license checks
Conflicting service plansMicrosoft 365 admin center (Errors & issues)Group-based licensing errors in Microsoft 365: conflicts, usage location and fixes
CountViolationMicrosoft Graph (licenseAssignmentStates)Group-based licensing errors in Microsoft 365: conflicts, usage location and fixes
DependencyViolationMicrosoft Graph (licenseAssignmentStates)Group-based licensing errors in Microsoft 365: conflicts, usage location and fixes
Due to organizational policies, you can't access this resource from this network locationSharePoint or OneDrive in the browserSharePoint and OneDrive "Access Denied" and sharing link errors: causes and fixes
Due to organizational policies, you can't access this resource from this untrusted deviceSharePoint or OneDrive in the browserSharePoint and OneDrive "Access Denied" and sharing link errors: causes and fixes
LicenseAssignmentAttributeConcurrencyExceptionMicrosoft Entra audit logGroup-based licensing errors in Microsoft 365: conflicts, usage location and fixes
MutuallyExclusiveViolationMicrosoft Graph (licenseAssignmentStates)Group-based licensing errors in Microsoft 365: conflicts, usage location and fixes
Non-commercial use / Unlicensed ProductOffice app title barMicrosoft 365 Apps activation errors: Unlicensed Product, accounts and shared computers
Not enough licencesMicrosoft 365 admin center (Errors & issues)Group-based licensing errors in Microsoft 365: conflicts, usage location and fixes
Processing 0KB of x MBOneDrive sync appOneDrive sync stuck on "Processing changes": causes and fixes for work and school accounts
Processing changesOneDrive sync appOneDrive sync stuck on "Processing changes": causes and fixes for work and school accounts
ProhibitedInUsageLocationViolationMicrosoft Graph (licenseAssignmentStates)Group-based licensing errors in Microsoft 365: conflicts, usage location and fixes
RecordingForWebinar : DisabledGet-CsTeamsEventsPolicyTeams meeting recording or transcription not available: policy, storage and license checks
spf=permerrorMessage header (Authentication-Results)Adding a domain to Microsoft 365: verification, DNS records and "already added" errors
Sync pendingOneDrive sync appOneDrive sync stuck on "Processing changes": causes and fixes for work and school accounts
The meeting recording button is missing.Teams meeting controlsTeams meeting recording or transcription not available: policy, storage and license checks
The recording is complete, but the recording is missing in meeting recap.Teams meeting recap / chatTeams meeting recording or transcription not available: policy, storage and license checks
There's a problem with your accountOffice activation dialogMicrosoft 365 Apps activation errors: Unlicensed Product, accounts and shared computers
This link is not available to youSharing link in the browserSharePoint and OneDrive "Access Denied" and sharing link errors: causes and fixes
UniquenessViolationMicrosoft Graph (licenseAssignmentStates)Group-based licensing errors in Microsoft 365: conflicts, usage location and fixes
Unlicensed ProductOffice app title barMicrosoft 365 Apps activation errors: Unlicensed Product, accounts and shared computers
User not found in the directorySharePoint or OneDrive in the browserSharePoint and OneDrive "Access Denied" and sharing link errors: causes and fixes
We are unable to connect right nowOffice activation dialogMicrosoft 365 Apps activation errors: Unlicensed Product, accounts and shared computers
we can't add it to your account because the domain is already added to a different Microsoft 365 organizationMicrosoft 365 admin center (Add domain)Adding a domain to Microsoft 365: verification, DNS records and "already added" errors
We couldn't find any Office productsOffice sign-in (activation)Microsoft 365 Apps activation errors: Unlicensed Product, accounts and shared computers
We're sorry, but <user> can't be found in the <tenant>.sharepoint.com directorySharePoint or OneDrive in the browserSharePoint and OneDrive "Access Denied" and sharing link errors: causes and fixes
You can't share this item because too many items in the folderShare dialogSharePoint and OneDrive "Access Denied" and sharing link errors: causes and fixes
You need permission to access this siteSharePoint or OneDrive in the browserSharePoint and OneDrive "Access Denied" and sharing link errors: causes and fixes
Your organization has disabled this deviceOffice activation dialogMicrosoft 365 Apps activation errors: Unlicensed Product, accounts and shared computers
Your organization policies do not allow you to share with these usersShare dialogSharePoint and OneDrive "Access Denied" and sharing link errors: causes and fixes
Your proxy settings require authenticationOneDrive sign-inOneDrive sync stuck on "Processing changes": causes and fixes for work and school accountsAADSTS codes 120000+
Every code in the quick reference “AADSTS error codes 120000 and above: password change, NGC, devices and more (part 5 of 5)”: what it means, the usual cause and the first check. Open the quick reference
AADSTS100007: Microsoft Entra Regional only supports managed identities or MSAL SN+I requestsToken response (regional endpoint)AADSTS error codes 120000 and above: password change, NGC, devices and more (part 5 of 5)
AADSTS120000 PasswordChangeIncorrectCurrentPassword: the current password was entered incorrectlyPassword change or reset pageAADSTS error codes 120000 and above: password change, NGC, devices and more (part 5 of 5)
AADSTS120002 PasswordChangeInvalidNewPasswordWeak: the new password is too weakPassword change or reset pageAADSTS error codes 120000 and above: password change, NGC, devices and more (part 5 of 5)
AADSTS120003 PasswordChangeInvalidNewPasswordContainsMemberName: new password contains the user's namePassword change or reset pageAADSTS error codes 120000 and above: password change, NGC, devices and more (part 5 of 5)
AADSTS120004 PasswordChangeOnPremComplexity: new password fails on-premises AD complexity rulesPassword change or reset pageAADSTS error codes 120000 and above: password change, NGC, devices and more (part 5 of 5)
AADSTS120005 PasswordChangeOnPremSuccessCloudFail: changed on-premises but the cloud step failedPassword change or reset pageSelf-service password reset and password writeback: fixing the usual failures
AADSTS120008 PasswordChangeAsyncJobStateTerminated: a non-retryable error occurredPassword change or reset pageAADSTS error codes 120000 and above: password change, NGC, devices and more (part 5 of 5)
AADSTS120011 PasswordChangeAsyncUpnInferenceFailed: the user's UPN couldn't be inferredPassword change or reset pageAADSTS error codes 120000 and above: password change, NGC, devices and more (part 5 of 5)
AADSTS120012 PasswordChangeNeedsToHappenOnPrem: the password must be changed on-premisesPassword change or reset pageSelf-service password reset and password writeback: fixing the usual failures
AADSTS120013 PasswordChangeOnPremisesConnectivityFailure: on-premises couldn't be reached for the changePassword change or reset pageSelf-service password reset and password writeback: fixing the usual failures
AADSTS120014 PasswordChangeOnPremUserAccountLockedOutOrDisabled: AD account locked out or disabledPassword change or reset pageAADSTS error codes 120000 and above: password change, NGC, devices and more (part 5 of 5)
AADSTS120015 PasswordChangeADAdminActionRequired: an Active Directory administrator must actPassword change or reset pageAADSTS error codes 120000 and above: password change, NGC, devices and more (part 5 of 5)
AADSTS120016 PasswordChangeUserNotFoundBySspr: SSPR couldn't find the userPassword change or reset pageAADSTS error codes 120000 and above: password change, NGC, devices and more (part 5 of 5)
AADSTS120018 PasswordChangePasswordDoesnotComplyFuzzyPolicy: password fails the fuzzy-matching policyPassword change or reset pageAADSTS error codes 120000 and above: password change, NGC, devices and more (part 5 of 5)
AADSTS120020 PasswordChangeFailure: the password change failedPassword change or reset pageAADSTS error codes 120000 and above: password change, NGC, devices and more (part 5 of 5)
AADSTS120021 PartnerServiceSsprInternalServiceError: internal error in the SSPR partner servicePassword change or reset pageAADSTS error codes 120000 and above: password change, NGC, devices and more (part 5 of 5)
AADSTS130004 NgcKeyNotFound: the user has no Windows Hello (NGC) ID key configuredMicrosoft Entra sign-in logAADSTS error codes 120000 and above: password change, NGC, devices and more (part 5 of 5)
AADSTS130005 NgcInvalidSignature: NGC key signature verification failedMicrosoft Entra sign-in logAADSTS error codes 120000 and above: password change, NGC, devices and more (part 5 of 5)
AADSTS130006 NgcTransportKeyNotFound: the NGC transport key isn't configured on the deviceMicrosoft Entra sign-in logAADSTS error codes 120000 and above: password change, NGC, devices and more (part 5 of 5)
AADSTS130007 NgcDeviceIsDisabled: the device is disabledMicrosoft Entra sign-in logAADSTS error codes 120000 and above: password change, NGC, devices and more (part 5 of 5)
AADSTS130008 NgcDeviceIsNotFound: the device referenced by the NGC key wasn't foundMicrosoft Entra sign-in logDual state, Pending and duplicate device objects in Microsoft Entra ID: a clean-up guide
AADSTS135010 KeyNotFound: key not foundMicrosoft Entra sign-in logAADSTS error codes 120000 and above: password change, NGC, devices and more (part 5 of 5)
AADSTS135011: the device used during authentication is disabledMicrosoft Entra sign-in logAADSTS error codes 120000 and above: password change, NGC, devices and more (part 5 of 5)
AADSTS140000 InvalidRequestNonce: the request nonce isn't providedMicrosoft Entra sign-in logAADSTS error codes 120000 and above: password change, NGC, devices and more (part 5 of 5)
AADSTS140001 InvalidSessionKey: the session key isn't validMicrosoft Entra sign-in logPrimary Refresh Token (PRT) explained: fixing SSO and repeated sign-in prompts
AADSTS165004: runtime-specific error, see the returned exception messageApp error / token responseAADSTS error codes 120000 and above: password change, NGC, devices and more (part 5 of 5)
AADSTS165900 InvalidApiRequest: invalid requestApp error / token responseAADSTS error codes 120000 and above: password change, NGC, devices and more (part 5 of 5)
AADSTS220450 UnsupportedAndroidWebViewVersion: the Chrome WebView version isn't supportedSign-in page (Android)AADSTS error codes 120000 and above: password change, NGC, devices and more (part 5 of 5)
AADSTS221000 DeviceOnlyTokensNotSupportedByResource: the resource doesn't accept device-only tokensApp error / token responseAADSTS error codes 120000 and above: password change, NGC, devices and more (part 5 of 5)
AADSTS240001 BulkAADJTokenUnauthorized: the user isn't authorized to register devicesDevice registration (bulk enrollment)AADSTS error codes 120000 and above: password change, NGC, devices and more (part 5 of 5)
AADSTS240002 RequiredClaimIsMissing: an id_token can't be used as a jwt-bearer grantToken response (on-behalf-of flow)AADSTS error codes 120000 and above: password change, NGC, devices and more (part 5 of 5)
AADSTS240003: unexpected result from the authorize endpoint callApp error / token responseAADSTS error codes 120000 and above: password change, NGC, devices and more (part 5 of 5)
AADSTS240004: no authorization code received from the authorize endpointApp error / token responseAADSTS error codes 120000 and above: password change, NGC, devices and more (part 5 of 5)
AADSTS501621 ClaimsTransformationTimeoutRegularExpressionTimeout: claims transformation regex timed outSign-in page / Microsoft Entra sign-in logAADSTS error codes 120000 and above: password change, NGC, devices and more (part 5 of 5)
AADSTS530032 BlockedByConditionalAccessOnSecurityPolicy: blocked by a tenant security policySign-in page / Microsoft Entra sign-in logAADSTS error codes 120000 and above: password change, NGC, devices and more (part 5 of 5)
AADSTS650059: the app isn't configured for use in this tenant (signInAudience AzureADMyOrg)Sign-in page / app errorAADSTS error codes 120000 and above: password change, NGC, devices and more (part 5 of 5)
AADSTS700005 InvalidGrantRedeemAgainstWrongTenant: authorization code redeemed against another tenantToken responseAADSTS error codes 120000 and above: password change, NGC, devices and more (part 5 of 5)
AADSTS700020 InteractionRequired: the access grant requires interactionApp error / token responseAADSTS error codes 120000 and above: password change, NGC, devices and more (part 5 of 5)
AADSTS700022 InvalidMultipleResourcesScope: the scope contains more than one resourceApp error / token responseAADSTS error codes 120000 and above: password change, NGC, devices and more (part 5 of 5)
AADSTS700023 InvalidResourcelessScope: the scope isn't valid for an access token requestApp error / token responseAADSTS error codes 120000 and above: password change, NGC, devices and more (part 5 of 5)
AADSTS700229 ForbiddenTokenType: only app-only tokens can be federated identity credentialsToken response (federated credential)AADSTS error codes 120000 and above: password change, NGC, devices and more (part 5 of 5)
AADSTS901011 NoEmailAddressCollectedFromExternalOidcIDP: no email from the external OIDC providerSign-in or sign-up pageAADSTS error codes 120000 and above: password change, NGC, devices and more (part 5 of 5)
AADSTS901012 EmailAddressCollectedFromExternalOidcIDPNotVerified: provider's email isn't verifiedSign-in or sign-up pageAADSTS error codes 120000 and above: password change, NGC, devices and more (part 5 of 5)
AADSTS901014 NoExternalIdentifierCollectedFromExternalOidcIDP: external identifier missing from the ID tokenSign-in or sign-up pageAADSTS error codes 120000 and above: password change, NGC, devices and more (part 5 of 5)
AADSTS1000000 UserNotBoundError: the user must also authenticate with the external IdP (Bind API)Sign-in pageAADSTS error codes 120000 and above: password change, NGC, devices and more (part 5 of 5)
AADSTS1000002 BindCompleteInterruptError: the bind completed, but the user must be informedSign-in pageAADSTS error codes 120000 and above: password change, NGC, devices and more (part 5 of 5)
AADSTS1000031: the application can't be accessed at this timeSign-in pageAADSTS error codes 120000 and above: password change, NGC, devices and more (part 5 of 5)
AADSTS7000112 UnauthorizedClientApplicationDisabled: the application is disabledSign-in page / Microsoft Entra sign-in logAADSTS error codes 120000 and above: password change, NGC, devices and more (part 5 of 5)
AADSTS7000114: the app isn't allowed to make application on-behalf-of callsToken response (on-behalf-of flow)AADSTS error codes 120000 and above: password change, NGC, devices and more (part 5 of 5)
AADSTS7000218: the request body must contain client_assertion or client_secretToken response / Microsoft Entra sign-in logAADSTS error codes 120000 and above: password change, NGC, devices and more (part 5 of 5)
AADSTS7500529: the value isn't a valid SAML ID (it can't start with a number)Sign-in page (SAML app)AADSTS error codes 120000 and above: password change, NGC, devices and more (part 5 of 5)
AADSTS9002341: V2Error invalid_grant, the user is required to permit SSOMicrosoft Entra sign-in logAADSTS error codes 120000 and above: password change, NGC, devices and more (part 5 of 5)AADSTS codes 16000–50079
Every code in the quick reference “Microsoft Entra AADSTS error codes 16000–50079: the complete list with fixes (part 1 of 5)”: what it means, the usual cause and the first check. Open the quick reference
AADSTS16000 InteractionRequired: account from another identity provider doesn't exist in the tenantSign-in page / Microsoft Entra sign-in logMicrosoft Entra AADSTS error codes 16000–50079: the complete list with fixes (part 1 of 5)
AADSTS16001 UserAccountSelectionInvalid: the account tile the user picked was rejectedSign-in page (account picker)Microsoft Entra AADSTS error codes 16000–50079: the complete list with fixes (part 1 of 5)
AADSTS16002 AppSessionSelectionInvalid: the app's session (SID) requirement wasn't metSign-in page / app errorMicrosoft Entra AADSTS error codes 16000–50079: the complete list with fixes (part 1 of 5)
AADSTS17003 CredentialKeyProvisioningFailed: Entra ID can't provision the user keyMicrosoft Entra sign-in logMicrosoft Entra AADSTS error codes 16000–50079: the complete list with fixes (part 1 of 5)
AADSTS20001 WsFedSignInResponseError: problem with the federated identity providerSign-in page / Microsoft Entra sign-in logMicrosoft Entra AADSTS error codes 16000–50079: the complete list with fixes (part 1 of 5)
AADSTS20012 WsFedMessageInvalid: invalid WS-Federation message from the federated identity providerSign-in page / Microsoft Entra sign-in logMicrosoft Entra AADSTS error codes 16000–50079: the complete list with fixes (part 1 of 5)
AADSTS20033 FedMetadataInvalidTenantName: problem with the federated identity providerSign-in page / Microsoft Entra sign-in logMicrosoft Entra AADSTS error codes 16000–50079: the complete list with fixes (part 1 of 5)
AADSTS28002: invalid scope value in the access token requestApp token response / sign-in logMicrosoft Entra AADSTS error codes 16000–50079: the complete list with fixes (part 1 of 5)
AADSTS28003: scope can't be empty when redeeming an authorization codeApp token response / sign-in logMicrosoft Entra AADSTS error codes 16000–50079: the complete list with fixes (part 1 of 5)
AADSTS40008 OAuth2IdPUnretryableServerError: federated identity provider error (not retryable)Sign-in page / Microsoft Entra sign-in logMicrosoft Entra AADSTS error codes 16000–50079: the complete list with fixes (part 1 of 5)
AADSTS40009 OAuth2IdPRefreshTokenRedemptionUserError: federated identity provider errorSign-in page / Microsoft Entra sign-in logMicrosoft Entra AADSTS error codes 16000–50079: the complete list with fixes (part 1 of 5)
AADSTS40010 OAuth2IdPRetryableServerError: federated identity provider error (retryable)Sign-in page / Microsoft Entra sign-in logMicrosoft Entra AADSTS error codes 16000–50079: the complete list with fixes (part 1 of 5)
AADSTS40015 OAuth2IdPAuthCodeRedemptionUserError: federated identity provider errorSign-in page / Microsoft Entra sign-in logMicrosoft Entra AADSTS error codes 16000–50079: the complete list with fixes (part 1 of 5)
AADSTS50000 TokenIssuanceError: problem with the sign-in serviceSign-in page / Microsoft Entra sign-in logMicrosoft Entra AADSTS error codes 16000–50079: the complete list with fixes (part 1 of 5)
AADSTS50001 InvalidResource: the resource is disabled or doesn't existApp token response / sign-in logMicrosoft Entra AADSTS error codes 16000–50079: the complete list with fixes (part 1 of 5)
AADSTS50002 NotAllowedTenant: sign-in blocked by restricted proxy access on the tenantSign-in pageMicrosoft Entra AADSTS error codes 16000–50079: the complete list with fixes (part 1 of 5)
AADSTS50003 MissingSigningKey: no signing key or certificate configured for the appSign-in page (SAML app)Microsoft Entra AADSTS error codes 16000–50079: the complete list with fixes (part 1 of 5)
AADSTS50005 DevicePolicyError: device platform not supported by Conditional AccessSign-in page / Microsoft Entra sign-in logMicrosoft Entra AADSTS error codes 16000–50079: the complete list with fixes (part 1 of 5)
AADSTS50006 InvalidSignature: signature verification failedSign-in page / app errorMicrosoft Entra AADSTS error codes 16000–50079: the complete list with fixes (part 1 of 5)
AADSTS50007 PartnerEncryptionCertificateMissing: partner encryption certificate not found for the appSign-in page / Microsoft Entra sign-in logMicrosoft Entra AADSTS error codes 16000–50079: the complete list with fixes (part 1 of 5)
AADSTS50010 AudienceUriValidationFailed: no token audiences configured for the appSign-in page (SAML app)Microsoft Entra AADSTS error codes 16000–50079: the complete list with fixes (part 1 of 5)
AADSTS50012 AuthenticationFailed: certificate or client assertion validation failedApp token response / sign-in logMicrosoft Entra AADSTS error codes 16000–50079: the complete list with fixes (part 1 of 5)
AADSTS50013 InvalidAssertion: assertion invalid, expired or malformedApp token response / sign-in logMicrosoft Entra AADSTS error codes 16000–50079: the complete list with fixes (part 1 of 5)
AADSTS50014 GuestUserInPendingState: user account doesn't exist in the directorySign-in page / Microsoft Entra sign-in logGuest sign-in errors in Microsoft Entra ID: AADSTS90072, AADSTS50020 and cross-tenant blocks
AADSTS50015 ViralUserLegalAgeConsentRequiredState: legal age group consent requiredSign-in pageMicrosoft Entra AADSTS error codes 16000–50079: the complete list with fixes (part 1 of 5)
AADSTS50027 InvalidJwtToken: JWT failed validationApp error / Microsoft Entra sign-in logMicrosoft Entra AADSTS error codes 16000–50079: the complete list with fixes (part 1 of 5)
AADSTS50029: invalid URI, the domain name contains invalid charactersSign-in page / app errorMicrosoft Entra AADSTS error codes 16000–50079: the complete list with fixes (part 1 of 5)
AADSTS50032 WeakRsaKey: attempt to use a weak RSA keyApp token response / sign-in logMicrosoft Entra AADSTS error codes 16000–50079: the complete list with fixes (part 1 of 5)
AADSTS50033 RetryableError: transient error not related to database operationsSign-in page / Microsoft Entra sign-in logMicrosoft Entra AADSTS error codes 16000–50079: the complete list with fixes (part 1 of 5)
AADSTS50042 UnableToGeneratePairwiseIdentifierWithMissingSalt: salt for a pairwise identifier is missingSign-in page / app errorMicrosoft Entra AADSTS error codes 16000–50079: the complete list with fixes (part 1 of 5)
AADSTS50043 UnableToGeneratePairwiseIdentifierWithMultipleSalts: pairwise identifier can't be generatedSign-in page / app errorMicrosoft Entra AADSTS error codes 16000–50079: the complete list with fixes (part 1 of 5)
AADSTS50048 SubjectMismatchesIssuer: client assertion subject doesn't match its issuerApp token response / sign-in logMicrosoft Entra AADSTS error codes 16000–50079: the complete list with fixes (part 1 of 5)
AADSTS50049 NoSuchInstanceForDiscovery: unknown or invalid instanceApp or library errorMicrosoft Entra AADSTS error codes 16000–50079: the complete list with fixes (part 1 of 5)
AADSTS50050 MalformedDiscoveryRequest: the discovery request is malformedApp or library errorMicrosoft Entra AADSTS error codes 16000–50079: the complete list with fixes (part 1 of 5)
AADSTS50056: invalid or null password, no password exists in the directory for this userSign-in page / Microsoft Entra sign-in logMicrosoft Entra AADSTS error codes 16000–50079: the complete list with fixes (part 1 of 5)
AADSTS50058 UserInformationNotProvided: session information not sufficient for single sign-onMicrosoft Entra sign-in logMicrosoft Entra AADSTS error codes 16000–50079: the complete list with fixes (part 1 of 5)
AADSTS50059 MissingTenantRealmAndNoUserInformationProvided: no tenant information in the requestSign-in page / app errorMicrosoft Entra AADSTS error codes 16000–50079: the complete list with fixes (part 1 of 5)
AADSTS50061 SignoutInvalidRequest: unable to complete sign-out, the request was invalidSign-out page / app errorMicrosoft Entra AADSTS error codes 16000–50079: the complete list with fixes (part 1 of 5)
AADSTS50064 CredentialAuthenticationError: username or password validation failedSign-in page / Microsoft Entra sign-in logMicrosoft Entra AADSTS error codes 16000–50079: the complete list with fixes (part 1 of 5)
AADSTS50068 SignoutInitiatorNotParticipant: the app that started sign-out isn't in the sessionSign-out page / app errorMicrosoft Entra AADSTS error codes 16000–50079: the complete list with fixes (part 1 of 5)
AADSTS50070 SignoutUnknownSessionIdentifier: sign-out name identifier doesn't match a sessionSign-out page / app errorMicrosoft Entra AADSTS error codes 16000–50079: the complete list with fixes (part 1 of 5)
AADSTS50071 SignoutMessageExpired: the logout request has expiredSign-out page / app errorMicrosoft Entra AADSTS error codes 16000–50079: the complete list with fixes (part 1 of 5)
AADSTS160021 AppSessionSelectionInvalidSessionNotExist: the requested user session doesn't existSign-in page / app errorMicrosoft Entra AADSTS error codes 16000–50079: the complete list with fixes (part 1 of 5)
AADSTS230109 CachedCredentialNonGWAuthNRequestsNotSupported: request bypassed the Microsoft Entra gatewayApp error / Microsoft Entra sign-in logMicrosoft Entra AADSTS error codes 16000–50079: the complete list with fixes (part 1 of 5)
AADSTS399284 InboundIdTokenIssuerInvalid: federated ID token issuer is empty or doesn't matchSign-in page / Microsoft Entra sign-in logMicrosoft Entra AADSTS error codes 16000–50079: the complete list with fixes (part 1 of 5)
AADSTS500022: access to the tenant is denied by tenant restrictionsSign-in pageGuest sign-in errors in Microsoft Entra ID: AADSTS90072, AADSTS50020 and cross-tenant blocks
AADSTS500133: assertion isn't within its valid time rangeApp token response / sign-in logMicrosoft Entra AADSTS error codes 16000–50079: the complete list with fixes (part 1 of 5)
AADSTS500141: redemption complete, but the request wasn't started by the target appSign-in page (guest redemption)Guest sign-in errors in Microsoft Entra ID: AADSTS90072, AADSTS50020 and cross-tenant blocks
AADSTS500207: account type can't be used for this resourceSign-in pageMicrosoft Entra AADSTS error codes 16000–50079: the complete list with fixes (part 1 of 5)
AADSTS500208: domain isn't a valid sign-in domain for the account typeSign-in pageMicrosoft Entra AADSTS error codes 16000–50079: the complete list with fixes (part 1 of 5)
AADSTS5000224 NotAllowedTenantBlockedTenantFraud: this resource isn't availableSign-in pageMicrosoft Entra AADSTS error codes 16000–50079: the complete list with fixes (part 1 of 5)
AADSTS5000819 InvalidSamlTokenEmailMissingOrInvalid: email claim missing or wrong domain in the SAML assertionSign-in page / Microsoft Entra sign-in logMicrosoft Entra AADSTS error codes 16000–50079: the complete list with fixes (part 1 of 5)
AADSTS5001256: invalid id_token from the external identity providerSign-in page / Microsoft Entra sign-in logMicrosoft Entra AADSTS error codes 16000–50079: the complete list with fixes (part 1 of 5)AADSTS codes 50085–54005
Every code in the quick reference “Microsoft Entra AADSTS error codes 50085–54005: the complete list with fixes (part 2 of 5)”: what it means, the usual cause and the first check. Open the quick reference
AADSTS50085: refresh token needs a social identity provider sign-inSign-in page / Microsoft Entra sign-in logMicrosoft Entra AADSTS error codes 50085–54005: the complete list with fixes (part 2 of 5)
AADSTS50086 SasNonRetryableError: non-retryable strong authentication errorMicrosoft Entra sign-in logMicrosoft Entra AADSTS error codes 50085–54005: the complete list with fixes (part 2 of 5)
AADSTS50087 SasRetryableError: transient error during strong authenticationMicrosoft Entra sign-in logMicrosoft Entra AADSTS error codes 50085–54005: the complete list with fixes (part 2 of 5)
AADSTS50089: authentication failed because the flow token expiredSign-in page / Microsoft Entra sign-in logMicrosoft Entra AADSTS error codes 50085–54005: the complete list with fixes (part 2 of 5)
AADSTS50097 DeviceAuthenticationRequired: device authentication is requiredMicrosoft Entra sign-in logMicrosoft Entra AADSTS error codes 50085–54005: the complete list with fixes (part 2 of 5)
AADSTS50098: JWT body must contain a required fieldSign-in page / Microsoft Entra sign-in logMicrosoft Entra AADSTS error codes 50085–54005: the complete list with fixes (part 2 of 5)
AADSTS50099 PKeyAuthInvalidJwtUnauthorized: the JWT signature is invalidMicrosoft Entra sign-in logMicrosoft Entra AADSTS error codes 50085–54005: the complete list with fixes (part 2 of 5)
AADSTS50100: error transforming the claims for the tokenSign-in page / Microsoft Entra sign-in logMicrosoft Entra AADSTS error codes 50085–54005: the complete list with fixes (part 2 of 5)
AADSTS50101: Unknown claims transformer specified for the principalSign-in page / Microsoft Entra sign-in logMicrosoft Entra AADSTS error codes 50085–54005: the complete list with fixes (part 2 of 5)
AADSTS50102: Unable to load the CustomClaimsTransformer specified for the principalSign-in page / Microsoft Entra sign-in logMicrosoft Entra AADSTS error codes 50085–54005: the complete list with fixes (part 2 of 5)
AADSTS50103: error transforming the claims for the token, with detailsSign-in page / Microsoft Entra sign-in logMicrosoft Entra AADSTS error codes 50085–54005: the complete list with fixes (part 2 of 5)
AADSTS50107: requested federation realm object doesn't existSign-in page / Microsoft Entra sign-in logMicrosoft Entra AADSTS error codes 50085–54005: the complete list with fixes (part 2 of 5)
AADSTS50108: Claims transformation configuration couldn't be retrievedSign-in page / Microsoft Entra sign-in logMicrosoft Entra AADSTS error codes 50085–54005: the complete list with fixes (part 2 of 5)
AADSTS50109: Claim transformation is unknown from configurationSign-in page / Microsoft Entra sign-in logMicrosoft Entra AADSTS error codes 50085–54005: the complete list with fixes (part 2 of 5)
AADSTS50111: Unknown claim transformation was asked to be appliedSign-in page / Microsoft Entra sign-in logMicrosoft Entra AADSTS error codes 50085–54005: the complete list with fixes (part 2 of 5)
AADSTS50117: policy in the request's claims parameter couldn't be deserializedApp token response / sign-in logMicrosoft Entra AADSTS error codes 50085–54005: the complete list with fixes (part 2 of 5)
AADSTS50120: unknown credential type, problem with the JWT headerApp token response / sign-in logMicrosoft Entra AADSTS error codes 50085–54005: the complete list with fixes (part 2 of 5)
AADSTS50123: Unknown claims transformation method specified for the principalSign-in page / Microsoft Entra sign-in logMicrosoft Entra AADSTS error codes 50085–54005: the complete list with fixes (part 2 of 5)
AADSTS50124: invalid regular expression in the app's claims transformationSign-in page / Microsoft Entra sign-in logMicrosoft Entra AADSTS error codes 50085–54005: the complete list with fixes (part 2 of 5)
AADSTS50125 PasswordResetRegistrationRequiredInterrupt: sign-in interrupted for password reset or registrationMicrosoft Entra sign-in logSelf-service password reset and password writeback: fixing the usual failures
AADSTS50127 BrokerAppNotInstalled: user must install a broker appSign-in page (mobile)Microsoft Entra AADSTS error codes 50085–54005: the complete list with fixes (part 2 of 5)
AADSTS50128: invalid domain name, no tenant information foundSign-in pageMicrosoft Entra AADSTS error codes 50085–54005: the complete list with fixes (part 2 of 5)
AADSTS50129 DeviceIsNotWorkplaceJoined: workplace join is required to register the deviceSign-in page / Microsoft Entra sign-in logMicrosoft Entra AADSTS error codes 50085–54005: the complete list with fixes (part 2 of 5)
AADSTS50130: claim value can't be interpreted as a known authentication methodMicrosoft Entra sign-in logMicrosoft Entra AADSTS error codes 50085–54005: the complete list with fixes (part 2 of 5)
AADSTS50131 ConditionalAccessFailed: various Conditional Access failuresMicrosoft Entra sign-in logMicrosoft Entra AADSTS error codes 50085–54005: the complete list with fixes (part 2 of 5)
AADSTS50132 SsoArtifactInvalidOrExpired: session invalid after a password expiry or changeSign-in page / Microsoft Entra sign-in logUsers keep being asked to sign in again: Entra sign-in frequency and AADSTS70043
AADSTS50134 DeviceFlowAuthorizeWrongDatacenter: device code flow approved in the wrong data centerSign-in page (device code flow)Microsoft Entra AADSTS error codes 50085–54005: the complete list with fixes (part 2 of 5)
AADSTS50136 RedirectMsaSessionToApp: single Microsoft account session detectedMicrosoft Entra sign-in logMicrosoft Entra AADSTS error codes 50085–54005: the complete list with fixes (part 2 of 5)
AADSTS50137: password must change because of a security policy ruleSign-in pageMicrosoft Entra AADSTS error codes 50085–54005: the complete list with fixes (part 2 of 5)
AADSTS50138: Invalid encryption key environmentSign-in page / Microsoft Entra sign-in logMicrosoft Entra AADSTS error codes 50085–54005: the complete list with fixes (part 2 of 5)
AADSTS50139 SessionMissingMsaOAuth2RefreshToken: session invalid, external refresh token missingSign-in page / Microsoft Entra sign-in logMicrosoft Entra AADSTS error codes 50085–54005: the complete list with fixes (part 2 of 5)
AADSTS50141: Protected key isn't intended for the authenticated userSign-in page / Microsoft Entra sign-in logMicrosoft Entra AADSTS error codes 50085–54005: the complete list with fixes (part 2 of 5)
AADSTS50143: session mismatch, the user's tenant doesn't match the domain hintSign-in page / Microsoft Entra sign-in logMicrosoft Entra AADSTS error codes 50085–54005: the complete list with fixes (part 2 of 5)
AADSTS50146 MissingCustomSigningKey: app must use an app-specific signing keyApp token response / sign-in logMicrosoft Entra AADSTS error codes 50085–54005: the complete list with fixes (part 2 of 5)
AADSTS50147 MissingCodeChallenge: invalid size of the code challenge parameterApp token response / sign-in logMicrosoft Entra AADSTS error codes 50085–54005: the complete list with fixes (part 2 of 5)
AADSTS50148: code_verifier doesn't match the PKCE code_challengeApp token response / sign-in logMicrosoft Entra AADSTS error codes 50085–54005: the complete list with fixes (part 2 of 5)
AADSTS50149: invalid Code_Challenge_method parameterApp token response / sign-in logMicrosoft Entra AADSTS error codes 50085–54005: the complete list with fixes (part 2 of 5)
AADSTS50150: Credentials lack valid user consent approval informationSign-in page / Microsoft Entra sign-in logMicrosoft Entra AADSTS error codes 50085–54005: the complete list with fixes (part 2 of 5)
AADSTS50156: Device tokens aren't supported for V2 resourcesSign-in page / Microsoft Entra sign-in logMicrosoft Entra AADSTS error codes 50085–54005: the complete list with fixes (part 2 of 5)
AADSTS50157: User redirection required for routingSign-in page / Microsoft Entra sign-in logMicrosoft Entra AADSTS error codes 50085–54005: the complete list with fixes (part 2 of 5)
AADSTS50159: claims sent by the external provider aren't enoughSign-in page / Microsoft Entra sign-in logMicrosoft Entra AADSTS error codes 50085–54005: the complete list with fixes (part 2 of 5)
AADSTS50160: A different target tenant is preferredSign-in page / Microsoft Entra sign-in logMicrosoft Entra AADSTS error codes 50085–54005: the complete list with fixes (part 2 of 5)
AADSTS50161: external claims provider's authorization URL couldn't be validatedSign-in page / Microsoft Entra sign-in logMicrosoft Entra AADSTS error codes 50085–54005: the complete list with fixes (part 2 of 5)
AADSTS50162: claims transformation timed outSign-in page / Microsoft Entra sign-in logMicrosoft Entra AADSTS error codes 50085–54005: the complete list with fixes (part 2 of 5)
AADSTS50163: regex replacement made a claim exceed the size limitSign-in page / Microsoft Entra sign-in logMicrosoft Entra AADSTS error codes 50085–54005: the complete list with fixes (part 2 of 5)
AADSTS50164: Access token wasn't issued for the purpose it's used forSign-in page / Microsoft Entra sign-in logMicrosoft Entra AADSTS error codes 50085–54005: the complete list with fixes (part 2 of 5)
AADSTS50165: requested token encryption algorithm isn't supported for this token typeSign-in page / app errorMicrosoft Entra AADSTS error codes 50085–54005: the complete list with fixes (part 2 of 5)
AADSTS50166: request to an external OIDC endpoint failedSign-in page / Microsoft Entra sign-in logMicrosoft Entra AADSTS error codes 50085–54005: the complete list with fixes (part 2 of 5)
AADSTS50167: Invalid pop_jwk keySign-in page / Microsoft Entra sign-in logMicrosoft Entra AADSTS error codes 50085–54005: the complete list with fixes (part 2 of 5)
AADSTS50168: Windows 10 Accounts extension can do SSO, but no valid SSO token was sentMicrosoft Entra sign-in logPrimary Refresh Token (PRT) explained: fixing SSO and repeated sign-in prompts
AADSTS50169 InvalidRequestBadRealm: realm isn't configured in the current service namespaceSign-in page / app errorMicrosoft Entra AADSTS error codes 50085–54005: the complete list with fixes (part 2 of 5)
AADSTS50170 MissingExternalClaimsProviderMapping: external controls mapping is missingSign-in page / Microsoft Entra sign-in logMicrosoft Entra AADSTS error codes 50085–54005: the complete list with fixes (part 2 of 5)
AADSTS50171: Audience usable only in mutual-TLS token callsSign-in page / Microsoft Entra sign-in logMicrosoft Entra AADSTS error codes 50085–54005: the complete list with fixes (part 2 of 5)
AADSTS50172: external claims provider isn't approvedSign-in page / Microsoft Entra sign-in logMicrosoft Entra AADSTS error codes 50085–54005: the complete list with fixes (part 2 of 5)
AADSTS50176: missing definition of an external controlSign-in page / Microsoft Entra sign-in logMicrosoft Entra AADSTS error codes 50085–54005: the complete list with fixes (part 2 of 5)
AADSTS50177 ExternalChallengeNotSupportedForPassthroughUsers: external challenge not supported for passthrough usersMicrosoft Entra sign-in logMicrosoft Entra AADSTS error codes 50085–54005: the complete list with fixes (part 2 of 5)
AADSTS50178 SessionControlNotSupportedForPassthroughUsers: session control not supported for passthrough usersMicrosoft Entra sign-in logMicrosoft Entra AADSTS error codes 50085–54005: the complete list with fixes (part 2 of 5)
AADSTS50180 WindowsIntegratedAuthMissing: integrated Windows authentication is neededSign-in page / Microsoft Entra sign-in logSeamless SSO not working: the AZUREADSSOACC account, Kerberos and the intranet zone
AADSTS50187 DeviceInformationNotProvided: service failed to perform device authenticationMicrosoft Entra sign-in logMicrosoft Entra AADSTS error codes 50085–54005: the complete list with fixes (part 2 of 5)
AADSTS50197 ConflictingIdentities: the user couldn't be foundSign-in pageMicrosoft Entra AADSTS error codes 50085–54005: the complete list with fixes (part 2 of 5)
AADSTS50199 CmsiInterrupt: user confirmation required for security reasonsMicrosoft Entra sign-in logMicrosoft Entra AADSTS error codes 50085–54005: the complete list with fixes (part 2 of 5)
AADSTS51000 RequiredFeatureNotEnabled: the feature is disabledSign-in page / Microsoft Entra sign-in logMicrosoft Entra AADSTS error codes 50085–54005: the complete list with fixes (part 2 of 5)
AADSTS51001 DomainHintMustbePresent: domain hint required with an on-premises SID or UPNSign-in page / app errorMicrosoft Entra AADSTS error codes 50085–54005: the complete list with fixes (part 2 of 5)
AADSTS51004 UserAccountNotInDirectory: user account doesn't exist in the directorySign-in page / Microsoft Entra sign-in logGuest sign-in errors in Microsoft Entra ID: AADSTS90072, AADSTS50020 and cross-tenant blocks
AADSTS51005 TemporaryRedirect: Equivalent to HTTP 307: follow the Location headerSign-in page / Microsoft Entra sign-in logMicrosoft Entra AADSTS error codes 50085–54005: the complete list with fixes (part 2 of 5)
AADSTS51006 ForceReauthDueToInsufficientAuth: integrated Windows authentication is neededSign-in page / Microsoft Entra sign-in logMicrosoft Entra AADSTS error codes 50085–54005: the complete list with fixes (part 2 of 5)
AADSTS52004 DelegationDoesNotExistForLinkedIn: user hasn't consented to LinkedIn resourcesSign-in page / app errorMicrosoft Entra AADSTS error codes 50085–54005: the complete list with fixes (part 2 of 5)
AADSTS53002 ApplicationUsedIsNotAnApprovedApp: app isn't approved for Conditional AccessSign-in page / Microsoft Entra sign-in logMicrosoft Entra AADSTS error codes 50085–54005: the complete list with fixes (part 2 of 5)
AADSTS53010 ProofUpBlockedDueToSecurityInfoAcr: MFA methods can't be set up from this location or deviceSecurity info registration / sign-in logAADSTS50076, AADSTS50079 and AADSTS50158: fixing MFA and authentication-strength sign-in errors
AADSTS54000 MinorUserBlockedLegalAgeGroupRule: minor blocked by the legal age group ruleSign-in pageMicrosoft Entra AADSTS error codes 50085–54005: the complete list with fixes (part 2 of 5)
AADSTS54005: OAuth2 authorization code was already redeemedApp token response / sign-in logMicrosoft Entra AADSTS error codes 50085–54005: the complete list with fixes (part 2 of 5)
AADSTS501241: mandatory input missing from a claims transformation (NameID source)Sign-in page (SAML app)Microsoft Entra AADSTS error codes 50085–54005: the complete list with fixes (part 2 of 5)
AADSTS501461: AcceptMappedClaims works only for an audience matching the app ID or a verified domainApp token response / sign-in logMicrosoft Entra AADSTS error codes 50085–54005: the complete list with fixes (part 2 of 5)
AADSTS501481: Code_Verifier doesn't match the code_challengeSign-in page / Microsoft Entra sign-in logMicrosoft Entra AADSTS error codes 50085–54005: the complete list with fixes (part 2 of 5)
AADSTS501491 InvalidCodeChallengeMethodInvalidSize: Invalid size of the Code_Challenge parameterSign-in page / Microsoft Entra sign-in logMicrosoft Entra AADSTS error codes 50085–54005: the complete list with fixes (part 2 of 5)
AADSTS501631: regex replacement made too many replacements in the source claimSign-in page / Microsoft Entra sign-in logMicrosoft Entra AADSTS error codes 50085–54005: the complete list with fixes (part 2 of 5)
AADSTS501632: regex replacement has too many substitution parametersSign-in page / Microsoft Entra sign-in logMicrosoft Entra AADSTS error codes 50085–54005: the complete list with fixes (part 2 of 5)
AADSTS530034 DelegatedAdminBlockedDueToSuspiciousActivity: delegated admin blocked due to home tenant riskSign-in page / Microsoft Entra sign-in logMicrosoft Entra AADSTS error codes 50085–54005: the complete list with fixes (part 2 of 5)
AADSTS1000104 XCB2BResourceCloudNotAllowedOnIdentityTenant: resource cloud not allowed for the identity tenantSign-in page / Microsoft Entra sign-in logMicrosoft Entra AADSTS error codes 50085–54005: the complete list with fixes (part 2 of 5)AADSTS codes 65001–81012
Every code in the quick reference “AADSTS error codes 65001–81012: the complete list with fixes (part 3 of 5)”: what it means, the usual cause and the first check. Open the quick reference
AADSTS65002: first-party app and API need preauthorization (a Microsoft-owned app ID was reused)App error / token responseAADSTS error codes 65001–81012: the complete list with fixes (part 3 of 5)
AADSTS67003 ActorNotValidServiceIdentity: the actor isn't a valid service identityApp error / token responseAADSTS error codes 65001–81012: the complete list with fixes (part 3 of 5)
AADSTS70000 InvalidGrant: the refresh token isn't valid (token binding header or hash)App error / token responseAADSTS error codes 65001–81012: the complete list with fixes (part 3 of 5)
AADSTS70001 UnauthorizedClient: the application is disabledSign-in page / Microsoft Entra sign-in logAADSTS error codes 65001–81012: the complete list with fixes (part 3 of 5)
AADSTS70003 UnsupportedGrantType: the grant type isn't supportedToken responseAADSTS error codes 65001–81012: the complete list with fixes (part 3 of 5)
AADSTS70004 InvalidRedirectUri: the redirect URI isn't configured or approvedSign-in pageApp sign-in errors in Microsoft Entra ID: AADSTS7000215, AADSTS700016, AADSTS50011 and more
AADSTS70005 UnsupportedResponseType: token not enabled, or id_token without the openid scopeSign-in pageAADSTS error codes 65001–81012: the complete list with fixes (part 3 of 5)
AADSTS70007 UnsupportedResponseMode: the response_mode value isn't supportedSign-in page / token responseAADSTS error codes 65001–81012: the complete list with fixes (part 3 of 5)
AADSTS70008 ExpiredOrRevokedGrant: refresh token expired after inactivityApp error / Microsoft Entra sign-in logUsers keep being asked to sign in again: Entra sign-in frequency and AADSTS70043
AADSTS70011 InvalidScope: the scope requested by the app is invalidSign-in page / token responseAADSTS error codes 65001–81012: the complete list with fixes (part 3 of 5)
AADSTS70012 MsaServerError: server error while authenticating a personal Microsoft accountSign-in pageAADSTS error codes 65001–81012: the complete list with fixes (part 3 of 5)
AADSTS70018 BadVerificationCode: wrong user code typed in the device code flowApp or script (device code flow)AADSTS error codes 65001–81012: the complete list with fixes (part 3 of 5)
AADSTS75001 BindingSerializationError: error during SAML message bindingSign-in page (SAML app)AADSTS error codes 65001–81012: the complete list with fixes (part 3 of 5)
AADSTS75003 UnsupportedBindingError: SAML responses can only be sent with HTTP POSTSign-in page (SAML app)AADSTS error codes 65001–81012: the complete list with fixes (part 3 of 5)
AADSTS75005 Saml2MessageInvalid: the SAML request sent by the app isn't supportedSign-in page (SAML app)AADSTS error codes 65001–81012: the complete list with fixes (part 3 of 5)
AADSTS75008 RequestDeniedError: the SAML request had an unexpected destinationSign-in page (SAML app)AADSTS error codes 65001–81012: the complete list with fixes (part 3 of 5)
AADSTS75016 Saml2AuthenticationRequestInvalidNameIDPolicy: invalid NameIdPolicySign-in page (SAML app)AADSTS error codes 65001–81012: the complete list with fixes (part 3 of 5)
AADSTS76021 ApplicationRequiresSignedRequests: the request isn't signedSign-in page (SAML app)AADSTS error codes 65001–81012: the complete list with fixes (part 3 of 5)
AADSTS76026 RequestIssueTimeExpired: IssueTime in the SAML request has expiredSign-in page (SAML app)AADSTS error codes 65001–81012: the complete list with fixes (part 3 of 5)
AADSTS80002 OnPremisePasswordValidatorRequestTimedout: PTA password validation timed outSign-in page / Microsoft Entra sign-in logAADSTS error codes 65001–81012: the complete list with fixes (part 3 of 5)
AADSTS80003: invalid response received by the PTA Authentication AgentMicrosoft Entra sign-in logAADSTS error codes 65001–81012: the complete list with fixes (part 3 of 5)
AADSTS80004: incorrect user principal name (UPN) passed to the PTA agentSign-in page / Microsoft Entra sign-in logAADSTS error codes 65001–81012: the complete list with fixes (part 3 of 5)
AADSTS80005 OnPremisePasswordValidatorUnpredictableWebException: unknown error from the PTA agentSign-in page / Microsoft Entra sign-in logAADSTS error codes 65001–81012: the complete list with fixes (part 3 of 5)
AADSTS80010 OnPremisePasswordValidationEncryptionException: PTA agent can't decrypt the passwordMicrosoft Entra sign-in logAADSTS error codes 65001–81012: the complete list with fixes (part 3 of 5)
AADSTS80011: PTA Authentication Agent can't retrieve the decryption keyMicrosoft Entra sign-in logAADSTS error codes 65001–81012: the complete list with fixes (part 3 of 5)
AADSTS80012 OnPremisePasswordValidationAccountLogonInvalidHours: sign-in outside AD logon hoursSign-in page / Microsoft Entra sign-in logAADSTS error codes 65001–81012: the complete list with fixes (part 3 of 5)
AADSTS80013 OnPremisePasswordValidationTimeSkew: time skew between the PTA agent and ADSign-in page / Microsoft Entra sign-in logAADSTS error codes 65001–81012: the complete list with fixes (part 3 of 5)
AADSTS80014 OnPremisePasswordValidationAuthenticationAgentTimeout: PTA agent answered too lateMicrosoft Entra sign-in logAADSTS error codes 65001–81012: the complete list with fixes (part 3 of 5)
AADSTS81005 DesktopSsoAuthenticationPackageNotSupported: authentication package not supportedMicrosoft Entra sign-in logSeamless SSO not working: the AZUREADSSOACC account, Kerberos and the intranet zone
AADSTS81006 DesktopSsoNoAuthorizationHeader: no authorization header found (Seamless SSO)Microsoft Entra sign-in logSeamless SSO not working: the AZUREADSSOACC account, Kerberos and the intranet zone
AADSTS650052: the app needs a service your organization hasn't subscribed to or enabledConsent prompt / Microsoft Entra sign-in logAADSTS error codes 65001–81012: the complete list with fixes (part 3 of 5)
AADSTS650054: the app asks for permissions to a resource that was removed or is no longer availableConsent prompt / Microsoft Entra sign-in logAADSTS error codes 65001–81012: the complete list with fixes (part 3 of 5)
AADSTS700011 UnauthorizedClientAppNotFoundInOrgIdTenant: client app not found in the directorySign-in page / token responseApp sign-in errors in Microsoft Entra ID: AADSTS7000215, AADSTS700016, AADSTS50011 and more
AADSTS700025 InvalidClientPublicClientWithCredential: a public client sent a secret or assertionToken response / sign-in logAADSTS error codes 65001–81012: the complete list with fixes (part 3 of 5)
AADSTS700030: certificate subject name isn't authorized for the appToken response / sign-in logAADSTS error codes 65001–81012: the complete list with fixes (part 3 of 5)
AADSTS700084: refresh token issued to a single-page app reached its fixed lifetimeApp error (single-page app)AADSTS error codes 65001–81012: the complete list with fixes (part 3 of 5)
AADSTS750054: SAMLRequest or SAMLResponse missing from the query string (Redirect binding)Sign-in page (SAML app)AADSTS error codes 65001–81012: the complete list with fixes (part 3 of 5)
AADSTS7500514: no supported SAML response type (Response or Assertion) was foundSign-in page (SAML app)AADSTS error codes 65001–81012: the complete list with fixes (part 3 of 5)AADSTS codes 90002–90130
Every code in the quick reference “AADSTS error codes 90002–90130: the complete list with fixes (part 4 of 5)”: what it means, the usual cause and the first check. Open the quick reference
AADSTS90002 InvalidTenantName: tenant not found (wrong tenant ID, domain or cloud)Sign-in page / app errorAADSTS error codes 90002–90130: the complete list with fixes (part 4 of 5)
AADSTS90004 InvalidRequestFormat: the request isn't properly formattedApp error / token responseAADSTS error codes 90002–90130: the complete list with fixes (part 4 of 5)
AADSTS90005 InvalidRequestWithMultipleRequirements: identifier and login hint used togetherSign-in page / app errorAADSTS error codes 90002–90130: the complete list with fixes (part 4 of 5)
AADSTS90006 ExternalServerRetryableError: the service is temporarily unavailableSign-in page / app errorAADSTS error codes 90002–90130: the complete list with fixes (part 4 of 5)
AADSTS90007 InvalidSessionId: the session ID passed can't be parsedSign-in pageAADSTS error codes 90002–90130: the complete list with fixes (part 4 of 5)
AADSTS90008 TokenForItselfRequiresGraphPermission: app needs the sign-in and read user profile permissionSign-in page / app error"Need admin approval": AADSTS65001 and AADSTS90094 consent errors in Microsoft Entra ID
AADSTS90009 TokenForItselfMissingIdenticalAppIdentifier: use the GUID app ID to request a token for itselfApp error / token responseAADSTS error codes 90002–90130: the complete list with fixes (part 4 of 5)
AADSTS90010 NotSupported: unable to create the algorithmApp error / token responseAADSTS error codes 90002–90130: the complete list with fixes (part 4 of 5)
AADSTS90012 RequestTimeout: the requests have timed outSign-in page / app errorAADSTS error codes 90002–90130: the complete list with fixes (part 4 of 5)
AADSTS90013 InvalidUserInput: the input from the user isn't validSign-in pageAADSTS error codes 90002–90130: the complete list with fixes (part 4 of 5)
AADSTS90014 MissingRequiredField: an expected field is missing from the credentialApp error / token responseAADSTS error codes 90002–90130: the complete list with fixes (part 4 of 5)
AADSTS90015 QueryStringTooLong: the query string is too longSign-in pageAADSTS error codes 90002–90130: the complete list with fixes (part 4 of 5)
AADSTS90016 MissingRequiredClaim: the access token is missing a required claimApp error / token responseAADSTS error codes 90002–90130: the complete list with fixes (part 4 of 5)
AADSTS90019 MissingTenantRealm: Entra ID can't determine the tenant from the requestSign-in page / app errorAADSTS error codes 90002–90130: the complete list with fixes (part 4 of 5)
AADSTS90020: the SAML 1.1 assertion is missing the user's ImmutableIDSign-in page (federated domain)AADSTS error codes 90002–90130: the complete list with fixes (part 4 of 5)
AADSTS90022 AuthenticatedInvalidPrincipalNameFormat: invalid principal name formatApp error / token responseAADSTS error codes 90002–90130: the complete list with fixes (part 4 of 5)
AADSTS90023 InvalidRequest: the authentication service request isn't validApp error / token responseAADSTS error codes 90002–90130: the complete list with fixes (part 4 of 5)
AADSTS90024 RequestBudgetExceededError: a transient error has occurredSign-in page / app errorAADSTS error codes 90002–90130: the complete list with fixes (part 4 of 5)
AADSTS90027: tokens can't be issued from this API version for personal Microsoft accountsSign-in page (personal account)AADSTS error codes 90002–90130: the complete list with fixes (part 4 of 5)
AADSTS90033 MsodsServiceUnavailable: the directory service (MSODS) isn't availableSign-in page / app errorAADSTS error codes 90002–90130: the complete list with fixes (part 4 of 5)
AADSTS90036 MsodsServiceUnretryableFailure: non-retryable directory service errorSign-in page / app errorAADSTS error codes 90002–90130: the complete list with fixes (part 4 of 5)
AADSTS90038 NationalCloudTenantRedirection: the tenant belongs to another national cloudSign-in page / app errorAADSTS error codes 90002–90130: the complete list with fixes (part 4 of 5)
AADSTS90043 NationalCloudAuthCodeRedirection: the feature is disabledApp error / token responseAADSTS error codes 90002–90130: the complete list with fixes (part 4 of 5)
AADSTS90051 InvalidNationalCloudId: the national cloud identifier isn't validApp error / token responseAADSTS error codes 90002–90130: the complete list with fixes (part 4 of 5)
AADSTS90055 TenantThrottlingError: too many incoming requests (blocked tenant)App error / token responseAADSTS error codes 90002–90130: the complete list with fixes (part 4 of 5)
AADSTS90056 BadResourceRequest: redeem the authorization code with a POST to the /token endpointApp error / token responseAADSTS error codes 90002–90130: the complete list with fixes (part 4 of 5)
AADSTS90081 OrgIdWsFederationMessageInvalid: the WS-Federation message isn't validSign-in page (WS-Federation app)AADSTS error codes 90002–90130: the complete list with fixes (part 4 of 5)
AADSTS90082 OrgIdWsFederationNotSupported: the selected authentication policy isn't supportedSign-in page (WS-Federation app)AADSTS error codes 90002–90130: the complete list with fixes (part 4 of 5)
AADSTS90084 OrgIdWsFederationGuestNotAllowed: guest accounts aren't allowed for this siteSign-in page (WS-Federation app)AADSTS error codes 90002–90130: the complete list with fixes (part 4 of 5)
AADSTS90085 OrgIdWsFederationSltRedemptionFailed: the company object isn't provisioned yetSign-in pageAADSTS error codes 90002–90130: the complete list with fixes (part 4 of 5)
AADSTS90086 OrgIdWsTrustDaTokenExpired: the user DA token has expiredSign-in page / app errorAADSTS error codes 90002–90130: the complete list with fixes (part 4 of 5)
AADSTS90087 OrgIdWsFederationMessageCreationFromUriFailed: WS-Federation message can't be built from the URISign-in page (WS-Federation app)AADSTS error codes 90002–90130: the complete list with fixes (part 4 of 5)
AADSTS90090 GraphRetryableError: the service is temporarily unavailableSign-in page / app errorAADSTS error codes 90002–90130: the complete list with fixes (part 4 of 5)
AADSTS90091 / AADSTS90092: Graph service unreachable, or a non-retryable Graph errorSign-in page / app errorAADSTS error codes 90002–90130: the complete list with fixes (part 4 of 5)
AADSTS90095 AdminConsentRequiredRequestAccess: the user must request admin approvalConsent prompt"Need admin approval": AADSTS65001 and AADSTS90094 consent errors in Microsoft Entra ID
AADSTS90099: the app isn't authorized in the tenant for partner delegated adminsSign-in page / app errorAADSTS error codes 90002–90130: the complete list with fixes (part 4 of 5)
AADSTS90100 InvalidRequestParameter: a parameter is empty or not validSign-in page / app errorAADSTS error codes 90002–90130: the complete list with fixes (part 4 of 5)
AADSTS90101 InvalidEmailAddress: the data isn't a valid email addressSign-in pageAADSTS error codes 90002–90130: the complete list with fixes (part 4 of 5)
AADSTS90102 InvalidUriParameter: the value must be a valid absolute URISign-in page / app errorAADSTS error codes 90002–90130: the complete list with fixes (part 4 of 5)
AADSTS90107 InvalidXml: the request contains invalid charactersSign-in page / app errorAADSTS error codes 90002–90130: the complete list with fixes (part 4 of 5)
AADSTS90112: the application identifier is expected to be a GUIDApp error / token responseAADSTS error codes 90002–90130: the complete list with fixes (part 4 of 5)
AADSTS90114 InvalidExpiryDate: the bulk token expiry would issue an already-expired tokenApp error / token responseAADSTS error codes 90002–90130: the complete list with fixes (part 4 of 5)
AADSTS90117: invalid request inputApp error / token responseAADSTS error codes 90002–90130: the complete list with fixes (part 4 of 5)
AADSTS90119 InvalidUserCode: the user code is null or empty (device code flow)Device code sign-in pageAADSTS error codes 90002–90130: the complete list with fixes (part 4 of 5)
AADSTS90120 InvalidDeviceFlowRequest: the request was already authorized or declinedApp or script (device code flow)AADSTS error codes 90002–90130: the complete list with fixes (part 4 of 5)
AADSTS90121 InvalidEmptyRequest: invalid empty requestApp error / token responseAADSTS error codes 90002–90130: the complete list with fixes (part 4 of 5)
AADSTS90123 IdentityProviderAccessDenied: the identity or claims provider denied the requestSign-in page / Microsoft Entra sign-in logAADSTS error codes 90002–90130: the complete list with fixes (part 4 of 5)
AADSTS90124 / AADSTS90130: resource or app isn't supported over the /common or /consumers endpointsSign-in page / app errorAADSTS error codes 90002–90130: the complete list with fixes (part 4 of 5)
AADSTS90125 / AADSTS90126: user not found, or the tenant can't be inferred from the user nameSign-in pageAADSTS error codes 90002–90130: the complete list with fixes (part 4 of 5)
AADSTS900144: the request body must contain the parameter named in the messageApp error / token responseAADSTS error codes 90002–90130: the complete list with fixes (part 4 of 5)
AADSTS900236 InvalidRequestSamlPropertyUnsupported: SAML request property isn't supportedSign-in page (SAML app)AADSTS error codes 90002–90130: the complete list with fixes (part 4 of 5)
AADSTS900384: JWT token failed signature validationApp error / token responseAADSTS error codes 90002–90130: the complete list with fixes (part 4 of 5)
AADSTS900432 / AADSTS900382: confidential client isn't supported in a cross-cloud requestApp error / token responseAADSTS error codes 90002–90130: the complete list with fixes (part 4 of 5)
AADSTS900561 BadResourceRequestInvalidRequest: the endpoint received the wrong HTTP verbSign-in page / app errorAADSTS error codes 90002–90130: the complete list with fixes (part 4 of 5)
AADSTS900612: provider signing keys from the JWKS endpoint can't be parsedSign-in page (external identity provider)AADSTS error codes 90002–90130: the complete list with fixes (part 4 of 5)
AADSTS900971: no reply address providedSign-in pageAADSTS error codes 90002–90130: the complete list with fixes (part 4 of 5)
AADSTS901002: the 'resource' request parameter isn't supportedApp error / token responseAADSTS error codes 90002–90130: the complete list with fixes (part 4 of 5)
AADSTS9001023: grant type isn't supported over the /common or /consumers endpointsApp error / token responseAADSTS error codes 90002–90130: the complete list with fixes (part 4 of 5)
AADSTS9002313 InvalidRequest: the request is malformed or invalidSign-in page / app errorAADSTS error codes 90002–90130: the complete list with fixes (part 4 of 5)
AADSTS9002332: app is for Microsoft Entra users only, so the /consumers endpoint can't be usedSign-in page / app errorAADSTS error codes 90002–90130: the complete list with fixes (part 4 of 5)AADSTS error codes
Every code in the quick reference “Microsoft Entra AADSTS error codes: a quick reference with meanings and fixes”: what it means, the usual cause and the first check. Open the quick reference
AADSTS16003 SsoUserAccountNotFoundInResourceTenant: user not explicitly added to the tenantMicrosoft Entra sign-in logGuest sign-in errors in Microsoft Entra ID: AADSTS90072, AADSTS50020 and cross-tenant blocks
AADSTS50008 InvalidSamlToken: SAML assertion missing or misconfiguredSign-in page / Microsoft Entra sign-in logMicrosoft Entra AADSTS error codes: a quick reference with meanings and fixes
AADSTS50011 InvalidReplyTo: redirect URI doesn't match the app's configured reply addressesSign-in pageApp sign-in errors in Microsoft Entra ID: AADSTS7000215, AADSTS700016, AADSTS50011 and more
AADSTS50017 CertificateValidationFailed: certificate validation failed (CBA)Sign-in page / Microsoft Entra sign-in logMicrosoft Entra CBA sign-in errors: trust store, CRL checks, bindings and AADSTS500173
AADSTS50020 UserUnauthorized: account from another identity provider isn't in the tenantSign-in pageGuest sign-in errors in Microsoft Entra ID: AADSTS90072, AADSTS50020 and cross-tenant blocks
AADSTS50034 UserAccountNotFound: the account isn't in this directorySign-in page / Microsoft Entra sign-in logMicrosoft Entra AADSTS error codes: a quick reference with meanings and fixes
AADSTS50053 IdsLocked: account locked by smart lockout, or sign-in from a malicious IP addressSign-in page / Microsoft Entra sign-in logAADSTS50053 account locked in Microsoft Entra ID: smart lockout and on-premises lockouts
AADSTS50055 InvalidPasswordExpiredPassword: the password has expiredSign-in page / Microsoft Entra sign-in logMicrosoft Entra AADSTS error codes: a quick reference with meanings and fixes
AADSTS50057 UserDisabled: the user account is disabledSign-in page / Microsoft Entra sign-in logAADSTS50053 account locked in Microsoft Entra ID: smart lockout and on-premises lockouts
AADSTS50076 UserStrongAuthClientAuthNRequired: MFA is required for this resourceMicrosoft Entra sign-in logAADSTS50076, AADSTS50079 and AADSTS50158: fixing MFA and authentication-strength sign-in errors
AADSTS50079 UserStrongAuthEnrollmentRequired: MFA required, security info must be registeredSign-in page / Microsoft Entra sign-in logAADSTS50076, AADSTS50079 and AADSTS50158: fixing MFA and authentication-strength sign-in errors
AADSTS50088: limit on telecom MFA calls reachedSign-in page / Microsoft Entra sign-in logMicrosoft Entra AADSTS error codes: a quick reference with meanings and fixes
AADSTS50105 EntitlementGrantsNotFound: user isn't assigned to a role for the appSign-in page / Microsoft Entra sign-in logMicrosoft Entra AADSTS error codes: a quick reference with meanings and fixes
AADSTS50126 InvalidUserNameOrPassword: wrong username or passwordSign-in page / Microsoft Entra sign-in logAADSTS50053 account locked in Microsoft Entra ID: smart lockout and on-premises lockouts
AADSTS50133 SsoArtifactRevoked: session invalid after a password expiry or changeSign-in page / Microsoft Entra sign-in logMicrosoft Entra AADSTS error codes: a quick reference with meanings and fixes
AADSTS50135 PasswordChangeCompromisedPassword: password change required due to account riskSign-in page / Microsoft Entra sign-in logMicrosoft Entra ID Protection: risk policies, self-remediation and false positives
AADSTS50142: password change required by a Conditional Access policySign-in page / Microsoft Entra sign-in logMicrosoft Entra ID Protection: risk policies, self-remediation and false positives
AADSTS50144 InvalidPasswordExpiredOnPremPassword: the Active Directory password has expiredSign-in page / Microsoft Entra sign-in logSelf-service password reset and password writeback: fixing the usual failures
AADSTS50158 ExternalSecurityChallenge: external security challenge not satisfiedMicrosoft Entra sign-in logAADSTS50076, AADSTS50079 and AADSTS50158: fixing MFA and authentication-strength sign-in errors
AADSTS50173: grant revoked, a fresh auth token is neededApp error / Microsoft Entra sign-in logMicrosoft Entra AADSTS error codes: a quick reference with meanings and fixes
AADSTS50192 RawCredentialExpectedNotFound: no certificate in the sign-in request (CBA)Sign-in page / Microsoft Entra sign-in logMicrosoft Entra CBA sign-in errors: trust store, CRL checks, bindings and AADSTS500173
AADSTS50194: app isn't multitenant, so the /common endpoint isn't supportedSign-in page / app errorMicrosoft Entra AADSTS error codes: a quick reference with meanings and fixes
AADSTS50196 LoopDetected: client loop detectedApp error / Microsoft Entra sign-in logMicrosoft Entra AADSTS error codes: a quick reference with meanings and fixes
AADSTS53003 BlockedByConditionalAccess: a Conditional Access policy doesn't allow token issuanceSign-in page / Microsoft Entra sign-in logAADSTS53000 vs AADSTS53003: troubleshooting Conditional Access sign-in blocks
AADSTS53004 ProofUpBlockedDueToRisk: MFA registration blocked because of riskSign-in page / Microsoft Entra sign-in logAADSTS50076, AADSTS50079 and AADSTS50158: fixing MFA and authentication-strength sign-in errors
AADSTS53011: user blocked due to risk on home tenantSign-in page / Microsoft Entra sign-in logMicrosoft Entra ID Protection: risk policies, self-remediation and false positives
AADSTS65001 DelegationDoesNotExist: no consent for the applicationApp error / Microsoft Entra sign-in log"Need admin approval": AADSTS65001 and AADSTS90094 consent errors in Microsoft Entra ID
AADSTS65004 UserDeclinedConsent: the user declined consentMicrosoft Entra sign-in log"Need admin approval": AADSTS65001 and AADSTS90094 consent errors in Microsoft Entra ID
AADSTS65005 MisconfiguredApplication: requested access doesn't match the app or resourceConsent prompt / Microsoft Entra sign-in log"Need admin approval": AADSTS65001 and AADSTS90094 consent errors in Microsoft Entra ID
AADSTS70002 InvalidClient: error validating the client credentialsApp token response / sign-in logApp sign-in errors in Microsoft Entra ID: AADSTS7000215, AADSTS700016, AADSTS50011 and more
AADSTS70016 / AADSTS70019: device code flow authorization pending or code expiredApp or script (device code flow)Microsoft Entra AADSTS error codes: a quick reference with meanings and fixes
AADSTS70043 BadTokenDueToSignInFrequency: refresh token expired by sign-in frequencyMicrosoft Entra sign-in logUsers keep being asked to sign in again: Entra sign-in frequency and AADSTS70043
AADSTS70046: session expired or reauthentication check failedMicrosoft Entra sign-in logUsers keep being asked to sign in again: Entra sign-in frequency and AADSTS70043
AADSTS75011 NoMatchedAuthnContextInOutputClaims: authentication method doesn't match the SAML requestSign-in page (SAML app)Microsoft Entra AADSTS error codes: a quick reference with meanings and fixes
AADSTS80001 OnPremiseStoreIsNotAvailable: PTA agent can't connect to Active DirectorySign-in page / Microsoft Entra sign-in logMicrosoft Entra AADSTS error codes: a quick reference with meanings and fixes
AADSTS80007 OnPremisePasswordValidatorErrorOccurredOnPrem: PTA agent can't validate the passwordSign-in page / Microsoft Entra sign-in logMicrosoft Entra AADSTS error codes: a quick reference with meanings and fixes
AADSTS81007 DesktopSsoTenantIsNotOptIn: tenant isn't enabled for Seamless SSOMicrosoft Entra sign-in logSeamless SSO not working: the AZUREADSSOACC account, Kerberos and the intranet zone
AADSTS81009: unable to validate the user's Kerberos ticket (Seamless SSO)Microsoft Entra sign-in logSeamless SSO not working: the AZUREADSSOACC account, Kerberos and the intranet zone
AADSTS90072: external account doesn't exist in the tenant, so MFA can't be satisfiedSign-in pageGuest sign-in errors in Microsoft Entra ID: AADSTS90072, AADSTS50020 and cross-tenant blocks
AADSTS90093: app requests permissions the user isn't authorized to grantConsent prompt"Need admin approval": AADSTS65001 and AADSTS90094 consent errors in Microsoft Entra ID
AADSTS90094: admin consent required (Need admin approval)Consent prompt / Microsoft Entra sign-in log"Need admin approval": AADSTS65001 and AADSTS90094 consent errors in Microsoft Entra ID
AADSTS500011 InvalidResourceServicePrincipalNotFound: resource principal not found in the tenantSign-in page / app token responseApp sign-in errors in Microsoft Entra ID: AADSTS7000215, AADSTS700016, AADSTS50011 and more
AADSTS500014 InvalidResourceServicePrincipalDisabled: the resource's service principal is disabledSign-in page / app token responseMicrosoft Entra AADSTS error codes: a quick reference with meanings and fixes
AADSTS500021: access to the tenant is denied by tenant restrictionsSign-in pageGuest sign-in errors in Microsoft Entra ID: AADSTS90072, AADSTS50020 and cross-tenant blocks
AADSTS500121: authentication failed during the strong authentication (MFA) requestSign-in page / Microsoft Entra sign-in logAADSTS50076, AADSTS50079 and AADSTS50158: fixing MFA and authentication-strength sign-in errors
AADSTS500212 NotAllowedByOutboundPolicyTenant: the user's tenant blocks outbound accessSign-in page / Microsoft Entra sign-in logGuest sign-in errors in Microsoft Entra ID: AADSTS90072, AADSTS50020 and cross-tenant blocks
AADSTS500213 NotAllowedByInboundPolicyTenant: the resource tenant blocks this userSign-in page / Microsoft Entra sign-in logGuest sign-in errors in Microsoft Entra ID: AADSTS90072, AADSTS50020 and cross-tenant blocks
AADSTS530035 BlockedBySecurityDefaults: access blocked by security defaultsSign-in page / Microsoft Entra sign-in logMicrosoft Entra AADSTS error codes: a quick reference with meanings and fixes
AADSTS650056: misconfigured application (permissions not listed or not consented)Sign-in page / app error"Need admin approval": AADSTS65001 and AADSTS90094 consent errors in Microsoft Entra ID
AADSTS650057: invalid resource, not in the app's requested permissionsSign-in page / app errorApp sign-in errors in Microsoft Entra ID: AADSTS7000215, AADSTS700016, AADSTS50011 and more
AADSTS700016 UnauthorizedClient_DoesNotMatchRequest: application not found in the directorySign-in page / app token responseApp sign-in errors in Microsoft Entra ID: AADSTS7000215, AADSTS700016, AADSTS50011 and more
AADSTS700027: client assertion failed signature validationApp token response / sign-in logApp sign-in errors in Microsoft Entra ID: AADSTS7000215, AADSTS700016, AADSTS50011 and more
AADSTS700054: response_type 'id_token' isn't enabled for the applicationSign-in pageMicrosoft Entra AADSTS error codes: a quick reference with meanings and fixes
AADSTS700082 ExpiredOrRevokedGrantInactiveToken: refresh token expired due to inactivityApp error / Microsoft Entra sign-in logMicrosoft Entra AADSTS error codes: a quick reference with meanings and fixes
AADSTS7000215: invalid client secret providedApp token response / sign-in logApp sign-in errors in Microsoft Entra ID: AADSTS7000215, AADSTS700016, AADSTS50011 and more
AADSTS7000222: the client secret keys for the app are expiredApp token response / sign-in logApp sign-in errors in Microsoft Entra ID: AADSTS7000215, AADSTS700016, AADSTS50011 and moreAD DS, Netlogon & DNS events
Every code in the quick reference “Active Directory event IDs: Directory Service, Netlogon and DNS events and their fixes”: what it means, the usual cause and the first check. Open the quick reference
DNS 4000: the DNS server was unable to open Active Directory and can't load the zoneEvent Viewer (DNS Server log)Active Directory event IDs: Directory Service, Netlogon and DNS events and their fixes
DNS 4007: the DNS server was unable to open the zone in the application directory partitionEvent Viewer (DNS Server log)Active Directory event IDs: Directory Service, Netlogon and DNS events and their fixes
DNS 4011: the DNS server was unable to add or write an update of a domain name to Active DirectoryEvent Viewer (DNS Server log)Active Directory event IDs: Directory Service, Netlogon and DNS events and their fixes
DNS 4013: the DNS server was unable to open the Active Directory and will wait for the directory to startEvent Viewer (DNS Server log)Active Directory event IDs: Directory Service, Netlogon and DNS events and their fixes
DNS 4015 with 0000051B: the DNS server can't access a zone object (SYSTEM isn't the owner)Event Viewer (DNS Server log)Active Directory event IDs: Directory Service, Netlogon and DNS events and their fixes
DNS 4015 with 00002095: a read-only DC's DNS server can't reach a writable domain controllerEvent Viewer (DNS Server log)Active Directory event IDs: Directory Service, Netlogon and DNS events and their fixes
DNS 4015 with ADMIN_LIMIT_EXCEEDED: a DNS object holds too many entries left by demoted DCsEvent Viewer (DNS Server log)Active Directory event IDs: Directory Service, Netlogon and DNS events and their fixes
Event ID 1311 (KCC): the replication configuration doesn't reflect the physical network topologyEvent Viewer (Directory Service log)Active Directory event IDs: Directory Service, Netlogon and DNS events and their fixes
Event ID 1388: a lingering object was replicated in because strict replication consistency isn't in effectEvent Viewer (Directory Service log)Active Directory event IDs: Directory Service, Netlogon and DNS events and their fixes
Event ID 1925 (KCC): the attempt to establish a replication link for a writable directory partition failedEvent Viewer (Directory Service log)Active Directory event IDs: Directory Service, Netlogon and DNS events and their fixes
Event ID 1988: the source DC sent an object that was deleted and garbage-collected locally (lingering object)Event Viewer (Directory Service log)Active Directory event IDs: Directory Service, Netlogon and DNS events and their fixes
Event ID 2042: it has been too long since this machine replicated (tombstone lifetime exceeded)Event Viewer (Directory Service log)Active Directory event IDs: Directory Service, Netlogon and DNS events and their fixes
Event ID 2087: AD DS couldn't resolve the source DC's DNS host name, and replication failedEvent Viewer (Directory Service log)Active Directory event IDs: Directory Service, Netlogon and DNS events and their fixes
Event ID 2088: AD DS couldn't resolve the source DC's DNS host name, but replication succeededEvent Viewer (Directory Service log)Active Directory event IDs: Directory Service, Netlogon and DNS events and their fixes
Event ID 2886: LDAP signing isn't enforced on this domain controllerEvent Viewer (Directory Service log)Active Directory event IDs: Directory Service, Netlogon and DNS events and their fixes
Event ID 2887: unsigned or cleartext LDAP binds were accepted in the last 24 hoursEvent Viewer (Directory Service log)Active Directory event IDs: Directory Service, Netlogon and DNS events and their fixes
Event ID 2888: unsigned or cleartext LDAP binds were rejected in the last 24 hoursEvent Viewer (Directory Service log)Active Directory event IDs: Directory Service, Netlogon and DNS events and their fixes
Event ID 2889: a client performed an LDAP bind on port 389 without signingEvent Viewer (Directory Service log)Active Directory event IDs: Directory Service, Netlogon and DNS events and their fixes
Event ID 3039: an LDAP bind over SSL/TLS failed the channel binding token validationEvent Viewer (Directory Service log)Active Directory event IDs: Directory Service, Netlogon and DNS events and their fixes
Event ID 3040: unprotected LDAPS binds were performed in the last 24 hoursEvent Viewer (Directory Service log)Active Directory event IDs: Directory Service, Netlogon and DNS events and their fixes
Event ID 3041: LDAP channel binding token validation isn't enforcedEvent Viewer (Directory Service log)Active Directory event IDs: Directory Service, Netlogon and DNS events and their fixes
Event ID 3074: client would fail channel binding token validation if it were enforced (audit)Event Viewer (Directory Service log)Active Directory event IDs: Directory Service, Netlogon and DNS events and their fixes
Event ID 3075: client bound over SSL/TLS without channel binding information (audit)Event Viewer (Directory Service log)Active Directory event IDs: Directory Service, Netlogon and DNS events and their fixes
Naming information could not be located.Active Directory Users and ComputersActive Directory event IDs: Directory Service, Netlogon and DNS events and their fixes
Netlogon 577x: the domain controller couldn't register its DNS SRV recordsEvent Viewer (System log on the DC)Active Directory event IDs: Directory Service, Netlogon and DNS events and their fixes
Netlogon 3210: this computer could not authenticate with a domain controller and might deny logon requestsEvent Viewer (System log, NETLOGON)Active Directory event IDs: Directory Service, Netlogon and DNS events and their fixes
Netlogon 5719 with 0xC00000E5 (STATUS_INTERNAL_ERROR) at Netlogon restart on Windows Server 2025Event Viewer (System log, NETLOGON)Active Directory event IDs: Directory Service, Netlogon and DNS events and their fixes
Netlogon 5719: this computer was not able to set up a secure session with a domain controllerEvent Viewer (System log, NETLOGON)Active Directory event IDs: Directory Service, Netlogon and DNS events and their fixes
Netlogon 5722: the session setup from the computer failed to authenticate (Access is denied)Event Viewer (System log on the DC)Active Directory event IDs: Directory Service, Netlogon and DNS events and their fixes
Netlogon 5805: a machine account failed to authenticateEvent Viewer (System log on the DC)Active Directory event IDs: Directory Service, Netlogon and DNS events and their fixes
NlSessionSetup: Session setup: cannot pick trusted DCNetlogon.logActive Directory event IDs: Directory Service, Netlogon and DNS events and their fixes
The trust relationship between this workstation and the primary domain failed.Windows sign-in screenActive Directory event IDs: Directory Service, Netlogon and DNS events and their fixesAD FS errors & events
Every code in the quick reference “AD FS errors and event IDs: 364, 411, 1203, certificate events and MSIS codes with fixes”: what it means, the usual cause and the first check. Open the quick reference
Event ID 102: There was an error in enabling endpoints of the Federation Service.AD FS/Admin logAD FS errors and event IDs: 364, 411, 1203, certificate events and MSIS codes with fixes
Event ID 220: The Federation Service configuration could not be loaded correctly from the AD FS configuration database.AD FS/Admin logAD FS errors and event IDs: 364, 411, 1203, certificate events and MSIS codes with fixes
Event ID 249: A certificate couldn't be found in the certificate store.AD FS/Admin logAD FS errors and event IDs: 364, 411, 1203, certificate events and MSIS codes with fixes
Event ID 315: chain build failed for the claims provider trust signing certificateAD FS/Admin logAD FS errors and event IDs: 364, 411, 1203, certificate events and MSIS codes with fixes
Event ID 316: chain build failed for the relying party trust signing certificateAD FS/Admin logAD FS errors and event IDs: 364, 411, 1203, certificate events and MSIS codes with fixes
Event ID 317: chain build failed for the relying party trust encryption certificateAD FS/Admin logAD FS errors and event IDs: 364, 411, 1203, certificate events and MSIS codes with fixes
Event ID 319: chain build failed for the client certificateAD FS/Admin logAD FS errors and event IDs: 364, 411, 1203, certificate events and MSIS codes with fixes
Event ID 342: credential or token validation failed (reason in the exception)AD FS/Admin logAD FS errors and event IDs: 364, 411, 1203, certificate events and MSIS codes with fixes
Event ID 352: A SQL Server operation in the AD FS configuration database with connection string %1 failed.AD FS/Admin logAD FS errors and event IDs: 364, 411, 1203, certificate events and MSIS codes with fixes
Event ID 360: request to a certificate transport endpoint didn't include a client certificateAD FS/Admin logAD FS errors and event IDs: 364, 411, 1203, certificate events and MSIS codes with fixes
Event ID 364: Encountered error during federation passive request.AD FS/Admin logAD FS errors and event IDs: 364, 411, 1203, certificate events and MSIS codes with fixes
Event ID 374: chain build failed for the claims provider trust encryption certificateAD FS/Admin logAD FS errors and event IDs: 364, 411, 1203, certificate events and MSIS codes with fixes
Event ID 381: chain build failed for a configuration certificate (expired or revoked)AD FS/Admin logAD FS errors and event IDs: 364, 411, 1203, certificate events and MSIS codes with fixes
Event ID 385: certificates in the AD FS configuration database need to be updated manuallyAD FS/Admin logAD FS errors and event IDs: 364, 411, 1203, certificate events and MSIS codes with fixes
Event ID 387: certificates weren't accessible to the AD FS service accountAD FS/Admin logAD FS errors and event IDs: 364, 411, 1203, certificate events and MSIS codes with fixes
Event ID 389: trust certificates need a manual update (expired or expiring)AD FS/Admin logAD FS errors and event IDs: 364, 411, 1203, certificate events and MSIS codes with fixes
Event ID 411: failed credential validation audit with the user and client IPSecurity log (AD FS auditing)AD FS errors and event IDs: 364, 411, 1203, certificate events and MSIS codes with fixes
Event ID 501: AD FS audit details with client IP headers (x-ms-client-ip)Security log (AD FS auditing)AD FS errors and event IDs: 364, 411, 1203, certificate events and MSIS codes with fixes
Event ID 512: The account for the following user is locked out. A sign-in attempt is being allowed due to the system configuration.Security log (AD FS auditing)AD FS errors and event IDs: 364, 411, 1203, certificate events and MSIS codes with fixes
Event ID 515: user was in a locked out state and the correct password was provided (might be compromised)Security log (AD FS auditing)AD FS errors and event IDs: 364, 411, 1203, certificate events and MSIS codes with fixes
Event ID 516: The following user account has been locked out due to too many bad password attempts.Security log (AD FS auditing)AD FS errors and event IDs: 364, 411, 1203, certificate events and MSIS codes with fixes
Event ID 557: error communicating with the account store REST service on a nodeAD FS Admin/Security logAD FS errors and event IDs: 364, 411, 1203, certificate events and MSIS codes with fixes
Event ID 562: error communicating with the account store endpoint on a serverAD FS Admin/Security logAD FS errors and event IDs: 364, 411, 1203, certificate events and MSIS codes with fixes
Event ID 563: error while calculating extranet lockout statusAD FS Admin/Security logAD FS errors and event IDs: 364, 411, 1203, certificate events and MSIS codes with fixes
Event ID 1200: Application Token SuccessSecurity log (AD FS auditing)AD FS errors and event IDs: 364, 411, 1203, certificate events and MSIS codes with fixes
Event ID 1201: Application Token FailureSecurity log (AD FS auditing)AD FS errors and event IDs: 364, 411, 1203, certificate events and MSIS codes with fixes
Event ID 1202: Fresh Credential Validation SuccessSecurity log (AD FS auditing)AD FS errors and event IDs: 364, 411, 1203, certificate events and MSIS codes with fixes
Event ID 1203: Fresh Credential Validation Error (bad password attempt)Security log (AD FS auditing)AD FS errors and event IDs: 364, 411, 1203, certificate events and MSIS codes with fixes
Event ID 1205: Password Change Request ErrorSecurity log (AD FS auditing)AD FS errors and event IDs: 364, 411, 1203, certificate events and MSIS codes with fixes
Event ID 1207: Sign Out FailureSecurity log (AD FS auditing)AD FS errors and event IDs: 364, 411, 1203, certificate events and MSIS codes with fixes
Event ID 1210: extranet lockout, written each time a user is locked outSecurity log (AD FS auditing)AD FS errors and event IDs: 364, 411, 1203, certificate events and MSIS codes with fixes
MSIS7042: The same client browser session has made '{0}' requests in the last '{1}' seconds.AD FS error page / Admin logAD FS errors and event IDs: 364, 411, 1203, certificate events and MSIS codes with fixes
MSIS7065: There are no registered protocol handlers on path ... to process the incoming request.AD FS/Admin log (event 364)AD FS errors and event IDs: 364, 411, 1203, certificate events and MSIS codes with fixes
Unknown Auth method (requested authentication context isn't supported)AD FS error pageAD FS errors and event IDs: 364, 411, 1203, certificate events and MSIS codes with fixesAD replication errors
Every code in the quick reference “Active Directory replication errors: repadmin and dcdiag codes with causes and fixes”: what it means, the usual cause and the first check. Open the quick reference
5 Access is denied: secure channel, time skew or security settings between DCsrepadmin /showrepl / dcdiagActive Directory replication errors: repadmin and dcdiag codes with causes and fixes
1127 While accessing the hard disk, a disk operation failed even after retriesrepadmin /showrepl / dcdiagActive Directory replication errors: repadmin and dcdiag codes with causes and fixes
1256 The remote system is not available: connectivity failure between partnersrepadmin /showrepl / dcdiagActive Directory replication errors: repadmin and dcdiag codes with causes and fixes
1396 Logon Failure: The target account name is incorrect (SPN lookup failed)repadmin /showrepl / dcdiagActive Directory replication errors: repadmin and dcdiag codes with causes and fixes
1722 The RPC server is unavailable: the destination DC can't reach RPC on the source DCrepadmin /showrepl / dcdiagActive Directory replication errors: repadmin and dcdiag codes with causes and fixes
1753 There are no more endpoints available from the endpoint mapperrepadmin /showrepl / dcdiagActive Directory replication errors: repadmin and dcdiag codes with causes and fixes
1818 The remote procedure call was cancelled: replication RPC timed outrepadmin /showrepl / dcdiagActive Directory replication errors: repadmin and dcdiag codes with causes and fixes
1908 Could not find the domain controller for this domain: no KDC reachablerepadmin /showrepl / dcdiagActive Directory replication errors: repadmin and dcdiag codes with causes and fixes
8240 There is no such object on the serverrepadmin /showrepl / Directory Service logActive Directory replication errors: repadmin and dcdiag codes with causes and fixes
8333 Directory object not foundrepadmin /showrepl / dcdiagActive Directory replication errors: repadmin and dcdiag codes with causes and fixes
8418 Replication failed because of a schema mismatch between the servers involvedrepadmin /showrepl / dcdiagActive Directory replication errors: repadmin and dcdiag codes with causes and fixes
8446 The replication operation failed to allocate memoryrepadmin /showrepl / dcdiagActive Directory replication errors: repadmin and dcdiag codes with causes and fixes
8451 The replication operation encountered a database errorrepadmin /showrepl / dcdiagActive Directory replication errors: repadmin and dcdiag codes with causes and fixes
8452 The naming context is in the process of being removed or is not replicated from the specified serverrepadmin /showrepl / dcdiagActive Directory replication errors: repadmin and dcdiag codes with causes and fixes
8453 Replication access was denied: missing replication permissionsrepadmin /showrepl / dcdiagActive Directory replication errors: repadmin and dcdiag codes with causes and fixes
8456 The source server is currently rejecting replication requestsrepadmin / dcdiag / DC promotionActive Directory replication errors: repadmin and dcdiag codes with causes and fixes
8457 The destination server is currently rejecting replication requestsrepadmin /showrepl / dcdiagActive Directory replication errors: repadmin and dcdiag codes with causes and fixes
8464 Synchronization attempt failed: partial attribute set sync in progressrepadmin /showrepl / dcdiagActive Directory replication errors: repadmin and dcdiag codes with causes and fixes
8477 The replication request has been posted; waiting for reply (informational)repadmin /showreplActive Directory replication errors: repadmin and dcdiag codes with causes and fixes
8524 The DSA operation is unable to proceed because of a DNS lookup failurerepadmin /showrepl / dcdiagActive Directory replication errors: repadmin and dcdiag codes with causes and fixes
8545 Replication update could not be applied (recent cross-domain move)repadmin /showrepl / dcdiagActive Directory replication errors: repadmin and dcdiag codes with causes and fixes
8589 The DS cannot derive a service principal name (SPN): serverReference problemrepadmin /showrepl / dcdiagActive Directory replication errors: repadmin and dcdiag codes with causes and fixes
8606 Insufficient attributes were given to create an object (lingering object)repadmin /showrepl / dcdiagActive Directory replication errors: repadmin and dcdiag codes with causes and fixes
8614 Can't replicate: time since last replication exceeded the tombstone lifetimerepadmin / dcdiag / Replicate NowActive Directory replication errors: repadmin and dcdiag codes with causes and fixes
-2146893022 (0x80090322) The target principal name is incorrect: KDC holds an old DC passwordrepadmin /showrepl / Replicate NowActive Directory replication errors: repadmin and dcdiag codes with causes and fixesApplication proxy errors
Every code in the quick reference “Microsoft Entra application proxy errors: connector events, gateway messages and fixes”: what it means, the usual cause and the first check. Open the quick reference
A server with the specified host name could not be found. (custom domain DNS or certificate)BrowserMicrosoft Entra application proxy errors: connector events, gateway messages and fixes
Authorization failed. Make sure that the user has a license for Microsoft Entra ID P1 or P2.Browser error pageMicrosoft Entra application proxy errors: connector events, gateway messages and fixes
Authorization failed. Make sure to assign the user with access to the application.Browser error pageMicrosoft Entra application proxy errors: connector events, gateway messages and fixes
Bad gateway: the connector can't reach the back-end applicationBrowser error page (Status Code)Microsoft Entra application proxy errors: connector events, gateway messages and fixes
Clear error is presented in the registration window. Cannot proceed (wrong user name or password)Connector installerMicrosoft Entra application proxy errors: connector events, gateway messages and fixes
Connector failed to download the configuration.Application log (private network connector)Microsoft Entra application proxy errors: connector events, gateway messages and fixes
Connector install fails: machine, proxy or firewall doesn't support TLS 1.2 or the SHA512 certificateConnector installer (%TEMP% logs)Microsoft Entra application proxy errors: connector events, gateway messages and fixes
Connector registration failed … AADSTS50059: No tenant-identifying information found (Microsoft account used)Connector installer / Application logMicrosoft Entra application proxy errors: connector events, gateway messages and fixes
Connector registration failed … Error: 'One or more errors occurred.' (window closed or network error)Connector installer / Application logMicrosoft Entra application proxy errors: connector events, gateway messages and fixes
Connector registration failed … Error: 'The registration request was denied.' (not an Application Administrator)Connector installer / Application logMicrosoft Entra application proxy errors: connector events, gateway messages and fixes
Connector status Inactive: uninstalled or unused connectors are removed after 10 daysEntra admin center (Connectors)Microsoft Entra application proxy errors: connector events, gateway messages and fixes
Event ID 1000: Connector re-registration failed: The Connector trust certificate expired.Connector Admin logMicrosoft Entra application proxy errors: connector events, gateway messages and fixes
Event ID 12008: exceeded the maximum permitted Kerberos authentication attempts to the backend serverConnector Admin logMicrosoft Entra application proxy errors: connector events, gateway messages and fixes
Event ID 12027: logged with KCD sign-in failures; correlate it with the browser's TransactionIDConnector Admin logMicrosoft Entra application proxy errors: connector events, gateway messages and fixes
Event ID 13016: no Kerberos ticket, no UPN in the edge token or access cookieConnector Admin logMicrosoft Entra application proxy errors: connector events, gateway messages and fixes
Event ID 13019: can't retrieve a Kerberos ticket on behalf of the user (general API error)Connector Admin logMicrosoft Entra application proxy errors: connector events, gateway messages and fixes
Event ID 13020: can't retrieve a Kerberos ticket, the back-end server SPN isn't definedConnector Admin logMicrosoft Entra application proxy errors: connector events, gateway messages and fixes
Event ID 13022: the back-end server answers Kerberos authentication attempts with HTTP 401Connector Admin logMicrosoft Entra application proxy errors: connector events, gateway messages and fixes
Failed to retrieve the current execution policy for running PowerShell scripts.Connector installer / Application logMicrosoft Entra application proxy errors: connector events, gateway messages and fixes
Failed to validate chain of certificate: connector proxy set in the .exe.config but no system proxyConnector advanced logMicrosoft Entra application proxy errors: connector events, gateway messages and fixes
Forbidden: the user isn't authorized in Entra ID or on the back-end applicationBrowser error page (Status Code)Microsoft Entra application proxy errors: connector events, gateway messages and fixes
Forbidden: This corporate app can't be accessed OR The user could not be authorized.Browser error pageMicrosoft Entra application proxy errors: connector events, gateway messages and fixes
Gateway time-out: the application proxy service can't reach a working connectorBrowser error page (Status Code)Microsoft Entra application proxy errors: connector events, gateway messages and fixes
HTTP 404 for images or scripts: content lives outside the published pathBrowser developer tools (F12)Microsoft Entra application proxy errors: connector events, gateway messages and fixes
InternalServerError: This corporate app can't be accessed right now. Please try again later… ConnectorError:Unauthorized.Browser error pageMicrosoft Entra application proxy errors: connector events, gateway messages and fixes
No admin sign-in pop-up during connector install: pop-ups or JavaScript blockedConnector installerMicrosoft Entra application proxy errors: connector events, gateway messages and fixes
NTLM blob TlRMTVNTUAAB in the back-end response: the application isn't offering KerberosFiddler / F12 on the connector hostMicrosoft Entra application proxy errors: connector events, gateway messages and fixes
The connector was unable to connect to the service due to networking issues.Application log (private network connector)Microsoft Entra application proxy errors: connector events, gateway messages and fixes
The website cannot display the page. (IWA or OWA app: wrong SPN, guest or Microsoft account)BrowserMicrosoft Entra application proxy errors: connector events, gateway messages and fixes
This corporate app can't be accessed right now. Please try again later… The connector timed out.Browser error pageMicrosoft Entra application proxy errors: connector events, gateway messages and fixesDevice registration codes
Every code in the quick reference “Entra hybrid join and device registration error codes: dsregcmd, DSREG and 0x801C”: what it means, the usual cause and the first check. Open the quick reference
0x801c001f DSREG_AUTOJOIN_DISC_WAIT_TIMEOUT: discovery timed outdsregcmd /status (Client ErrorCode)Troubleshooting Microsoft Entra hybrid join with dsregcmd /status
0x801c0002 DSREG_E_DEVICE_AUTHENTICATION_ERROR: AuthenticationError from the registration servicedsregcmd /status (Client ErrorCode)Troubleshooting Microsoft Entra hybrid join with dsregcmd /status
0x801c003a DSREG_DISCOVERY_TENANT_NOT_FOUND: wrong tenant ID in the SCP or no active subscriptiondsregcmd /status (Client ErrorCode)Configuring Microsoft Entra hybrid join: SCP, targeted deployment and validation
0x801c003d DSREG_AUTOJOIN_USERREALM_DISCOVERY_FAILED: managed or federated couldn't be determineddsregcmd /status (Client ErrorCode)Troubleshooting Microsoft Entra hybrid join with dsregcmd /status
0x801c0006 DSREG_E_DEVICE_INTERNALSERVICE_ERROR: error response from the registration servicedsregcmd /status (Client ErrorCode)Troubleshooting Microsoft Entra hybrid join with dsregcmd /status
0x801c0025 DSREG_SERVER_BUSY: HTTP 503 from the device registration servicedsregcmd /status (Client ErrorCode)Entra hybrid join and device registration error codes: dsregcmd, DSREG and 0x801C
0x80072ee7 WININET_E_NAME_NOT_RESOLVED: registration server name couldn't be resolveddsregcmd /status (Client ErrorCode)Entra hybrid join and device registration error codes: dsregcmd, DSREG and 0x801C
0x80072efd WININET_E_CANNOT_CONNECT: connection to the registration service faileddsregcmd /status (DRS Discovery Test)Entra hybrid join and device registration error codes: dsregcmd, DSREG and 0x801C
0x80072efe WININET_E_CONNECTION_ABORTED: connection to the server ended abnormallydsregcmd /status (Client ErrorCode)Entra hybrid join and device registration error codes: dsregcmd, DSREG and 0x801C
0x80072f8f WININET_E_DECODING_FAILED: response couldn't be decodeddsregcmd /status (DRS Discovery Test)Entra hybrid join and device registration error codes: dsregcmd, DSREG and 0x801C
0x8007000d E_INVALIDDATA: registration response couldn't be parsed (proxy page)dsregcmd /status (Client ErrorCode)Entra hybrid join and device registration error codes: dsregcmd, DSREG and 0x801C
0x80090031 NTE_AUTHENTICATION_IGNORED: the TPM is locked outdsregcmd /status (Client ErrorCode)Entra hybrid join and device registration error codes: dsregcmd, DSREG and 0x801C
0x80280036 TPM_E_NOTFIPS: TPM in FIPS mode isn't supporteddsregcmd /status (Client ErrorCode)Entra hybrid join and device registration error codes: dsregcmd, DSREG and 0x801C
0x80290407 TPM_E_PCP_INTERNAL_ERROR: generic TPM error during joindsregcmd /status (Client ErrorCode)Entra hybrid join and device registration error codes: dsregcmd, DSREG and 0x801C
0xc00cee4f WC_E_DTDPROHIBITED: WS-Trust XML response included a DTDdsregcmd /status (Attempt Status)Entra hybrid join and device registration error codes: dsregcmd, DSREG and 0x801C
0xc00000d0 STATUS_REQUEST_NOT_ACCEPTED: HTTP 400 from Entra ID or WS-Trustdsregcmd /status (Attempt Status)Primary Refresh Token (PRT) explained: fixing SSO and repeated sign-in prompts
0xc000006a STATUS_WRONG_PASSWORD: PRT request rejected (HTTP 400)dsregcmd /status (Attempt Status)Primary Refresh Token (PRT) explained: fixing SSO and repeated sign-in prompts
0xc000023c / 0xc00000be / 0xc00000c4: network unreachable, bad path or unexpected network errordsregcmd /status (Attempt Status)Primary Refresh Token (PRT) explained: fixing SSO and repeated sign-in prompts
0xc00484c1 AAD_CLOUDAP_E_WSTRUST_SAML_TOKENS_ARE_EMPTY: error from the WS-Trust endpointdsregcmd /status (Attempt Status)Entra hybrid join and device registration error codes: dsregcmd, DSREG and 0x801C
0xc004844c AAD_CLOUDAP_E_OAUTH_USERNAME_IS_MALFORMED: UPN not in the expected formatdsregcmd /status (Attempt Status)Primary Refresh Token (PRT) explained: fixing SSO and repeated sign-in prompts
0xc004848b AAD_CLOUDAP_E_HTTP_PASSWORD_URI_IS_EMPTY: MEX response has no password URLsdsregcmd /status (Attempt Status)Entra hybrid join and device registration error codes: dsregcmd, DSREG and 0x801C
0xc004848c AAD_CLOUDAP_E_HTTP_CERTIFICATE_URI_IS_EMPTY: MEX response has no certificate URLsdsregcmd /status (Attempt Status)Entra hybrid join and device registration error codes: dsregcmd, DSREG and 0x801C
0xc0048442 AAD_CLOUDAP_E_OAUTH_USER_SID_IS_EMPTY: user SID missing from the ID tokendsregcmd /status (Attempt Status)Entra hybrid join and device registration error codes: dsregcmd, DSREG and 0x801C
0xcaa82ee2 ERROR_ADAL_INTERNET_TIMEOUT: network timeout during federated joinUser Device Registration Admin log (305)Entra hybrid join and device registration error codes: dsregcmd, DSREG and 0x801C
0xcaa82efd ERROR_ADAL_INTERNET_CANNOT_CONNECT: can't connect to login.microsoftonline.comUser Device Registration Admin log (305)Entra hybrid join and device registration error codes: dsregcmd, DSREG and 0x801C
0xcaa82efe ERROR_ADAL_INTERNET_CONNECTION_ABORTED: authorization endpoint connection abortedUser Device Registration Admin log (305)Entra hybrid join and device registration error codes: dsregcmd, DSREG and 0x801C
0xcaa82f8f ERROR_ADAL_INTERNET_SECURE_FAILURE: server TLS certificate couldn't be validatedUser Device Registration Admin log (305)Entra hybrid join and device registration error codes: dsregcmd, DSREG and 0x801C
0xcaa1002d ERROR_ADAL_OPERATION_PENDING: general ADAL failureUser Device Registration Admin log (305)Entra hybrid join and device registration error codes: dsregcmd, DSREG and 0x801C
0xcaa9002c ERROR_ADAL_FAILED_TO_PARSE_XML: federation service didn't return XMLUser Device Registration Admin log (305)Entra hybrid join and device registration error codes: dsregcmd, DSREG and 0x801C
0xcaa20003 ERROR_ADAL_SERVER_ERROR_INVALID_GRANT: Entra ID rejected the on-premises SAML tokenUser Device Registration Admin log (305)Entra hybrid join and device registration error codes: dsregcmd, DSREG and 0x801C
0xcaa90006 ERROR_ADAL_WSTRUST_TOKEN_REQUEST_FAIL: error from the token endpointUser Device Registration Admin log (305)Entra hybrid join and device registration error codes: dsregcmd, DSREG and 0x801C
0xcaa90014 ERROR_ADAL_WSTRUST_REQUEST_SECURITYTOKEN_FAILED: WS-Trust fault, no assertionUser Device Registration Admin log (305)Entra hybrid join and device registration error codes: dsregcmd, DSREG and 0x801C
0xcaa90017 ERROR_ADAL_PROTOCOL_NOT_SUPPORTED: the federation protocol isn't WS-TrustUser Device Registration Admin log (305)Entra hybrid join and device registration error codes: dsregcmd, DSREG and 0x801C
0xcaa90023 ERROR_ADAL_COULDNOT_DISCOVER_USERNAME_PASSWORD_ENDPOINTUser Device Registration Admin log (305)Entra hybrid join and device registration error codes: dsregcmd, DSREG and 0x801C
AadRecoveryEnabled : YES: device keys unusable, device marked for recoverydsregcmd /status (Diagnostic Data)Entra hybrid join and device registration error codes: dsregcmd, DSREG and 0x801C
AD Configuration Test : FAIL: the service connection point can't be read or is wrongdsregcmd /status (Diagnostic Data)Configuring Microsoft Entra hybrid join: SCP, targeted deployment and validation
AD Connectivity Test : FAIL: no line of sight to a domain controller (pre-check)dsregcmd /status (Diagnostic Data)Troubleshooting Microsoft Entra hybrid join with dsregcmd /status
AuthenticationError: The verification of the target computer's SID (sync join)dsregcmd /status (Server Message)Troubleshooting Microsoft Entra hybrid join with dsregcmd /status
DeviceAuthStatus : ERROR: the device health check couldn't rundsregcmd /status (Device Details)Entra hybrid join and device registration error codes: dsregcmd, DSREG and 0x801C
DirectoryError: AADSTS90002: Tenant UUID not found. (sync join)dsregcmd /status (Server Message)Configuring Microsoft Entra hybrid join: SCP, targeted deployment and validation
DirectoryError: Your request is throttled temporarily. Please try after 300 seconds.dsregcmd /status (Server Message)Entra hybrid join and device registration error codes: dsregcmd, DSREG and 0x801C
DRS Connectivity Test : FAIL: no connection to the device registration servicedsregcmd /status (Diagnostic Data)Troubleshooting Microsoft Entra hybrid join with dsregcmd /status
DRS Discovery Test : FAIL [code/sub-code]: discovery or user realm request faileddsregcmd /status (Diagnostic Data)Troubleshooting Microsoft Entra hybrid join with dsregcmd /status
Event ID 201: discovery sub-error (Windows 10 before version 1803)User Device Registration Admin logTroubleshooting Microsoft Entra hybrid join with dsregcmd /status
Event ID 204: join-phase error (Windows 10 before version 1803)User Device Registration Admin logTroubleshooting Microsoft Entra hybrid join with dsregcmd /status
Event ID 220: Windows can't access the computer object in Active Directory (1312 / 1317)User Device Registration Admin logActive Directory replication errors: repadmin and dcdiag codes with causes and fixes
Event ID 1006 / 1007: start and end of PRT acquisition (1007 has the final error)Event Viewer (AAD Analytic)Primary Refresh Token (PRT) explained: fixing SSO and repeated sign-in prompts
Event ID 1022: URL accessed during PRT acquisitionEvent Viewer (AAD Analytic)Primary Refresh Token (PRT) explained: fixing SSO and repeated sign-in prompts
Event ID 1084: network sub-error during PRT acquisitionEvent Viewer (AAD Operational)Primary Refresh Token (PRT) explained: fixing SSO and repeated sign-in prompts
Event ID 1144: UPN sent during PRT acquisitionEvent Viewer (AAD Analytic)Primary Refresh Token (PRT) explained: fixing SSO and repeated sign-in prompts
KeySignTest: : MUST Run elevated to test.dsregcmd /status (Device State)Entra hybrid join and device registration error codes: dsregcmd, DSREG and 0x801C
Token acquisition Test : FAIL: no Entra token for a federated joindsregcmd /status (Diagnostic Data)Troubleshooting Microsoft Entra hybrid join with dsregcmd /status
Virtual Desktop : INVALID: VDI device metadata present but not set correctlydsregcmd /status (Device Details)Entra hybrid join and device registration error codes: dsregcmd, DSREG and 0x801CDomain join errors
Every code in the quick reference “Active Directory domain join errors: NetSetup.log codes and messages with fixes”: what it means, the usual cause and the first check. Open the quick reference
0x3a: The specified server cannot perform the requested operationJoin dialog / NetSetup.logActive Directory domain join errors: NetSetup.log codes and messages with fixes
0x5 ERROR_ACCESS_DENIED: Access is denied.Join dialog / NetSetup.logActive Directory domain join errors: NetSetup.log codes and messages with fixes
0x6bf / 0xc002001c: The remote procedure call failed and did not executeJoin dialog / NetSetup.logActive Directory domain join errors: NetSetup.log codes and messages with fixes
0x6d9: There are no more endpoints available from the endpoint mapperJoin dialog / NetSetup.logActive Directory domain join errors: NetSetup.log codes and messages with fixes
0x8b0 NERR_UserExists: The account already exists.NetSetup.logActive Directory domain join errors: NetSetup.log codes and messages with fixes
0x40 ERROR_NETNAME_DELETED: The specified network name is no longer available.Join dialog / NetSetup.logActive Directory domain join errors: NetSetup.log codes and messages with fixes
0x52e: Logon failure: unknown user name or bad passwordJoin dialog / NetSetup.logActive Directory domain join errors: NetSetup.log codes and messages with fixes
0x54b: The specified domain either does not exist or could not be contacted.Join dialog / NetSetup.logActive Directory domain join errors: NetSetup.log codes and messages with fixes
0x216d: You have exceeded the maximum number of computer accounts you are allowed to create in this domain.Join dialog / NetSetup.logActive Directory domain join errors: NetSetup.log codes and messages with fixes
0x0000232A: the DNS name of the domain can't be resolvedJoin dialog > DetailsActive Directory domain join errors: NetSetup.log codes and messages with fixes
0x0000232B RCODE_NAME_ERROR: DNS name does not exist (SRV _ldap._tcp.dc._msdcs)Join dialog > DetailsActive Directory domain join errors: NetSetup.log codes and messages with fixes
0x534: No mapping between account names and security IDs was doneNetSetup.logActive Directory domain join errors: NetSetup.log codes and messages with fixes
0x569: Logon failure: the user has not been granted the requested logon type at this computerJoin dialog / NetSetup.logActive Directory domain join errors: NetSetup.log codes and messages with fixes
0x574: Logon failure: The target account name is incorrectJoin dialog / NetSetup.logActive Directory domain join errors: NetSetup.log codes and messages with fixes
0x576 ERROR_TIME_SKEW: There is a time and/or date difference between the client and server.Join dialog / NetSetup.logActive Directory domain join errors: NetSetup.log codes and messages with fixes
0xa8b: An attempt to resolve the DNS name of a DC in the domain being joined has failedJoin dialog / NetSetup.logActive Directory domain join errors: NetSetup.log codes and messages with fixes
0xaac: An account with the same name exists in Active Directory. Re-using the account was blocked by security policy.Join dialog / NetSetup.logActive Directory domain join errors: NetSetup.log codes and messages with fixes
An Active Directory Domain Controller (AD DC) for the domain could not be contactedJoin dialog (System Properties)Active Directory domain join errors: NetSetup.log codes and messages with fixes
An operation was attempted on a nonexistent network connectionJoin dialog (System Properties)Active Directory domain join errors: NetSetup.log codes and messages with fixes
Can't join this domain. Contact your IT admin for more info.Settings > Accounts > Access work or schoolActive Directory domain join errors: NetSetup.log codes and messages with fixes
Multiple connections to a server or shared resource by the same user, using more than one user name, are not allowed.Join dialog (System Properties)Active Directory domain join errors: NetSetup.log codes and messages with fixes
Network name cannot be foundJoin dialog (System Properties)Active Directory domain join errors: NetSetup.log codes and messages with fixes
No more connections can be made to this remote computer at this timeJoin dialog (System Properties)Active Directory domain join errors: NetSetup.log codes and messages with fixes
Not enough storage is available to complete this operation (Kerberos token too large)Join dialog (System Properties)Active Directory domain join errors: NetSetup.log codes and messages with fixes
The account is not authorized to login from this stationJoin dialog (System Properties)Active Directory domain join errors: NetSetup.log codes and messages with fixes
The account specified for this service is different from the account specified for other services running in the same processJoin dialog (System Properties)Active Directory domain join errors: NetSetup.log codes and messages with fixes
The directory service has exhausted the pool of relative identifiersJoin dialog (System Properties)Active Directory domain join errors: NetSetup.log codes and messages with fixes
The format of the specified network name is invalidJoin dialog (System Properties)Active Directory domain join errors: NetSetup.log codes and messages with fixesEntra Connect sync errors
Every code in the quick reference “Microsoft Entra Connect sync errors: export errors, event IDs and Cloud Sync quarantine”: what it means, the usual cause and the first check. Open the quick reference
Agent times out or certificate isn't valid: provisioning agent registration failsCloud Sync agent installationMicrosoft Entra Connect sync errors: export errors, event IDs and Cloud Sync quarantine
AttributeUpdateNotAllowed (96): OnPremisesObjectIdentifier cannot be changed unless its current value is nullSynchronization Service Manager (export)Entra Connect sync errors: duplicates, InvalidSoftMatch and objects that never sync
AttributeValueMustBeUnique: mail, proxyAddresses, signInName or UPN already used by another objectSynchronization Service Manager (export)Entra Connect sync errors: duplicates, InvalidSoftMatch and objects that never sync
AzureDirectoryServiceAuthorizationFailed: quarantine error, sync service principal missingEntra admin center (Cloud sync)Microsoft Entra Connect sync errors: export errors, event IDs and Cloud Sync quarantine
completed-export-errors: export run finished but some objects were rejectedSynchronization Service Manager (Operations)Entra Connect sync errors: duplicates, InvalidSoftMatch and objects that never sync
Deletes blocked by the directory's accidental deletion prevention (Connect and Cloud Sync)Cloud Sync provisioning logsMicrosoft Entra Cloud Sync vs Connect Sync: choosing the right tool and migrating safely
DeletingCloudOnlyObjectNotAllowed (Error Type 114): This synchronization operation, Delete, isn't validSynchronization Service Manager (export)Microsoft Entra Connect sync errors: export errors, event IDs and Cloud Sync quarantine
Event ID 611: error during password hash sync for a domainApplication log (Directory Synchronization)Microsoft Entra Connect sync errors: export errors, event IDs and Cloud Sync quarantine
Event ID 613: password hash sync paused until directory full sync completesApplication log (Directory Synchronization)Microsoft Entra Connect sync errors: export errors, event IDs and Cloud Sync quarantine
Event ID 616: password hash sync connection to preferred DC failedApplication log (Directory Synchronization)Microsoft Entra Connect sync errors: export errors, event IDs and Cloud Sync quarantine
Event ID 621: full password hash sync attempt failedApplication log (Directory Synchronization)Microsoft Entra Connect sync errors: export errors, event IDs and Cloud Sync quarantine
Event ID 652: error during password hash sync operationApplication log (Directory Synchronization)Microsoft Entra Connect sync errors: export errors, event IDs and Cloud Sync quarantine
Event ID 654 missing: no password hash sync heartbeatApplication log (Directory Synchronization)Microsoft Entra Connect sync errors: export errors, event IDs and Cloud Sync quarantine
Event ID 655: error during password hash sync pingApplication log (Directory Synchronization)Microsoft Entra Connect sync errors: export errors, event IDs and Cloud Sync quarantine
Event ID 656 / 657: password hash sync request and response messagesApplication log (Directory Synchronization)Microsoft Entra Connect sync errors: export errors, event IDs and Cloud Sync quarantine
Event ID 6329 0x8023061f: password synchronization isn't enabled on this Management AgentApplication log (ADSync)Microsoft Entra Connect sync errors: export errors, event IDs and Cloud Sync quarantine
Event ID 6329 0x80230619: A restriction prevents the password from being changed to the current one specifiedApplication log (ADSync)Self-service password reset and password writeback: fixing the usual failures
Event ID 6329: The server doesn't contain the LDAP password policy controlApplication log (ADSync)Microsoft Entra Connect sync errors: export errors, event IDs and Cloud Sync quarantine
Event ID 6800: password writeback endpoint didn't startApplication log (Entra Connect server)Microsoft Entra Connect sync errors: export errors, event IDs and Cloud Sync quarantine
Event ID 31003 / 31008: PasswordResetFail / ChangePasswordFailApplication log (PasswordResetService)Self-service password reset and password writeback: fixing the usual failures
Event ID 31016 WriteBackServiceStopped: password writeback service stoppedApplication log (PasswordResetService)Self-service password reset and password writeback: fixing the usual failures
Event ID 31034 ServiceBusListenerError: can't connect to the tenant's Service Bus listenerApplication log (PasswordResetService)Self-service password reset and password writeback: fixing the usual failures
Event ID 32002: Error Connecting to ServiceBus. The token provider was unable to provide a security token.Application log (PasswordResetService)Self-service password reset and password writeback: fixing the usual failures
Event ID 32009 AuthTokenError: Error getting auth token.Application log (PasswordResetService)Self-service password reset and password writeback: fixing the usual failures
Event ID 33001 ADUnKnownError: unknown error returned by Active DirectoryApplication log (PasswordResetService)Microsoft Entra Connect sync errors: export errors, event IDs and Cloud Sync quarantine
Event ID 33002 ADUserNotFoundError: user not found in the on-premises directoryApplication log (PasswordResetService)Microsoft Entra Connect sync errors: export errors, event IDs and Cloud Sync quarantine
Event ID 33003 ADMutliMatchError: two on-premises users share the same cloud anchorApplication log (PasswordResetService)Microsoft Entra Connect sync errors: export errors, event IDs and Cloud Sync quarantine
Event ID 33004 ADPermissionsError: ADMA account can't set the password on this accountApplication log (PasswordResetService)Self-service password reset and password writeback: fixing the usual failures
Event ID 33005 / 33006: on-premises account disabled / locked outApplication log (PasswordResetService)Self-service password reset and password writeback: fixing the usual failures
Event ID 33008 ADPasswordPolicyError: password doesn't meet the domain's password policyApplication log (PasswordResetService)Self-service password reset and password writeback: fixing the usual failures
Existing Admin Role Conflict: soft match to a cloud user with an admin role isn't allowedSynchronization Service Manager (export)Entra Connect sync errors: duplicates, InvalidSoftMatch and objects that never sync
Export to Microsoft Entra ID was Stopped. Accidental delete threshold was reachedMicrosoft Entra Connect HealthMicrosoft Entra Connect Health: installing the agents and acting on sync alerts
FilteredByTarget: password set to User must change password at next logon, not syncedObject password sync logMicrosoft Entra Connect sync errors: export errors, event IDs and Cloud Sync quarantine
Hard match operation blocked due to security hardeningSynchronization Service Manager (export)Entra Connect sync errors: duplicates, InvalidSoftMatch and objects that never sync
Health Service data is not up to date: Connect Health agent stopped reportingMicrosoft Entra Connect HealthMicrosoft Entra Connect Health: installing the agents and acting on sync alerts
hr=800700CE, message=The filename or extension is too longApplication log (Entra Connect server)Microsoft Entra Connect sync errors: export errors, event IDs and Cloud Sync quarantine
hr=80230402: duplicated entries with the same anchorApplication log (Entra Connect server)Microsoft Entra Connect sync errors: export errors, event IDs and Cloud Sync quarantine
IdentityDataValidationFailed / DataValidationFailed: data fails Entra ID validationSynchronization Service Manager (export)Entra Connect sync errors: duplicates, InvalidSoftMatch and objects that never sync
InvalidHardMatch (103): the cloud user with privileged roles is not allowed to be taken overSynchronization Service Manager (export)Entra Connect sync errors: duplicates, InvalidSoftMatch and objects that never sync
InvalidSoftMatch: soft match found an object with a different immutableIdSynchronization Service Manager (export)Entra Connect sync errors: duplicates, InvalidSoftMatch and objects that never sync
LargeObject / ExceededAllowedLength: object or attribute over the size, length or count limitSynchronization Service Manager (export)Entra Connect sync errors: duplicates, InvalidSoftMatch and objects that never sync
NoTargetConnection: no object in the metaverse or Entra connector spaceObject password sync logMicrosoft Entra Connect sync errors: export errors, event IDs and Cloud Sync quarantine
ObjectTypeMismatch: soft match found an object of a different typeSynchronization Service Manager (export)Entra Connect sync errors: duplicates, InvalidSoftMatch and objects that never sync
Password access violation: change request contains one or more cloud-only user objectsSynchronization Service Manager (export)Microsoft Entra Connect sync errors: export errors, event IDs and Cloud Sync quarantine
Password Hash Synchronization has stopped workingMicrosoft Entra Connect HealthMicrosoft Entra Connect Health: installing the agents and acting on sync alerts
Quarantine: Cloud Sync job quarantined after calls to the target fail consistentlyEntra admin center (Cloud sync)Microsoft Entra Connect sync errors: export errors, event IDs and Cloud Sync quarantine
Service 'Microsoft Entra Provisioning Agent' failed to start.Cloud Sync agent serverMicrosoft Entra Connect sync errors: export errors, event IDs and Cloud Sync quarantine
Skipped: object out of scope (identity shows only a Source ID)Cloud Sync provisioning logsMicrosoft Entra Connect sync errors: export errors, event IDs and Cloud Sync quarantine
SSPR_0029: We are unable to reset your password due to an error in your on-premises configuration.Password reset pageSelf-service password reset and password writeback: fixing the usual failures
stopped-deletion-threshold-exceeded: export stopped, too many deletes pendingSynchronization Service Manager (Operations)Filtering Microsoft Entra Connect Sync by OU, group and attribute without deleting users
TargetNotExportedToDirectory: Entra connector space object not yet exportedObject password sync logMicrosoft Entra Connect sync errors: export errors, event IDs and Cloud Sync quarantineEntra Domain Services alerts
Every code in the quick reference “Microsoft Entra Domain Services alerts: every AADDS alert ID with its fix”: what it means, the usual cause and the first check. Open the quick reference
AADDS100 Missing directory: The Microsoft Entra directory associated with your managed domain may have been deleted.Domain Services Health pageMicrosoft Entra Domain Services alerts: every AADDS alert ID with its fix
AADDS101 Secure LDAP network configuration: access to port 636 is not locked down using a network security groupDomain Services Health pageMicrosoft Entra Domain Services alerts: every AADDS alert ID with its fix
AADDS101: Microsoft Entra Domain Services cannot be enabled in an Azure AD B2C Directory.Domain Services Health pageMicrosoft Entra Domain Services alerts: every AADDS alert ID with its fix
AADDS102 Service principal not found: a service principal required for Domain Services was deletedDomain Services Health pageMicrosoft Entra Domain Services alerts: every AADDS alert ID with its fix
AADDS103 Address is in a public IP range: the virtual network uses a public IP address rangeDomain Services Health pageMicrosoft Entra Domain Services alerts: every AADDS alert ID with its fix
AADDS104 Network error: Microsoft is unable to reach the domain controllers for this managed domain.Domain Services Health pageMicrosoft Entra Domain Services alerts: every AADDS alert ID with its fix
AADDS105 Password synchronization application is out of date: sync service principal deleted and recreatedDomain Services Health pageMicrosoft Entra Domain Services alerts: every AADDS alert ID with its fix
AADDS106 Your Azure subscription is not found: the managed domain's subscription was deletedDomain Services Health pageMicrosoft Entra Domain Services alerts: every AADDS alert ID with its fix
AADDS107 Your Azure subscription is disabled: the managed domain's subscription is not activeDomain Services Health pageMicrosoft Entra Domain Services alerts: every AADDS alert ID with its fix
AADDS108 Subscription moved directories: the subscription was moved to another directoryDomain Services Health pageMicrosoft Entra Domain Services alerts: every AADDS alert ID with its fix
AADDS109 Resources for your managed domain cannot be found: a required resource was deletedDomain Services Health pageMicrosoft Entra Domain Services alerts: every AADDS alert ID with its fix
AADDS110 The subnet associated with your managed domain is fullDomain Services Health pageMicrosoft Entra Domain Services alerts: every AADDS alert ID with its fix
AADDS111 Service principal unauthorized: a Domain Services service principal can't manage subscription resourcesDomain Services Health pageMicrosoft Entra Domain Services alerts: every AADDS alert ID with its fix
AADDS112 Not enough IP address in the managed domain: the subnet may not have enough IP addressesDomain Services Health pageMicrosoft Entra Domain Services alerts: every AADDS alert ID with its fix
AADDS113 Resources are unrecoverable: resources in an unexpected state that can't be recoveredDomain Services Health pageMicrosoft Entra Domain Services alerts: every AADDS alert ID with its fix
AADDS114 Subnet invalid: the subnet selected for deployment is invalid and cannot be usedDomain Services Health pageMicrosoft Entra Domain Services alerts: every AADDS alert ID with its fix
AADDS115 Resources are locked: network resources can't be changed because the target scope is lockedDomain Services Health pageMicrosoft Entra Domain Services alerts: every AADDS alert ID with its fix
AADDS116 Resources are unusable: network resources can't be changed because of policy restrictionsDomain Services Health pageMicrosoft Entra Domain Services alerts: every AADDS alert ID with its fix
AADDS120: The managed domain has encountered an error onboarding one or more custom attributesDomain Services Health pageMicrosoft Entra Domain Services alerts: every AADDS alert ID with its fix
AADDS122 Group policy object conflict detected (preview)Domain Services Health pageMicrosoft Entra Domain Services alerts: every AADDS alert ID with its fix
AADDS123 Kerberos RC4 usage detected for service ticket issuance: can block CVE-2026-20833 hardeningDomain Services Health pageKerberos error codes: KDC_ERR and KRB_AP_ERR results in events 4768, 4769 and 4771
AADDS500 Synchronization has not completed in a while: last synchronized with Microsoft Entra ID on [date]Domain Services Health pageMicrosoft Entra Domain Services alerts: every AADDS alert ID with its fix
AADDS501 A backup has not been taken in a while: The managed domain was last backed up on [date].Domain Services Health pageMicrosoft Entra Domain Services alerts: every AADDS alert ID with its fix
AADDS502 Secure LDAP certificate expiring: the secure LDAP certificate will expire on [date]Domain Services Health pageMicrosoft Entra Domain Services alerts: every AADDS alert ID with its fix
AADDS503 Suspension due to disabled subscription: the Azure subscription is not activeDomain Services Health pageMicrosoft Entra Domain Services alerts: every AADDS alert ID with its fix
AADDS504 Suspension due to an invalid configuration: domain controllers not managed for a long timeDomain Services Health pageMicrosoft Entra Domain Services alerts: every AADDS alert ID with its fix
AADDS600 Unresolved health alerts for 30 days: unresolved alerts block critical security updatesDomain Services Health pageMicrosoft Entra Domain Services alerts: every AADDS alert ID with its fix
Last backup was taken more than 14 days ago.Domain Services Health (Backup monitor)Microsoft Entra Domain Services alerts: every AADDS alert ID with its fix
Needs attention (critical): one or more critical alerts must be addressedDomain Services Health (status)Microsoft Entra Domain Services alerts: every AADDS alert ID with its fix
Suspended: domain controllers deprovisioned after a critical alert stayed open for 15 daysDomain Services Health (status)Microsoft Entra Domain Services alerts: every AADDS alert ID with its fixGroup Policy errors & events
Every code in the quick reference “Group Policy processing errors: event IDs 1058, 1030, 1129 and more with fixes”: what it means, the usual cause and the first check. Open the quick reference
Computer policy could not be updated successfully. The following errors were encountered:gpupdate /forceGroup Policy processing errors: event IDs 1058, 1030, 1129 and more with fixes
Event ID 1002 (GroupPolicy): processing failed because of a system allocation failureEvent Viewer (System log)Group Policy processing errors: event IDs 1058, 1030, 1129 and more with fixes
Event ID 1006 (GroupPolicy): could not authenticate to Active Directory (LDAP Bind function call failed)Event Viewer (System log)Group Policy processing errors: event IDs 1058, 1030, 1129 and more with fixes
Event ID 1006 with error code 5: access is denied (no permission to access Active Directory)Event Viewer (System log, Details tab)Group Policy processing errors: event IDs 1058, 1030, 1129 and more with fixes
Event ID 1006 with error code 49: invalid credentials (password expired while signed in)Event Viewer (System log, Details tab)Group Policy processing errors: event IDs 1058, 1030, 1129 and more with fixes
Event ID 1006 with error code 258: timeout (usually DNS configuration)Event Viewer (System log, Details tab)Group Policy processing errors: event IDs 1058, 1030, 1129 and more with fixes
Event ID 1030 (GroupPolicy): Windows attempted to retrieve new Group Policy settings and failedEvent Viewer (System log)Group Policy processing errors: event IDs 1058, 1030, 1129 and more with fixes
Event ID 1053 (GroupPolicy): Windows could not resolve the user nameEvent Viewer (System log)Group Policy processing errors: event IDs 1058, 1030, 1129 and more with fixes
Event ID 1053 with error code 5: access is denied (password expired or changed while signed in)Event Viewer (System log, Details tab)Group Policy processing errors: event IDs 1058, 1030, 1129 and more with fixes
Event ID 1053 with error code 14: not enough storage is available to complete this operationEvent Viewer (System log, Details tab)Group Policy processing errors: event IDs 1058, 1030, 1129 and more with fixes
Event ID 1053 with error code 525: the specified user doesn't exist (no read access to the OU)Event Viewer (System log, Details tab)Group Policy processing errors: event IDs 1058, 1030, 1129 and more with fixes
Event ID 1053 with error code 1355: the specified domain either doesn't exist or couldn't be contactedEvent Viewer (System log, Details tab)Group Policy processing errors: event IDs 1058, 1030, 1129 and more with fixes
Event ID 1053 with error code 1727: the remote procedure call failed and didn't executeEvent Viewer (System log, Details tab)Group Policy processing errors: event IDs 1058, 1030, 1129 and more with fixes
Event ID 1058 (GroupPolicy): Windows attempted to read gpt.ini from a domain controller and was not successfulEvent Viewer (System log) / gpupdateGroup Policy processing errors: event IDs 1058, 1030, 1129 and more with fixes
Event ID 1058 with error code 3: the system cannot find the path specifiedEvent Viewer (System log, Details tab)Group Policy processing errors: event IDs 1058, 1030, 1129 and more with fixes
Event ID 1058 with error code 5: access is denied reading the gpt.ini pathEvent Viewer (System log, Details tab)Group Policy processing errors: event IDs 1058, 1030, 1129 and more with fixes
Event ID 1058 with error code 53: the network path wasn't foundEvent Viewer (System log, Details tab)Group Policy processing errors: event IDs 1058, 1030, 1129 and more with fixes
Event ID 1097 (GroupPolicy): Windows could not determine the computer account to enforce Group Policy settingsEvent Viewer (System log)Group Policy processing errors: event IDs 1058, 1030, 1129 and more with fixes
Event ID 1129 (GroupPolicy): processing failed because of lack of network connectivity to a domain controllerEvent Viewer (System log)Group Policy processing errors: event IDs 1058, 1030, 1129 and more with fixes
Event ID 5016 ErrorCode 2147483658 (E_PENDING) for audit policy: expected, not a failureGroupPolicy/Operational logGroup Policy processing errors: event IDs 1058, 1030, 1129 and more with fixes
Event ID 7017 (GroupPolicy): the system call to access the specified file failedGroupPolicy/Operational log / gpresultGroup Policy processing errors: event IDs 1058, 1030, 1129 and more with fixes
GetLdapHandle: Failed to connect <DC> with 81gpsvc.logGroup Policy processing errors: event IDs 1058, 1030, 1129 and more with fixes
SceCli 1202 0x2: The system cannot find the file specifiedEvent Viewer (Application log)Group Policy processing errors: event IDs 1058, 1030, 1129 and more with fixes
SceCli 1202 0x5: Access denied (can't update a service's access control list)Event Viewer (Application log)Group Policy processing errors: event IDs 1058, 1030, 1129 and more with fixes
SceCli 1202 0x6fc: The trust relationship between the primary domain and the trusted domain failedEvent Viewer (Application log)Group Policy processing errors: event IDs 1058, 1030, 1129 and more with fixes
SceCli 1202 0x534: No mapping between account names and security IDs was doneEvent Viewer (Application log)Group Policy processing errors: event IDs 1058, 1030, 1129 and more with fixes
Windows could not apply the registry-based policy settings for the Group Policy objectgpupdate /force / Event Viewer (System log)Group Policy processing errors: event IDs 1058, 1030, 1129 and more with fixesKerberos errors
Every code in the quick reference “Kerberos error codes: KDC_ERR and KRB_AP_ERR results in events 4768, 4769 and 4771”: what it means, the usual cause and the first check. Open the quick reference
0x1B KDC_ERR_MUST_USE_USER2USER: server principal valid for user2user onlySecurity log (4769), domain controllerKerberos error codes: KDC_ERR and KRB_AP_ERR results in events 4768, 4769 and 4771
0x1F KRB_AP_ERR_BAD_INTEGRITY: integrity check on decrypted field failedSecurity log (4768 / 4769), domain controllerKerberos error codes: KDC_ERR and KRB_AP_ERR results in events 4768, 4769 and 4771
0x2C KRB_AP_ERR_BADKEYVER: specified version of key is not availableSecurity log / Kerberos event loggingKerberos error codes: KDC_ERR and KRB_AP_ERR results in events 4768, 4769 and 4771
0x2D KRB_AP_ERR_NOKEY: service key not availableSecurity log / Kerberos event loggingKerberos error codes: KDC_ERR and KRB_AP_ERR results in events 4768, 4769 and 4771
0x3C KRB_ERR_GENERIC: generic error (PAC too large, SPN too long, recent password changes)Security log (4768 / 4769), domain controllerKerberos error codes: KDC_ERR and KRB_AP_ERR results in events 4768, 4769 and 4771
0x3E KDC_ERR_CLIENT_NOT_TRUSTED: smart card certificate revoked or CA not trustedSecurity log (4768), domain controllerKerberos error codes: KDC_ERR and KRB_AP_ERR results in events 4768, 4769 and 4771
0x3F KDC_ERR_KDC_NOT_TRUSTED: the KDC certificate could not be verifiedSecurity log / Kerberos event loggingKerberos error codes: KDC_ERR and KRB_AP_ERR results in events 4768, 4769 and 4771
0x6 KDC_ERR_C_PRINCIPAL_UNKNOWN: client not found in Kerberos database (user name doesn't exist)Security log (4768 / 4771), domain controllerKerberos error codes: KDC_ERR and KRB_AP_ERR results in events 4768, 4769 and 4771
0x7 KDC_ERR_S_PRINCIPAL_UNKNOWN: server not found in Kerberos database (SPN missing)Security log (4769) / System log (Kerberos)Kerberos error codes: KDC_ERR and KRB_AP_ERR results in events 4768, 4769 and 4771
0x8 KDC_ERR_PRINCIPAL_NOT_UNIQUE: multiple principal entries (duplicate SPN)Security log (4769), domain controllerKerberos error codes: KDC_ERR and KRB_AP_ERR results in events 4768, 4769 and 4771
0x9 KDC_ERR_NULL_KEY: the client or server has a null keySecurity log (4768 / 4769), domain controllerKerberos error codes: KDC_ERR and KRB_AP_ERR results in events 4768, 4769 and 4771
0x10 KDC_ERR_PADATA_TYPE_NOSUPP: smart card logon, DC certificate or CA problemSecurity log (4771), domain controllerKerberos error codes: KDC_ERR and KRB_AP_ERR results in events 4768, 4769 and 4771
0x12 KDC_ERR_CLIENT_REVOKED: account disabled, expired or locked outSecurity log (4768 / 4771), domain controllerKerberos error codes: KDC_ERR and KRB_AP_ERR results in events 4768, 4769 and 4771
0x17 KDC_ERR_KEY_EXPIRED: password has expiredSecurity log (4771), domain controllerKerberos error codes: KDC_ERR and KRB_AP_ERR results in events 4768, 4769 and 4771
0x18 KDC_ERR_PREAUTH_FAILED: pre-authentication information was invalid (wrong password)Security log (4771), domain controllerKerberos error codes: KDC_ERR and KRB_AP_ERR results in events 4768, 4769 and 4771
0x19 KDC_ERR_PREAUTH_REQUIRED: additional pre-authentication required (usually expected)Security log / Kerberos event loggingKerberos error codes: KDC_ERR and KRB_AP_ERR results in events 4768, 4769 and 4771
0x20 KRB_AP_ERR_TKT_EXPIRED: the ticket has expired (routine)Security log (4769), domain controllerKerberos error codes: KDC_ERR and KRB_AP_ERR results in events 4768, 4769 and 4771
0x21 KRB_AP_ERR_TKT_NYV: the ticket is not yet valid (clocks out of sync)Security log / Kerberos event loggingKerberos error codes: KDC_ERR and KRB_AP_ERR results in events 4768, 4769 and 4771
0x22 KRB_AP_ERR_REPEAT: the request is a replaySecurity log (4768 / 4769), domain controllerKerberos error codes: KDC_ERR and KRB_AP_ERR results in events 4768, 4769 and 4771
0x23 KRB_AP_ERR_NOT_US: the ticket isn't for us (different realm)Security log / Kerberos event loggingKerberos error codes: KDC_ERR and KRB_AP_ERR results in events 4768, 4769 and 4771
0x24 KRB_AP_ERR_BADMATCH: ticket and authenticator don't matchSecurity log (4769), domain controllerKerberos error codes: KDC_ERR and KRB_AP_ERR results in events 4768, 4769 and 4771
0x25 KRB_AP_ERR_SKEW: the clock skew is too greatSecurity log / Kerberos event loggingKerberos error codes: KDC_ERR and KRB_AP_ERR results in events 4768, 4769 and 4771
0x26 KRB_AP_ERR_BADADDR: network address doesn't match the address in the ticketSecurity log / Kerberos event loggingKerberos error codes: KDC_ERR and KRB_AP_ERR results in events 4768, 4769 and 4771
0x29 KRB_AP_ERR_MODIFIED: message stream modified, ticket encrypted with the wrong keySecurity log (4769) / System log (Kerberos)Kerberos error codes: KDC_ERR and KRB_AP_ERR results in events 4768, 4769 and 4771
0x34 KRB_ERR_RESPONSE_TOO_BIG: response too big for UDP, retry with TCPSecurity log / Kerberos event loggingKerberos error codes: KDC_ERR and KRB_AP_ERR results in events 4768, 4769 and 4771
0x40 KDC_ERR_INVALID_SIG: the PKINIT signature is invalidSecurity log (4768), domain controllerKerberos error codes: KDC_ERR and KRB_AP_ERR results in events 4768, 4769 and 4771
0x41 KDC_ERR_KEY_TOO_WEAK: a higher encryption level is neededSecurity log (4768), domain controllerKerberos error codes: KDC_ERR and KRB_AP_ERR results in events 4768, 4769 and 4771
0x44 KDC_ERR_WRONG_REALM: incorrect domain or principal (cross-realm, DNS)Security log (4768 / 4769), domain controllerKerberos error codes: KDC_ERR and KRB_AP_ERR results in events 4768, 4769 and 4771
0xA KDC_ERR_CANNOT_POSTDATE: ticket not eligible for postdatingSecurity log (4768 / 4769), domain controllerKerberos error codes: KDC_ERR and KRB_AP_ERR results in events 4768, 4769 and 4771
0xB KDC_ERR_NEVER_VALID: requested start time is later than end timeSecurity log (4768 / 4769), domain controllerKerberos error codes: KDC_ERR and KRB_AP_ERR results in events 4768, 4769 and 4771
0xC KDC_ERR_POLICY: KDC policy rejects request (logon restrictions)Security log (4768 / 4769), domain controllerKerberos error codes: KDC_ERR and KRB_AP_ERR results in events 4768, 4769 and 4771
0xD KDC_ERR_BADOPTION: KDC cannot accommodate requested option (delegation)Security log (4769), domain controllerKerberos error codes: KDC_ERR and KRB_AP_ERR results in events 4768, 4769 and 4771
0xE KDC_ERR_ETYPE_NOTSUPP: KDC has no support for encryption typeSecurity log (4768 / 4769), domain controllerKerberos error codes: KDC_ERR and KRB_AP_ERR results in events 4768, 4769 and 4771
0xF KDC_ERR_SUMTYPE_NOSUPP: KDC has no support for checksum typeSecurity log (4768 / 4769), domain controllerKerberos error codes: KDC_ERR and KRB_AP_ERR results in events 4768, 4769 and 4771
Event 4: The Kerberos client received a KRB_AP_ERR_MODIFIED error from the serverSystem log (Security-Kerberos), clientKerberos error codes: KDC_ERR and KRB_AP_ERR results in events 4768, 4769 and 4771
Kdcsvc event 39: user certificate valid but could not be mapped to a user in a strong waySystem log (Kdcsvc), domain controllerKerberos error codes: KDC_ERR and KRB_AP_ERR results in events 4768, 4769 and 4771
KDCSVC event 201: RC4 usage will be unsupported, client only supports insecure encryption typesSystem log (Kdcsvc), domain controllerKerberos error codes: KDC_ERR and KRB_AP_ERR results in events 4768, 4769 and 4771
KDCSVC event 202: RC4 usage will be unsupported, service account only has insecure keysSystem log (Kdcsvc), domain controllerKerberos error codes: KDC_ERR and KRB_AP_ERR results in events 4768, 4769 and 4771
KDCSVC event 203: KDC blocked cipher usage, client only supports insecure encryption typesSystem log (Kdcsvc), domain controllerKerberos error codes: KDC_ERR and KRB_AP_ERR results in events 4768, 4769 and 4771
KDCSVC event 204: KDC blocked cipher usage, service account only has insecure keysSystem log (Kdcsvc), domain controllerKerberos error codes: KDC_ERR and KRB_AP_ERR results in events 4768, 4769 and 4771
KDCSVC event 205: explicit cipher enablement in Default Domain Supported Encryption TypesSystem log (Kdcsvc), domain controllerKerberos error codes: KDC_ERR and KRB_AP_ERR results in events 4768, 4769 and 4771
KDCSVC event 206: service is AES-SHA1 only but the client doesn't advertise AES-SHA1System log (Kdcsvc), domain controllerKerberos error codes: KDC_ERR and KRB_AP_ERR results in events 4768, 4769 and 4771
KDCSVC event 207: service is AES-SHA1 only but the service account has no AES-SHA1 keysSystem log (Kdcsvc), domain controllerKerberos error codes: KDC_ERR and KRB_AP_ERR results in events 4768, 4769 and 4771
KDCSVC event 208: KDC intentionally denied cipher usage, client doesn't advertise AES-SHA1System log (Kdcsvc), domain controllerKerberos error codes: KDC_ERR and KRB_AP_ERR results in events 4768, 4769 and 4771
KDCSVC event 209: KDC intentionally denied cipher usage, service account has no AES-SHA1 keysSystem log (Kdcsvc), domain controllerKerberos error codes: KDC_ERR and KRB_AP_ERR results in events 4768, 4769 and 4771LDAP bind errors
Every code in the quick reference “LDAP bind errors in Active Directory: error 49 data codes (52e, 525, 775) and LDAP results”: what it means, the usual cause and the first check. Open the quick reference
0x8007052E: LDAP_INVALID_CREDENTIALS surfaced through ADSI or .NETPowerShell / ADSI / .NETLDAP bind errors in Active Directory: error 49 data codes (52e, 525, 775) and LDAP results
0x8007203A: LDAP_SERVER_DOWN, cannot contact the LDAP serverPowerShell / ADSI / .NETLDAP bind errors in Active Directory: error 49 data codes (52e, 525, 775) and LDAP results
0x80072030: LDAP_NO_SUCH_OBJECT, object does not existPowerShell / ADSI / .NETLDAP bind errors in Active Directory: error 49 data codes (52e, 525, 775) and LDAP results
AcceptSecurityContext error, data 52e: user name or password is incorrect (ERROR_LOGON_FAILURE)LDAP client / ldp.exeLDAP bind errors in Active Directory: error 49 data codes (52e, 525, 775) and LDAP results
AcceptSecurityContext error, data 525: user not found (ERROR_NO_SUCH_USER)LDAP client / ldp.exeLDAP bind errors in Active Directory: error 49 data codes (52e, 525, 775) and LDAP results
AcceptSecurityContext error, data 530: logon hours restriction (ERROR_INVALID_LOGON_HOURS)LDAP client / ldp.exeLDAP bind errors in Active Directory: error 49 data codes (52e, 525, 775) and LDAP results
AcceptSecurityContext error, data 531: not allowed to sign in from this computer (ERROR_INVALID_WORKSTATION)LDAP client / ldp.exeLDAP bind errors in Active Directory: error 49 data codes (52e, 525, 775) and LDAP results
AcceptSecurityContext error, data 532: password expired (ERROR_PASSWORD_EXPIRED)LDAP client / ldp.exeLDAP bind errors in Active Directory: error 49 data codes (52e, 525, 775) and LDAP results
AcceptSecurityContext error, data 533: account disabled (ERROR_ACCOUNT_DISABLED)LDAP client / ldp.exeLDAP bind errors in Active Directory: error 49 data codes (52e, 525, 775) and LDAP results
AcceptSecurityContext error, data 568: too many security IDs in the token (ERROR_TOO_MANY_CONTEXT_IDS)LDAP client / ldp.exeLDAP bind errors in Active Directory: error 49 data codes (52e, 525, 775) and LDAP results
AcceptSecurityContext error, data 701: account expired (ERROR_ACCOUNT_EXPIRED)LDAP client / ldp.exeLDAP bind errors in Active Directory: error 49 data codes (52e, 525, 775) and LDAP results
AcceptSecurityContext error, data 773: password must be changed (ERROR_PASSWORD_MUST_CHANGE)LDAP client / ldp.exeLDAP bind errors in Active Directory: error 49 data codes (52e, 525, 775) and LDAP results
AcceptSecurityContext error, data 775: account locked out (ERROR_ACCOUNT_LOCKED_OUT)LDAP client / ldp.exeWindows logon failure codes: event 4625 and 4776 status codes and account lockout 4740
LDAP 4 LDAP_SIZELIMIT_EXCEEDED: more results than one response returnsLDAP clientLDAP bind errors in Active Directory: error 49 data codes (52e, 525, 775) and LDAP results
LDAP 19 LDAP_CONSTRAINT_VIOLATION: password write breaks length, complexity or history rulesLDAP client / provisioning appLDAP bind errors in Active Directory: error 49 data codes (52e, 525, 775) and LDAP results
LDAP 32 LDAP_NO_SUCH_OBJECT: object or search base doesn't existLDAP client / ldp.exeLDAP bind errors in Active Directory: error 49 data codes (52e, 525, 775) and LDAP results
LDAP 34 LDAP_INVALID_DN_SYNTAX: distinguished name syntax isn't validLDAP client / ldp.exeLDAP bind errors in Active Directory: error 49 data codes (52e, 525, 775) and LDAP results
LDAP 49 LDAP_INVALID_CREDENTIALS: ldap_bind_s() failed: Invalid Credentialsldp.exe / LDAP clientLDAP bind errors in Active Directory: error 49 data codes (52e, 525, 775) and LDAP results
LDAP 50 LDAP_INSUFFICIENT_RIGHTS: bound account lacks access rightsLDAP client / ldp.exeLDAP bind errors in Active Directory: error 49 data codes (52e, 525, 775) and LDAP results
LDAP 53 LDAP_UNWILLING_TO_PERFORM: problem 5003 (WILL_NOT_PERFORM)LDAP client / NetSetup.logLDAP bind errors in Active Directory: error 49 data codes (52e, 525, 775) and LDAP results
LDAP 68 LDAP_ALREADY_EXISTS: object already existsLDAP client / provisioning appLDAP bind errors in Active Directory: error 49 data codes (52e, 525, 775) and LDAP results
LDAP 81 LDAP_SERVER_DOWN: cannot contact the LDAP serverLDAP client / ldp.exeLDAP bind errors in Active Directory: error 49 data codes (52e, 525, 775) and LDAP results
LDAP 85 LDAP_TIMEOUT: search timed outLDAP clientLDAP bind errors in Active Directory: error 49 data codes (52e, 525, 775) and LDAP results
ldap_simple_bind_s() failed: Strong Authentication Required (LDAP 8)ldp.exe / LDAP clientLDAP bind errors in Active Directory: error 49 data codes (52e, 525, 775) and LDAP resultsLogon failure & lockout codes
Every code in the quick reference “Windows logon failure codes: event 4625 and 4776 status codes and account lockout 4740”: what it means, the usual cause and the first check. Open the quick reference
0xC000005E: there are currently no logon servers available to service the logon requestSecurity log (event 4625)Windows logon failure codes: event 4625 and 4776 status codes and account lockout 4740
0xC000006A: user name is correct but the password is wrongSecurity log (4625 / 4776)Windows logon failure codes: event 4625 and 4776 status codes and account lockout 4740
0xC000006D: logon failure, bad user name or authentication information (read the Sub Status)Security log (4625 / 4776)Windows logon failure codes: event 4625 and 4776 status codes and account lockout 4740
0xC000006E STATUS_ACCOUNT_RESTRICTION: an account restriction blocked the logonSecurity log (event 4625)Windows logon failure codes: event 4625 and 4776 status codes and account lockout 4740
0xC000006F: logon outside authorized hoursSecurity log (4625 / 4776)Windows logon failure codes: event 4625 and 4776 status codes and account lockout 4740
0xC000015B: user not granted the requested logon type (logon right) on this machineSecurity log (event 4625)Windows logon failure codes: event 4625 and 4776 status codes and account lockout 4740
0xC000018C STATUS_TRUSTED_DOMAIN_FAILURE: trust between the primary and trusted domain failedSecurity log (event 4625)Windows logon failure codes: event 4625 and 4776 status codes and account lockout 4740
0xC000018D: the trust relationship between this workstation and the primary domain failedSecurity log (4625) / Windows sign-in screenWindows logon failure codes: event 4625 and 4776 status codes and account lockout 4740
0xC0000064: the user name doesn't existSecurity log (4625 / 4776)Windows logon failure codes: event 4625 and 4776 status codes and account lockout 4740
0xC0000070: logon from unauthorized workstationSecurity log (4625 / 4776)Windows logon failure codes: event 4625 and 4776 status codes and account lockout 4740
0xC0000071: password expiredSecurity log (4625 / 4776)Windows logon failure codes: event 4625 and 4776 status codes and account lockout 4740
0xC0000072: account disabled by administratorSecurity log (4625 / 4776)Windows logon failure codes: event 4625 and 4776 status codes and account lockout 4740
0xC0000133 STATUS_TIME_DIFFERENCE_AT_DC: clock difference with the domain controller too largeSecurity log (event 4625)Windows logon failure codes: event 4625 and 4776 status codes and account lockout 4740
0xC0000192: logon attempted but the Netlogon service was not startedSecurity log (event 4625)Windows logon failure codes: event 4625 and 4776 status codes and account lockout 4740
0xC0000193: account expiredSecurity log (4625 / 4776)Windows logon failure codes: event 4625 and 4776 status codes and account lockout 4740
0xC0000224: user must change password at next logonSecurity log (4625 / 4776)Windows logon failure codes: event 4625 and 4776 status codes and account lockout 4740
0xC0000234: account locked outSecurity log (4625 / 4776)Windows logon failure codes: event 4625 and 4776 status codes and account lockout 4740
0xC0000371: the local account store doesn't contain secret material for the accountSecurity log (event 4776)Windows logon failure codes: event 4625 and 4776 status codes and account lockout 4740
0xC0000413: machine protected by an authentication firewall, account not allowed to authenticateSecurity log (event 4625)Windows logon failure codes: event 4625 and 4776 status codes and account lockout 4740
Failure Reason: Unknown user name or bad password.Security log (event 4625)Windows logon failure codes: event 4625 and 4776 status codes and account lockout 4740
The referenced account is currently locked out and may not be logged on to.Windows sign-in screenWindows logon failure codes: event 4625 and 4776 status codes and account lockout 4740NPS extension (MFA) errors
Every code in the quick reference “NPS extension for Microsoft Entra MFA errors: NPS event IDs, log messages and fixes”: what it means, the usual cause and the first check. Open the quick reference
AuthZOptCh error at NPS service start: IP_WHITELIST registry value not created (harmless)Event Viewer (AzureMfa AuthZ)NPS extension for Microsoft Entra MFA errors: NPS event IDs, log messages and fixes
Azure Government or 21Vianet tenant: AZURE_MFA_HOSTNAME, AZURE_MFA_RESOURCE_HOSTNAME, STS_URL not setRegistry (HKLM\SOFTWARE\Microsoft\AzureMfa)NPS extension for Microsoft Entra MFA errors: NPS event IDs, log messages and fixes
Azure Multi-Factor Auth Client service principal disabled: setup script can't use itEntra admin center (Enterprise apps)NPS extension for Microsoft Entra MFA errors: NPS event IDs, log messages and fixes
Client certificate not associated with the tenant: thumbprint missing from KeyCredentialsMicrosoft Graph PowerShellNPS extension for Microsoft Entra MFA errors: NPS event IDs, log messages and fixes
Code-based methods not offered: MS-CHAPv2 and EAP support only phone call and app notificationVPN / RADIUS clientNPS extension for Microsoft Entra MFA errors: NPS event IDs, log messages and fixes
ESTS_TOKEN_ERROR: Unable to get Azure AD access token (security token error)Event Viewer (AzureMfa logs)NPS extension for Microsoft Entra MFA errors: NPS event IDs, log messages and fixes
Event ID 13: A RADIUS message was received from the invalid RADIUS client IP addressEvent Viewer (Network Policy Server)NPS extension for Microsoft Entra MFA errors: NPS event IDs, log messages and fixes
Event ID 18: Access-Request with a message authenticator attribute that isn't valid (shared secret)Event Viewer (Network Policy Server)NPS extension for Microsoft Entra MFA errors: NPS event IDs, log messages and fixes
Event ID 6272: Network Policy Server granted access to a user (healthy result)Event Viewer (Network Policy Server)NPS extension for Microsoft Entra MFA errors: NPS event IDs, log messages and fixes
Event ID 6273 reason code 16: credentials mismatch (bad password, locked or missing account)Event Viewer (Network Policy Server)NPS extension for Microsoft Entra MFA errors: NPS event IDs, log messages and fixes
Event ID 6273 reason code 21: an NPS extension DLL rejected the request (MFA failed or denied)Event Viewer (Network Policy Server)NPS extension for Microsoft Entra MFA errors: NPS event IDs, log messages and fixes
Event ID 6273 reason code 48: the request matched no network policyEvent Viewer (Network Policy Server)NPS extension for Microsoft Entra MFA errors: NPS event IDs, log messages and fixes
Event ID 6273 reason code 65: the account's dial-in permission denies accessEvent Viewer (Network Policy Server)NPS extension for Microsoft Entra MFA errors: NPS event IDs, log messages and fixes
Event ID 6273 reason code 66: authentication method not enabled on the matching network policyEvent Viewer (Network Policy Server)NPS extension for Microsoft Entra MFA errors: NPS event IDs, log messages and fixes
Event ID 6273: Network Policy Server denied access to a userEvent Viewer (Network Policy Server)NPS extension for Microsoft Entra MFA errors: NPS event IDs, log messages and fixes
Event ID 6274: Network Policy Server discarded the request (often a duplicate RADIUS retry)Event Viewer (Network Policy Server)NPS extension for Microsoft Entra MFA errors: NPS event IDs, log messages and fixes
Expired NPS extension certificate left in the store: extension fails to startCertificates (Local Computer) › PersonalNPS extension for Microsoft Entra MFA errors: NPS event IDs, log messages and fixes
Extension errors for non-RADIUS requests: the NPS server also handles other servicesEvent Viewer (AzureMfa AuthN / AuthZ)NPS extension for Microsoft Entra MFA errors: NPS event IDs, log messages and fixes
HTTP connect errors in the extension log while every authentication failsEvent Viewer (AzureMfa AuthN / AuthZ)NPS extension for Microsoft Entra MFA errors: NPS event IDs, log messages and fixes
IP_WHITE_LIST_WARNING::IP Whitelist is being ignored as the source IP is missing in the RADIUS request NasIpAddress attribute.Event Viewer (AzureMfa AuthZ)NPS extension for Microsoft Entra MFA errors: NPS event IDs, log messages and fixes
MFA fails for users not enrolled for MFA: REQUIRE_USER_MATCH not set or TRUEVPN / RADIUS clientNPS extension for Microsoft Entra MFA errors: NPS event IDs, log messages and fixes
NPS extension client certificate expired: script-created certificates last two yearsCertificates (Local Computer) › PersonalNPS extension for Microsoft Entra MFA errors: NPS event IDs, log messages and fixes
OTP sign-in succeeds but network policy RADIUS attributes aren't returned to the VPNVPN / RADIUS clientNPS extension for Microsoft Entra MFA errors: NPS event IDs, log messages and fixes
Own certificate ignored: no Client Authentication purpose or no NETWORK SERVICE read on the keyCertificates (Local Computer) › PersonalNPS extension for Microsoft Entra MFA errors: NPS event IDs, log messages and fixes
Service principal was not foundAzureMfaNpsExtnConfigSetup.ps1NPS extension for Microsoft Entra MFA errors: NPS event IDs, log messages and fixes
Sign-in fails because the password expired: the extension can't change passwordsVPN / RADIUS clientNPS extension for Microsoft Entra MFA errors: NPS event IDs, log messages and fixes
TOTP code requested instead of Approve/Deny: NPS extension 1.2.2216.1 or laterVPN client / Microsoft AuthenticatorNPS extension for Microsoft Entra MFA errors: NPS event IDs, log messages and fixes
User not found in the extension's HTTP log: user missing in AD DS or Entra IDEvent Viewer (AzureMfa AuthN / AuthZ)NPS extension for Microsoft Entra MFA errors: NPS event IDs, log messages and fixesPassword protection, PTA & SSO
Every code in the quick reference “Microsoft Entra Password Protection, PTA and Seamless SSO errors: events and fixes”: what it means, the usual cause and the first check. Open the quick reference
30 or more AD forests: Seamless SSO can't be enabled through Entra ConnectMicrosoft Entra Connect wizardMicrosoft Entra Password Protection, PTA and Seamless SSO errors: events and fixes
25600-character policy limit: the Seamless SSO policy can't take more forestsAzureADSSO PowerShell moduleMicrosoft Entra Password Protection, PTA and Seamless SSO errors: events and fixes
An unexpected error occurred: Authentication Agent installation or registration failedAuthentication Agent setupMicrosoft Entra Password Protection, PTA and Seamless SSO errors: events and fixes
AZUREADSSOACC computer account missing or disabledActive Directory (each SSO forest)Seamless SSO not working: the AZUREADSSOACC account, Kerberos and the intranet zone
AzureADSSOAcc$ moved from RC4_HMAC_MD5 to AES: SSO stops if the Kerberos key isn't rolled over firstAzureADSSOAcc$ msDS-SupportedEncryptionTypesMicrosoft Entra Password Protection, PTA and Seamless SSO errors: events and fixes
Clock more than five minutes off: Kerberos and Seamless SSO failClient device / klistMicrosoft Entra Password Protection, PTA and Seamless SSO errors: events and fixes
Disable-AzureADSSOForest / Enable-AzureADSSOForest fails: domain admin in Protected UsersAzureADSSO PowerShell moduleMicrosoft Entra Password Protection, PTA and Seamless SSO errors: events and fixes
Enabling the feature failed because there were no Authentication Agents availableMicrosoft Entra Connect wizardMicrosoft Entra Password Protection, PTA and Seamless SSO errors: events and fixes
Event ID 4769 with ServiceName AZUREADSSOACC$: Kerberos ticket issued for Seamless SSOSecurity log (domain controller)Seamless SSO not working: the AZUREADSSOACC account, Kerberos and the intranet zone
Event ID 10012 / 10013: password change / set errors (DC agent service not reachable)DCAgent Admin logMicrosoft Entra Password Protection, PTA and Seamless SSO errors: events and fixes
Event ID 10014 / 10015: password change / set validated as compliantDCAgent Admin logMicrosoft Entra Password Protection, PTA and Seamless SSO errors: events and fixes
Event ID 10016 / 10017: password change / set rejected by the Azure password policyDCAgent Admin logMicrosoft Entra Password Protection, PTA and Seamless SSO errors: events and fixes
Event ID 10021 / 10022: preview DC agent trial period nearing expiration / expiredDCAgent Admin logMicrosoft Entra Password Protection, PTA and Seamless SSO errors: events and fixes
Event ID 10023: DC booted into Directory Services Repair Mode, all passwords approvedDCAgent Admin logMicrosoft Entra Password Protection, PTA and Seamless SSO errors: events and fixes
Event ID 10024 / 10025: audit-only, password would have been rejected but was acceptedDCAgent Admin logMicrosoft Entra Password Protection, PTA and Seamless SSO errors: events and fixes
Event ID 30001: password accepted because an Azure password policy is not available yetDCAgent Admin logMicrosoft Entra Password Protection, PTA and Seamless SSO errors: events and fixes
Event ID 30002 / 30003: rejected, matched the custom banned password listDCAgent Admin logMicrosoft Entra Password Protection, PTA and Seamless SSO errors: events and fixes
Event ID 30004 / 30005: rejected, matched the Microsoft global banned password listDCAgent Admin logMicrosoft Entra Password Protection, PTA and Seamless SSO errors: events and fixes
Event ID 30006: The service is now enforcing the following Azure password policy.DCAgent Admin logMicrosoft Entra Password Protection, PTA and Seamless SSO errors: events and fixes
Event ID 30008 / 30007: audit-only, would have failed the custom banned listDCAgent Admin logMicrosoft Entra Password Protection, PTA and Seamless SSO errors: events and fixes
Event ID 30010 / 30009: audit-only, would have failed the Microsoft banned listDCAgent Admin logMicrosoft Entra Password Protection, PTA and Seamless SSO errors: events and fixes
Event ID 30016: The forest hasn't been registered with Azure.DCAgent Admin logMicrosoft Entra Password Protection, PTA and Seamless SSO errors: events and fixes
Event ID 30017: the DC agent can't locate a proxy in the directoryDCAgent Admin logMicrosoft Entra Password Protection, PTA and Seamless SSO errors: events and fixes
Event ID 30018: the DC agent isn't able to communicate with a proxyDCAgent Admin logMicrosoft Entra Password Protection, PTA and Seamless SSO errors: events and fixes
Event ID 30019: password policy disabled, all passwords accepted without processingDCAgent Admin logMicrosoft Entra Password Protection, PTA and Seamless SSO errors: events and fixes
Event ID 30021 / 30022: rejected, password contains the user name or a friendly nameDCAgent Admin logMicrosoft Entra Password Protection, PTA and Seamless SSO errors: events and fixes
Event ID 30024 / 30023: audit-only, would have failed because of the user nameDCAgent Admin logMicrosoft Entra Password Protection, PTA and Seamless SSO errors: events and fixes
Event ID 30026 / 30027: rejected, matched both the Microsoft and custom listsDCAgent Admin logMicrosoft Entra Password Protection, PTA and Seamless SSO errors: events and fixes
Event ID 30028 / 30029: audit-only, would have failed the combined listsDCAgent Admin logMicrosoft Entra Password Protection, PTA and Seamless SSO errors: events and fixes
Event ID 30034 / 20002: newer DC agent / proxy version availableDCAgent / ProxyService Operational logMicrosoft Entra Password Protection, PTA and Seamless SSO errors: events and fixes
https://autologon.microsoftazuread-sso.com in Trusted sites: wrong zone, Seamless SSO sign-in blockedBrowser zone settingsSeamless SSO not working: the AZUREADSSOACC account, Kerberos and the intranet zone
Invalid username or password while the agent works: on-premises UPN differs from the cloud UPNSign-in pageMicrosoft Entra Password Protection, PTA and Seamless SSO errors: events and fixes
No proxy certificates were found - please run the Register-AzureADPasswordProtectionProxy cmdlet to register the proxy.Test-AzureADPasswordProtectionProxyHealthMicrosoft Entra Password Protection, PTA and Seamless SSO errors: events and fixes
Passthrough Authentication request failed. RequestId: '...'. Reason: '1328'.PTA agent trace logMicrosoft Entra Password Protection, PTA and Seamless SSO errors: events and fixes
PTA agent shows Inactive: the Authentication Agent isn't serving requestsEntra admin center (Entra Connect)Microsoft Entra Password Protection, PTA and Seamless SSO errors: events and fixes
Reason 1326 ERROR_LOGON_FAILURE: The user name or password is incorrect.PTA agent trace logMicrosoft Entra Password Protection, PTA and Seamless SSO errors: events and fixes
Reason 1327 ERROR_ACCOUNT_RESTRICTION: account restrictions prevent the sign-inPTA agent trace logMicrosoft Entra Password Protection, PTA and Seamless SSO errors: events and fixes
Reason 1328 ERROR_INVALID_LOGON_HOURS: time restrictions on the accountPTA agent trace logMicrosoft Entra Password Protection, PTA and Seamless SSO errors: events and fixes
Reason 1329 ERROR_INVALID_WORKSTATION: This user isn't allowed to sign in to this computer.PTA agent trace logMicrosoft Entra Password Protection, PTA and Seamless SSO errors: events and fixes
Reason 1330 ERROR_PASSWORD_EXPIRED: The password for this account has expired.PTA agent trace logMicrosoft Entra Password Protection, PTA and Seamless SSO errors: events and fixes
Reason 1331 ERROR_ACCOUNT_DISABLED: the account is disabledPTA agent trace logMicrosoft Entra Password Protection, PTA and Seamless SSO errors: events and fixes
Registration of the Authentication Agent failed due to blocked portsAuthentication Agent setupMicrosoft Entra Password Protection, PTA and Seamless SSO errors: events and fixes
Registration of the Authentication Agent failed due to token or account authorization errorsAuthentication Agent setupMicrosoft Entra Password Protection, PTA and Seamless SSO errors: events and fixes
The Directory Services Restore Mode password doesn't meet a requirement of the password filter(s).Install-ADDSDomainControllerMicrosoft Entra Password Protection, PTA and Seamless SSO errors: events and fixes
The RPC endpoint mapper on the specified proxy returned no resultsTest-AzureADPasswordProtectionDCAgentHealthMicrosoft Entra Password Protection, PTA and Seamless SSO errors: events and fixes
Users will not be able to sign-in to Microsoft Entra ID unless you have other Pass-through Authentication agents installedUninstalling Microsoft Entra ConnectMicrosoft Entra Password Protection, PTA and Seamless SSO errors: events and fixes
VerifyEncryptionDecryption Failed: KDS encryption or decryption isn't workingTest-AzureADPasswordProtectionDCAgentHealthMicrosoft Entra Password Protection, PTA and Seamless SSO errors: events and fixes
Weak passwords accepted: audit mode, disabled policy, expired agent or a DC without the agentDomain controllers (password changes)Microsoft Entra Password Protection, PTA and Seamless SSO errors: events and fixes
WIN32 Error Code: 0xa91 Error Message: Password doesn't meet the requirements of the filter dll'sntdsutil (set dsrm password)Microsoft Entra Password Protection, PTA and Seamless SSO errors: events and fixesProvisioning errors
Every code in the quick reference “Microsoft Entra provisioning error codes: SCIM apps, HR-driven and cross-tenant sync”: what it means, the usual cause and the first check. Open the quick reference
AzureActiveDirectoryCannotUpdateObjectsMasteredOnPremises: target user still mastered on-premisesProvisioning logs (cross-tenant sync)Microsoft Entra provisioning error codes: SCIM apps, HR-driven and cross-tenant sync
AzureActiveDirectoryCannotUpdateObjectsOriginatedInExternalService: Exchange Online is source of authorityProvisioning logs (cross-tenant sync)Microsoft Entra provisioning error codes: SCIM apps, HR-driven and cross-tenant sync
AzureActiveDirectoryCannotUpdateObjectsOriginatedInExternalService: SOA enforcement on Mail or showInAddressListProvisioning logs (cross-tenant sync)Microsoft Entra provisioning error codes: SCIM apps, HR-driven and cross-tenant sync
AzureActiveDirectoryConflictEncountered: conflicting object (contact) in the target tenantProvisioning logs (cross-tenant sync)Microsoft Entra provisioning error codes: SCIM apps, HR-driven and cross-tenant sync
AzureActiveDirectoryForbidden: dirSyncEnabled is true, immutableId or extensionProperty can't be updatedProvisioning logs (cross-tenant sync)Microsoft Entra provisioning error codes: SCIM apps, HR-driven and cross-tenant sync
AzureActiveDirectoryForbidden: external collaboration settings blocked invitationsProvisioning logs (cross-tenant sync)B2B guest access and cross-tenant access settings: inbound, outbound and trust
AzureActiveDirectoryQuotaLimitExceeded: objects in the tenant exceed the directory limitProvisioning logs (cross-tenant sync)Microsoft Entra provisioning error codes: SCIM apps, HR-driven and cross-tenant sync
AzureDirectoryB2BManagementPolicyCheckFailure: automatic redemption policy check failedProvisioning logs (cross-tenant sync)B2B guest access and cross-tenant access settings: inbound, outbound and trust
Conflict, EntryConflict: conflicting attribute values in Entra ID and the appProvisioning logsMicrosoft Entra provisioning error codes: SCIM apps, HR-driven and cross-tenant sync
Duplicate roles: imported roles must be unique (quarantine)Provisioning page (quarantine reason)Microsoft Entra provisioning error codes: SCIM apps, HR-driven and cross-tenant sync
DuplicateSourceEntries: more than one source user matches the matching attributesProvisioning logsMicrosoft Entra provisioning error codes: SCIM apps, HR-driven and cross-tenant sync
DuplicateTargetEntries: more than one target user matches the matching attributesProvisioning logsMicrosoft Entra provisioning error codes: SCIM apps, HR-driven and cross-tenant sync
EncounteredEscrowProportionThreshold: job quarantined, more than 40% of provisioning events failedProvisioning page / Graph synchronizationJobMicrosoft Entra provisioning error codes: SCIM apps, HR-driven and cross-tenant sync
EncounteredQuarantineException: job quarantined, invalid credentials or no connection to the targetProvisioning page / Graph synchronizationJobMicrosoft Entra provisioning error codes: SCIM apps, HR-driven and cross-tenant sync
EntityTypeNotSupported: groups scope users but aren't synchronized (skipped)Provisioning logs (cross-tenant sync)Microsoft Entra provisioning error codes: SCIM apps, HR-driven and cross-tenant sync
EntrySynchronizationSkipped: user skipped, out of scope or no changes neededProvisioning logsMicrosoft Entra provisioning error codes: SCIM apps, HR-driven and cross-tenant sync
HTTP/404 Not Found instead of HTTP/200 OK: SCIM compliance issue (quarantine)Provisioning page (quarantine reason)Microsoft Entra provisioning error codes: SCIM apps, HR-driven and cross-tenant sync
HybridSynchronizationActiveDirectoryCannotFindAttribute: attribute not in the AD schemaProvisioning logs (HR inbound to AD)Microsoft Entra provisioning error codes: SCIM apps, HR-driven and cross-tenant sync
HybridSynchronizationActiveDirectoryInsufficientAccessRights: Problem 4003 - INSUFF_ACCESS_RIGHTSProvisioning logs (HR inbound to AD)Microsoft Entra provisioning error codes: SCIM apps, HR-driven and cross-tenant sync
ImportSkipped: source user is missing the matching attributeProvisioning logsMicrosoft Entra provisioning error codes: SCIM apps, HR-driven and cross-tenant sync
InsufficientRights, MethodNotAllowed, NotPermitted, Unauthorized: authenticated but not authorizedProvisioning logsMicrosoft Entra provisioning error codes: SCIM apps, HR-driven and cross-tenant sync
InternalError: internal error in the Microsoft Entra provisioning serviceProvisioning logsMicrosoft Entra provisioning error codes: SCIM apps, HR-driven and cross-tenant sync
InternalServerError: the target app returned an unexpected errorProvisioning logsMicrosoft Entra provisioning error codes: SCIM apps, HR-driven and cross-tenant sync
Invalid value: manager attribute not updated by provision on demandProvision on demand (HR inbound)Microsoft Entra provisioning error codes: SCIM apps, HR-driven and cross-tenant sync
InvalidAnchor: a previously created or matched user no longer existsProvisioning logsMicrosoft Entra provisioning error codes: SCIM apps, HR-driven and cross-tenant sync
InvalidAttributeSyntax-LdapErr: The syntax is invalid. The parameter is incorrect.Provisioning logs (HR inbound to AD)Microsoft Entra provisioning error codes: SCIM apps, HR-driven and cross-tenant sync
InvalidDomain: an attribute value contains an invalid domain nameProvisioning logsMicrosoft Entra provisioning error codes: SCIM apps, HR-driven and cross-tenant sync
InvitationCreationFailure: inviting the user in the target tenant failedProvisioning logs (cross-tenant sync)Microsoft Entra provisioning error codes: SCIM apps, HR-driven and cross-tenant sync
InvitationCreationFailureAmbiguousUser: proxy address matches an internal user in the targetProvisioning logs (cross-tenant sync)Microsoft Entra provisioning error codes: SCIM apps, HR-driven and cross-tenant sync
InvitationCreationFailureInvalidPropertyValue: invalid primary SMTP address, userType or group email clashProvisioning logs (cross-tenant sync)Microsoft Entra provisioning error codes: SCIM apps, HR-driven and cross-tenant sync
InvitationCreationFailureUserAccountDisabled: user disabled in the target tenant, invitation pendingProvisioning logs (cross-tenant sync)Microsoft Entra provisioning error codes: SCIM apps, HR-driven and cross-tenant sync
LicenseLimitExceeded: no available licenses in the target applicationProvisioning logsMicrosoft Entra provisioning error codes: SCIM apps, HR-driven and cross-tenant sync
MandatoryFieldsMissing, MissingValues: required values missing, user not createdProvisioning logsMicrosoft Entra provisioning error codes: SCIM apps, HR-driven and cross-tenant sync
NotImplemented: unexpected response from the target appProvisioning logsMicrosoft Entra provisioning error codes: SCIM apps, HR-driven and cross-tenant sync
QuarantineOnDemand: Microsoft detected an issue and quarantined the jobProvisioning page / Graph synchronizationJobMicrosoft Entra provisioning error codes: SCIM apps, HR-driven and cross-tenant sync
SchemaAttributeNotFound: attribute doesn't exist in the target applicationProvisioning logsMicrosoft Entra provisioning error codes: SCIM apps, HR-driven and cross-tenant sync
SchemaPropertyCanOnlyAcceptValue: single-valued target property, multi-valued sourceProvisioning logsMicrosoft Entra provisioning error codes: SCIM apps, HR-driven and cross-tenant sync
SystemForCrossDomainIdentityManagementMultipleEntriesInResponse: GET returned several objectsProvisioning logsMicrosoft Entra provisioning error codes: SCIM apps, HR-driven and cross-tenant sync
SystemForCrossDomainIdentityManagementServiceIncompatible: SCIM response can't be parsedProvisioning logsMicrosoft Entra provisioning error codes: SCIM apps, HR-driven and cross-tenant sync
Timeout: the target application took too long to respondProvisioning logsMicrosoft Entra provisioning error codes: SCIM apps, HR-driven and cross-tenant sync
TooManyRequests: the target app is receiving too many requestsProvisioning logsMicrosoft Entra provisioning error codes: SCIM apps, HR-driven and cross-tenant sync
UnprocessableEntity: unexpected response from the target applicationProvisioning logsMicrosoft Entra provisioning error codes: SCIM apps, HR-driven and cross-tenant sync
WebExceptionProtocolError: HTTP protocol error connecting to the target appProvisioning logsMicrosoft Entra provisioning error codes: SCIM apps, HR-driven and cross-tenant syncSSPR & password writeback errors
Every code in the quick reference “Entra ID SSPR and password writeback errors: SSPR_00xx codes, event IDs and fixes”: what it means, the usual cause and the first check. Open the quick reference
Event ID 31001 / 31002 PasswordResetStart / PasswordResetSuccess: user reset written to ADApplication log (PasswordResetService)Entra ID SSPR and password writeback errors: SSPR_00xx codes, event IDs and fixes
Event ID 31004 / 31005 OnboardingEventStart / OnboardingEventSuccess: writeback onboardingApplication log (PasswordResetService)Entra ID SSPR and password writeback errors: SSPR_00xx codes, event IDs and fixes
Event ID 31006 / 31007 ChangePasswordStart / ChangePasswordSuccess: user change written to ADApplication log (PasswordResetService)Entra ID SSPR and password writeback errors: SSPR_00xx codes, event IDs and fixes
Event ID 31009 / 31010 ResetUserPasswordByAdminStart / Success: admin reset written to ADApplication log (PasswordResetService)Entra ID SSPR and password writeback errors: SSPR_00xx codes, event IDs and fixes
Event ID 31011 ResetUserPasswordByAdminFail: admin reset reached AD but couldn't be setApplication log (PasswordResetService)Entra ID SSPR and password writeback errors: SSPR_00xx codes, event IDs and fixes
Event ID 31012 / 31013 OffboardingEventStart / OffboardingEventSuccess: writeback offboardingApplication log (PasswordResetService)Entra ID SSPR and password writeback errors: SSPR_00xx codes, event IDs and fixes
Event ID 31014 OffboardingEventFail: disabling password writeback failedApplication log (PasswordResetService)Entra ID SSPR and password writeback errors: SSPR_00xx codes, event IDs and fixes
Event ID 31015 WriteBackServiceStarted: writeback is ready for requests from the cloudApplication log (PasswordResetService)Entra ID SSPR and password writeback errors: SSPR_00xx codes, event IDs and fixes
Event ID 31017 / 31018 AuthTokenSuccess / KeyPairCreationSuccess: admin token and encryption key createdApplication log (PasswordResetService)Entra ID SSPR and password writeback errors: SSPR_00xx codes, event IDs and fixes
Event ID 31019 ServiceBusHeartBeat: request to the tenant's Service Bus succeededApplication log (PasswordResetService)Entra ID SSPR and password writeback errors: SSPR_00xx codes, event IDs and fixes
Event ID 31044: password writeback not healthy, no Service Bus service host runningApplication log (PasswordResetService)Entra ID SSPR and password writeback errors: SSPR_00xx codes, event IDs and fixes
Event ID 32000 UnknownError: unknown error during a password operationApplication log (PasswordResetService)Entra ID SSPR and password writeback errors: SSPR_00xx codes, event IDs and fixes
Event ID 32001 ServiceError: can't connect to the cloud password reset serviceApplication log (PasswordResetService)Entra ID SSPR and password writeback errors: SSPR_00xx codes, event IDs and fixes
Event ID 32003 InPutValidationError: invalid input passed to the web service APIApplication log (PasswordResetService)Entra ID SSPR and password writeback errors: SSPR_00xx codes, event IDs and fixes
Event ID 32004 DecryptionError: password from the cloud couldn't be decryptedApplication log (PasswordResetService)Entra ID SSPR and password writeback errors: SSPR_00xx codes, event IDs and fixes
Event ID 32005 ConfigurationError: writeback configuration file can't be saved or readApplication log (PasswordResetService)Entra ID SSPR and password writeback errors: SSPR_00xx codes, event IDs and fixes
Event ID 32007 OnBoardingConfigUpdateError: onboarding data couldn't be written in memoryApplication log (PasswordResetService)Entra ID SSPR and password writeback errors: SSPR_00xx codes, event IDs and fixes
Event ID 32008 ValidationError: invalid response from the password reset web serviceApplication log (PasswordResetService)Entra ID SSPR and password writeback errors: SSPR_00xx codes, event IDs and fixes
Event ID 32010 CryptoError: encryption key creation or password decryption failedApplication log (PasswordResetService)Entra ID SSPR and password writeback errors: SSPR_00xx codes, event IDs and fixes
Event ID 32011 OnBoardingServiceError: onboarding can't reach the password reset serviceApplication log (PasswordResetService)Entra ID SSPR and password writeback errors: SSPR_00xx codes, event IDs and fixes
Event ID 32013 OffBoardingError: offboarding can't reach the password reset serviceApplication log (PasswordResetService)Entra ID SSPR and password writeback errors: SSPR_00xx codes, event IDs and fixes
Event ID 32014 ServiceBusWarning: connection to the Service Bus had to be retriedApplication log (PasswordResetService)Entra ID SSPR and password writeback errors: SSPR_00xx codes, event IDs and fixes
Event ID 32015 ReportServiceHealthError: five-minute health heartbeat to the cloud failedApplication log (PasswordResetService)Entra ID SSPR and password writeback errors: SSPR_00xx codes, event IDs and fixes
Event ID 33007 ADUserIncorrectPassword: wrong current password in a password changeApplication log (PasswordResetService)Entra ID SSPR and password writeback errors: SSPR_00xx codes, event IDs and fixes
Event ID 33009 ADConfigurationError: an Active Directory configuration issue blocked the writeApplication log (PasswordResetService)Entra ID SSPR and password writeback errors: SSPR_00xx codes, event IDs and fixes
Multiple matches found: the user has an enabled account in more than one forestApplication log (Entra Connect server)Entra ID SSPR and password writeback errors: SSPR_00xx codes, event IDs and fixes
Object could not be found: sync engine can't find the user's connector space or metaverse objectApplication log (Entra Connect server)Entra ID SSPR and password writeback errors: SSPR_00xx codes, event IDs and fixes
On-premises policy violation: the new password fails the Active Directory password policyPassword reset pageEntra ID SSPR and password writeback errors: SSPR_00xx codes, event IDs and fixes
OnPremisesSuccessCloudFailure: password reset on-premises, cloud update not committed yetPassword reset pageEntra ID SSPR and password writeback errors: SSPR_00xx codes, event IDs and fixes
Password doesn't comply with fuzzy policy: the password is on the banned password listPassword reset / change pageEntra ID SSPR and password writeback errors: SSPR_00xx codes, event IDs and fixes
SSPR_0009 TenantSSPRFlagDisabled: password reset isn't enabled for the organizationPassword reset pageSelf-service password reset and password writeback: fixing the usual failures
SSPR_0010 WritebackNotEnabled: password writeback hasn't been enabledPassword reset pageSelf-service password reset and password writeback: fixing the usual failures
SSPR_0011 SsprNotEnabledInUserPolicy: no password reset policy is definedPassword reset pageSelf-service password reset and password writeback: fixing the usual failures
SSPR_0012 UserNotLicensed: required licenses are missingPassword reset pageSelf-service password reset and password writeback: fixing the usual failures
Unable to configure password writeback. Ensure you have the required license.Entra Connect wizardEntra ID SSPR and password writeback errors: SSPR_00xx codes, event IDs and fixesSYSVOL & DFSR events
Every code in the quick reference “SYSVOL replication events: DFSR and FRS event IDs with causes and fixes”: what it means, the usual cause and the first check. Open the quick reference
DFSR 2212: unexpected shutdown detected on the volume; database recovery startedEvent Viewer (DFS Replication log)SYSVOL replication events: DFSR and FRS event IDs with causes and fixes
DFSR 2213: replication stopped on the volume after a dirty shutdown; resume it manuallyEvent Viewer (DFS Replication log)SYSVOL replication events: DFSR and FRS event IDs with causes and fixes
DFSR 2214: recovery from the dirty shutdown completedEvent Viewer (DFS Replication log)SYSVOL replication events: DFSR and FRS event IDs with causes and fixes
DFSR 4012: replication stopped; member failed to replicate longer than MaxOfflineTimeInDaysEvent Viewer (DFS Replication log)SYSVOL replication events: DFSR and FRS event IDs with causes and fixes
DFSR 4114: the SYSVOL replicated folder is disabled and no longer replicatedEvent Viewer (DFS Replication log)SYSVOL replication events: DFSR and FRS event IDs with causes and fixes
DFSR 4602: SYSVOL initialized as the primary (authoritative) memberEvent Viewer (DFS Replication log)SYSVOL replication events: DFSR and FRS event IDs with causes and fixes
DFSR 4604: SYSVOL initialized; initial synchronization completedEvent Viewer (DFS Replication log)SYSVOL replication events: DFSR and FRS event IDs with causes and fixes
DFSR 4614: SYSVOL initialized and waiting to perform initial replicationEvent Viewer (DFS Replication log)SYSVOL replication events: DFSR and FRS event IDs with causes and fixes
DFSR 5002: the DFS Replication service encountered an error communicating with a partnerEvent Viewer (DFS Replication log)SYSVOL replication events: DFSR and FRS event IDs with causes and fixes
DFSR 5008: failed to communicate with the partner (host unreachable or DFSR not running)Event Viewer (DFS Replication log)SYSVOL replication events: DFSR and FRS event IDs with causes and fixes
DFSR 5012: the partner did not recognize the connection or the replication group configurationEvent Viewer (DFS Replication log)SYSVOL replication events: DFSR and FRS event IDs with causes and fixes
DFSR 5014: communication with a partner stopped because of an error; DFSR retriesEvent Viewer (DFS Replication log)SYSVOL replication events: DFSR and FRS event IDs with causes and fixes
DFSR 6016: the DFS Replication service failed to update configuration in Active Directory Domain ServicesEvent Viewer (DFS Replication log)SYSVOL replication events: DFSR and FRS event IDs with causes and fixes
FRS 13508: FRS is having trouble enabling replication from a partner using its DNS nameEvent Viewer (File Replication Service log)SYSVOL replication events: DFSR and FRS event IDs with causes and fixes
FRS 13509: FRS has enabled replication from a partner after repeated retriesEvent Viewer (File Replication Service log)SYSVOL replication events: DFSR and FRS event IDs with causes and fixes
FRS 13511: FRS is stopping because there is no free space on the volumeEvent Viewer (File Replication Service log)SYSVOL replication events: DFSR and FRS event IDs with causes and fixes
FRS 13522: FRS paused because the staging area is fullEvent Viewer (File Replication Service log)SYSVOL replication events: DFSR and FRS event IDs with causes and fixes
FRS 13526: the partner computer's SID can't be determined from its distinguished nameEvent Viewer (File Replication Service log)SYSVOL replication events: DFSR and FRS event IDs with causes and fixes
FRS 13548: clock difference with the partner computer is outside the allowed rangeEvent Viewer (File Replication Service log)SYSVOL replication events: DFSR and FRS event IDs with causes and fixes
FRS 13552: FRS is unable to add this computer to the replica setEvent Viewer (File Replication Service log)SYSVOL replication events: DFSR and FRS event IDs with causes and fixes
FRS 13555: the File Replication Service is in an error stateEvent Viewer (File Replication Service log)SYSVOL replication events: DFSR and FRS event IDs with causes and fixes
FRS 13557: duplicate connection object between this computer and a partnerEvent Viewer (File Replication Service log)SYSVOL replication events: DFSR and FRS event IDs with causes and fixes
FRS 13559: the replica root path has changedEvent Viewer (File Replication Service log)SYSVOL replication events: DFSR and FRS event IDs with causes and fixes
FRS 13565: FRS is initializing the system volume with data from another domain controllerEvent Viewer (File Replication Service log)SYSVOL replication events: DFSR and FRS event IDs with causes and fixes
FRS 13568: the replica set is in JRNL_WRAP_ERROREvent Viewer (File Replication Service log)SYSVOL replication events: DFSR and FRS event IDs with causes and fixes
FRS 13575: this DC has migrated SYSVOL to DFS Replication; FRS has been stopped (expected)Event Viewer (File Replication Service log)SYSVOL replication events: DFSR and FRS event IDs with causes and fixes
Migration has not yet reached a consistent state on all Domain Controllers.dfsrmig /getmigrationstateSYSVOL replication events: DFSR and FRS event IDs with causes and fixes
SYSVOL Share replicated folder in state 5 (In Error)WMI DfsrReplicatedFolderInfoSYSVOL replication events: DFSR and FRS event IDs with causes and fixes
The specified domain <domain> is still using the File Replication Service (FRS) to replicate the SYSVOL share. FRS is deprecated.Domain controller promotion (prerequisites)SYSVOL replication events: DFSR and FRS event IDs with causes and fixesExchange Online NDR codes
Every code in the quick reference “Exchange Online NDR and SMTP error codes: a quick reference with causes and fixes”: what it means, the usual cause and the first check. Open the quick reference
4.3.2 STOREDRV.Deliver; recipient thread limit exceededNDR / message traceExchange Online NDR and SMTP error codes: a quick reference with causes and fixes
4.4.7 Message expiredNDRExchange Online NDR and SMTP error codes: a quick reference with causes and fixes
4.4.8 / 5.4.8 MX hosts failed MTA-STS validationNDRExchange Online NDR and SMTP error codes: a quick reference with causes and fixes
4.4.316 Connection refused [Message=Socket error code 10061]NDRExchange Online NDR and SMTP error codes: a quick reference with causes and fixes
4.4.317 Cannot connect to remote server [Message=UntrustedRoot]NDRExchange Online NDR and SMTP error codes: a quick reference with causes and fixes
4.5.3 Too many recipientsNDR / SMTP responseExchange Online NDR and SMTP error codes: a quick reference with causes and fixes
4.7.5 / 5.7.5 Remote certificate failed MTA-STS validationNDRExchange Online NDR and SMTP error codes: a quick reference with causes and fixes
4.7.321 / 5.7.321 starttls-not-supportedNDRExchange Online NDR and SMTP error codes: a quick reference with causes and fixes
4.7.322 / 5.7.322 certificate-expiredNDRExchange Online NDR and SMTP error codes: a quick reference with causes and fixes
4.7.323 / 5.7.323 tlsa-invalidNDRExchange Online NDR and SMTP error codes: a quick reference with causes and fixes
4.7.324 / 5.7.324 dnssec-invalidNDRExchange Online NDR and SMTP error codes: a quick reference with causes and fixes
4.7.325 / 5.7.325 certificate-host-mismatchNDRExchange Online NDR and SMTP error codes: a quick reference with causes and fixes
4.7.500-699 / 4.7.850-899 Access denied, please try again laterNDRExchange Online NDR and SMTP error codes: a quick reference with causes and fixes
5.0.350 Generic error, x-dg-ref header is too long, or policy violation detected (AS345)NDRExchange Online NDR and SMTP error codes: a quick reference with causes and fixes
5.1.0 Sender deniedNDRExchange Online NDR and SMTP error codes: a quick reference with causes and fixes
5.1.1 Bad destination mailbox addressNDR550 5.1.1 RESOLVER.ADR.ExRecipNotFound and IMCEAEX NDRs: fixing them with X500 addresses
5.1.8 Access denied, bad outbound senderNDRUsers blocked from sending in Exchange Online: Restricted entities and NDR 550 5.1.8
5.1.10 Recipient not foundNDR / message traceNDR 550 5.1.10 RESOLVER.ADR.RecipientNotFound in Exchange Online: causes and fixes
5.1.20 Multiple From addresses are not allowed without Sender addressNDRExchange Online NDR and SMTP error codes: a quick reference with causes and fixes
5.1.90 / 5.2.2 Daily recipient limit reached / Submission quota exceededNDRUsers blocked from sending in Exchange Online: Restricted entities and NDR 550 5.1.8
5.2.2 Mailbox full (STOREDRV.Deliver QuotaExceededException)NDR“Mailbox full” in Exchange Online: quotas, Recoverable Items and the 554 5.2.2 NDR
5.2.121 / 5.2.122 Recipient's per hour message receive limit exceededNDRExchange Online NDR and SMTP error codes: a quick reference with causes and fixes
5.4.1 Recipient address rejected: Access deniedNDRNDR 550 5.4.1 “Recipient address rejected: Access denied”: Directory-Based Edge Blocking
5.4.1 Relay Access DeniedNDRExchange Online NDR and SMTP error codes: a quick reference with causes and fixes
5.4.6 / 5.4.14 Routing loop detectedNDR554 5.4.6 and 5.4.14 Hop count exceeded: finding and fixing Exchange mail loops
5.5.0 Requested action not taken: mailbox unavailableNDRNDR 550 5.1.10 RESOLVER.ADR.RecipientNotFound in Exchange Online: causes and fixes
5.6.11 Invalid charactersNDRExchange Online NDR and SMTP error codes: a quick reference with causes and fixes
5.7.1 Client was not authenticatedNDR530 5.7.1 Client was not authenticated: fixing anonymous SMTP submission to Exchange
5.7.1 Delivery not authorizedNDRNDR 550 5.7.1 Delivery not authorized, message refused: fixing it in Exchange Online
5.7.1 RESOLVER.RST.AuthRequired; authentication requiredNDRNDR 550 5.7.1 Delivery not authorized, message refused: fixing it in Exchange Online
5.7.1 Unable to relayNDRExchange Online NDR and SMTP error codes: a quick reference with causes and fixes
5.7.12 Sender was not authenticated by organizationNDRNDR 550 5.7.1 Delivery not authorized, message refused: fixing it in Exchange Online
5.7.13 / 5.7.135 / 5.7.136 Sender was not authenticated for public folder or mail userNDRNDR 550 5.7.1 Delivery not authorized, message refused: fixing it in Exchange Online
5.7.23 The message was rejected because of Sender Policy Framework violationNDRSPF, DKIM and DMARC for your Microsoft 365 custom domain: a practical setup guide
5.7.57 Client was not authenticated to send anonymous mail during MAIL FROMSMTP response (device or app)Printers and apps can't send via Microsoft 365: SMTP AUTH, relay connectors and 5.7.57
5.7.64 TenantAttribution; Relay Access DeniedNDRNDR 550 5.7.750 in Exchange Online: Client blocked from sending from unregistered domains
5.7.124 Sender not in allowed-senders listNDRNDR 550 5.7.1 Delivery not authorized, message refused: fixing it in Exchange Online
5.7.129 No permission to send to the recipientNDRNDR 550 5.7.1 Delivery not authorized, message refused: fixing it in Exchange Online
5.7.133 Sender not authenticated for groupNDR / message traceNDR 550 5.7.1 Delivery not authorized, message refused: fixing it in Exchange Online
5.7.134 Sender was not authenticated for mailboxNDRNDR 550 5.7.1 Delivery not authorized, message refused: fixing it in Exchange Online
5.7.232 / 5.7.233 Tenant exceeded its daily limit for sending email to external recipientsNDRExchange Online NDR and SMTP error codes: a quick reference with causes and fixes
5.7.236 Daily limit for external recipients from onmicrosoft.com domainsNDRAdding a domain to Microsoft 365: verification, DNS records and "already added" errors
5.7.367 Remote server returned not permitted to relayNDRExchange Online NDR and SMTP error codes: a quick reference with causes and fixes
5.7.501 / 5.7.502 / 5.7.503 Access denied, spam abuse detected / banned senderNDRUsers blocked from sending in Exchange Online: Restricted entities and NDR 550 5.1.8
5.7.506 Access Denied, Bad HELONDR (external sender)Exchange Online NDR and SMTP error codes: a quick reference with causes and fixes
5.7.507 Access denied, rejected by recipientNDRExchange Online NDR and SMTP error codes: a quick reference with causes and fixes
5.7.509 Access denied, sending domain does not pass DMARC verification and has a DMARC policy of rejectNDRSPF, DKIM and DMARC for your Microsoft 365 custom domain: a practical setup guide
5.7.511 / 5.7.606-649 Access denied, banned sender / banned sending IPNDR (external sender)Exchange Online NDR and SMTP error codes: a quick reference with causes and fixes
5.7.512 Access denied, message must be RFC 5322 section 3.6.2 compliantNDRExchange Online NDR and SMTP error codes: a quick reference with causes and fixes
5.7.513 Client host blocked using Customer Block list (AS16012607)NDRExchange Online NDR and SMTP error codes: a quick reference with causes and fixes
5.7.520 Access denied, Your organization does not allow external forwardingNDRNDR 550 5.7.520: fixing “Your organization does not allow external forwarding”
5.7.703 Blocked by your organization using Tenant Allow Block ListNDRTenant Allow/Block List in Defender for Office 365: senders, URLs, files and spoofing
5.7.705 Access denied, tenant has exceeded thresholdNDRNDR 550 5.7.708 in Exchange Online: Access denied, traffic not accepted from this IP
5.7.708 Access denied, traffic not accepted from this IPNDRNDR 550 5.7.708 in Exchange Online: Access denied, traffic not accepted from this IP
5.7.750 Client blocked from sending from unregistered domainsNDRNDR 550 5.7.750 in Exchange Online: Client blocked from sending from unregistered domains
5.7.800 Access denied, banned senderNDRExchange Online NDR and SMTP error codes: a quick reference with causes and fixesExchange Online PowerShell errors
Every code in the quick reference “Exchange Online PowerShell V3 errors: Connect-ExchangeOnline, module install and cmdlets”: what it means, the usual cause and the first check. Open the quick reference
[outlook.office365.com] Connecting to remote server failed with the following error message: Access is denied.New-PSSession (legacy remote PowerShell)Exchange Online PowerShell V3 errors: Connect-ExchangeOnline, module install and cmdlets
Cannot find a cmdlet Update-Manifest: PowerShellGet isn't installedConnect-ExchangeOnlineExchange Online PowerShell V3 errors: Connect-ExchangeOnline, module install and cmdlets
Cannot invoke the pipeline because the runspace isn't in the Opened state. Current state of the runspace is 'Closed'.Exchange Online PowerShell (old module)Exchange Online PowerShell V3 errors: Connect-ExchangeOnline, module install and cmdlets
Files cannot be loaded because running scripts is disabled on this system. Provide a valid certificate with which to sign the files.Connect-ExchangeOnlineExchange Online PowerShell V3: connect, automate with certificates, run everyday reports
Import-PSSession : Cannot validate argument on parameter 'Session'. The argument is null.Import-PSSession (legacy remote PowerShell)Exchange Online PowerShell V3 errors: Connect-ExchangeOnline, module install and cmdlets
No match was found for the specified search criteria and module name 'ExchangeOnlineManagement'.Install-ModuleExchange Online PowerShell V3: connect, automate with certificates, run everyday reports
The data in the command exceeded the maximum permitted by the session configuration. The allowed maximum is 500MB.Get-Mailbox (legacy remote PowerShell)Exchange Online PowerShell V3 errors: Connect-ExchangeOnline, module install and cmdlets
The operation couldn't be performed because object '<identity>' couldn't be found on '<server>'. (ManagementObjectNotFoundException)Exchange Online PowerShell (cmdlet output)Exchange Online PowerShell V3 errors: Connect-ExchangeOnline, module install and cmdlets
The specified module 'ExchangeOnlineManagement' with PowerShellGetFormatVersion '<version>' isn't supported (old PowerShellGet)Install-Module / Update-ModuleExchange Online PowerShell V3 errors: Connect-ExchangeOnline, module install and cmdlets
The term 'Connect-ExchangeOnline' is not recognized as the name of a cmdlet, function, script file, or operable program.PowerShell consoleExchange Online PowerShell V3: connect, automate with certificates, run everyday reports
The term 'Get-Mailbox' is not recognized as the name of a cmdlet: cmdlet not loaded in the session (connection or RBAC)Exchange Online PowerShellExchange Online PowerShell V3 errors: Connect-ExchangeOnline, module install and cmdlets
The term 'Update-ModuleManifest' is not recognized as a name of a cmdlet, function, script file, or executable program.Connect-ExchangeOnline (PowerShell SDK)Exchange Online PowerShell V3 errors: Connect-ExchangeOnline, module install and cmdlets
The WinRM client cannot process the request: Basic authentication in WinRM (legacy remote PowerShell)New-PSSession (legacy remote PowerShell)Exchange Online PowerShell V3 errors: Connect-ExchangeOnline, module install and cmdlets
WARNING: Unable to download from URI 'https://go.microsoft.com/fwlink/?LinkID=627338&clcid=0x409' to ''.Install-Module / Update-ModuleExchange Online PowerShell V3 errors: Connect-ExchangeOnline, module install and cmdlets
WARNING: Unable to download the list of available providers. Check your internet connection.Install-Module / Update-ModuleExchange Online PowerShell V3 errors: Connect-ExchangeOnline, module install and cmdletsMigration batch errors
Every code in the quick reference “Exchange Online migration batch errors: IMAP, cutover, Google Workspace and cross-tenant”: what it means, the usual cause and the first check. Open the quick reference
"/o=NT5/ou=.../cn=..." is not a valid SMTP address: stale GAL entries in a cutover batchCutover migration batchExchange Server to Exchange Online: every scenario, from first batch to last server
'{0}' email addresses use domains that are not accepted in the organization.Cross-tenant identity mappingExchange Online migration batch errors: IMAP, cutover, Google Workspace and cross-tenant
A recipient wasn't found for user@contoso.com on the target: no Exchange Online mailbox with that addressMigration user error reportExchange Online migration batch errors: IMAP, cutover, Google Workspace and cross-tenant
Column "<name>" is missing from the CSV file. The import process can't continue because this column is required.EAC (CSV upload)Exchange Online migration batch errors: IMAP, cutover, Google Workspace and cross-tenant
Couldn't find a mail user with '{0}' ExternalEmailAddress in '{1}' tenant.Cross-tenant identity mappingExchange Online migration batch errors: IMAP, cutover, Google Workspace and cross-tenant
CTM-001 / CTM-002 User migration validation failed. User is already a part of the same or another batchOrchestrated cross-tenant migrationExchange Online migration batch errors: IMAP, cutover, Google Workspace and cross-tenant
CTM-100 User migration validation failed. User identity mapping not found.Orchestrated cross-tenant migrationExchange Online migration batch errors: IMAP, cutover, Google Workspace and cross-tenant
CTM-101 User migration validation failed. User identity mapping not in completed state.Orchestrated cross-tenant migrationExchange Online migration batch errors: IMAP, cutover, Google Workspace and cross-tenant
CTM-102 / CTM-103 Service busy or internal server error during the validation of the userOrchestrated cross-tenant migrationExchange Online migration batch errors: IMAP, cutover, Google Workspace and cross-tenant
CTM-104 The CTMS and/or CTIM Apps are either not provisioned, not enabled, or not fully configured.Orchestrated cross-tenant migrationExchange Online migration batch errors: IMAP, cutover, Google Workspace and cross-tenant
EXCH-07 No valid migration endpoints for the remote tenant.Orchestrated cross-tenant migrationExchange Online migration batch errors: IMAP, cutover, Google Workspace and cross-tenant
EXCH-08 Setup validation failed (Test-MigrationServerAvailability failed for the user)Orchestrated cross-tenant migrationExchange Online migration batch errors: IMAP, cutover, Google Workspace and cross-tenant
EXCH-13 Mailbox migration for user {0} has already completed in another batchOrchestrated cross-tenant migrationExchange Online migration batch errors: IMAP, cutover, Google Workspace and cross-tenant
EXCH-15 Max retry for user with id {0} reached.Orchestrated cross-tenant migrationExchange Online migration batch errors: IMAP, cutover, Google Workspace and cross-tenant
EXCH-23 Max Test-MigrationServerAvailability retry for user with id {0} reached.Orchestrated cross-tenant migrationExchange Online migration batch errors: IMAP, cutover, Google Workspace and cross-tenant
EXCH-24 No license was found for the source recipient or the target recipient (Cross-tenant User Data Migration)Orchestrated cross-tenant migrationExchange Online migration batch errors: IMAP, cutover, Google Workspace and cross-tenant
EXCH-25 / EXCH-26 Cannot delete ongoing migration / Delete request for batch failedOrchestrated cross-tenant migrationExchange Online migration batch errors: IMAP, cutover, Google Workspace and cross-tenant
ExchangeGuid missmatch, expected '{0}', found '{1}' (also ArchiveGuid)Cross-tenant identity mappingExchange Online migration batch errors: IMAP, cutover, Google Workspace and cross-tenant
HTTP 409 Conflict: Cross Tenant Migration Job <ID> must be in final state before it can be deleted.Orchestrated migration API responseExchange Online migration batch errors: IMAP, cutover, Google Workspace and cross-tenant
HTTP 422 BadArgument: duplicateDisplayNameJob or minThresholdFailed (completeAfterDateTime)Orchestrated migration API responseExchange Online migration batch errors: IMAP, cutover, Google Workspace and cross-tenant
IM-003 User migration failed. User <X> is not mapped to an identity on tenant <Y>.Orchestrated cross-tenant migrationExchange Online migration batch errors: IMAP, cutover, Google Workspace and cross-tenant
Microsoft.Exchange.Rpc.ServerUnavailableException: Error 0x6ba (The RPC server is unavailable) from cli_NspiBindEAC / New-MigrationEndpointExchange Server to Exchange Online: every scenario, from first batch to last server
MIGR-001 Tenant authorization error. The tenants are not configured to support migration.Orchestrated cross-tenant migrationExchange Online migration batch errors: IMAP, cutover, Google Workspace and cross-tenant
MIGR-002 User migration failed. User <X> is not authorized to migrate.Orchestrated cross-tenant migrationExchange Online migration batch errors: IMAP, cutover, Google Workspace and cross-tenant
MIGR-003 User [X] migration failed. Please retry user migration.Orchestrated cross-tenant migrationExchange Online migration batch errors: IMAP, cutover, Google Workspace and cross-tenant
MIGR-004 Authorization error: organization relationship or security group membershipOrchestrated cross-tenant migrationExchange Online migration batch errors: IMAP, cutover, Google Workspace and cross-tenant
MigrationPermanentException: Special credentials are required in order to access this IMAP account (app password)Migration user error (Gmail over IMAP)Exchange Online migration batch errors: IMAP, cutover, Google Workspace and cross-tenant
MigrationTransientException: We weren't able to connect to the remote server (cutover endpoint)EAC / New-MigrationEndpointExchange Server to Exchange Online: every scenario, from first batch to last server
Missing required EmailAddresses. Expected '{0}', found '{1}'.Cross-tenant identity mappingExchange Online migration batch errors: IMAP, cutover, Google Workspace and cross-tenant
Row X has the wrong number of columns. Expected number: 3. Actual number: Y.EAC (CSV upload)Exchange Online migration batch errors: IMAP, cutover, Google Workspace and cross-tenant
The connection to the server imap.contoso.com could not be completed: IMAP server name doesn't resolveEAC (new IMAP endpoint or batch)Exchange Online migration batch errors: IMAP, cutover, Google Workspace and cross-tenant
The connection to the server Servername.contoso.com timed out after 00:00:15: IMAP port not reachableEAC (new IMAP endpoint or batch)Exchange Online migration batch errors: IMAP, cutover, Google Workspace and cross-tenant
The CSV file contains more than 50,000 rows. Please divide the file into two or more filesEAC (CSV upload)Exchange Online migration batch errors: IMAP, cutover, Google Workspace and cross-tenant
The mail user '{0}' is synchronized from an on-premises directory.Cross-tenant identity mappingExchange Online migration batch errors: IMAP, cutover, Google Workspace and cross-tenant
The migration batch already exists.EAC / New-MigrationBatchExchange Online migration batch errors: IMAP, cutover, Google Workspace and cross-tenant
This mailbox is full. Please free up some space so that email can be downloaded.Migration user error report“Mailbox full” in Exchange Online: quotas, Recoverable Items and the 554 5.2.2 NDR
Upload file can't be emptyEAC (CSV upload)Exchange Online migration batch errors: IMAP, cutover, Google Workspace and cross-tenant
We had trouble signing in to this account. Confirm that you're using the correct user name and password.Migration user error reportExchange Online migration batch errors: IMAP, cutover, Google Workspace and cross-tenantAnti-spam header values
Every code in the quick reference “Anti-spam message headers in Microsoft 365: SFV, CAT, SCL, BCL and compauth values”: what it means, the usual cause and the first check. Open the quick reference
action=pct.quarantine or action=pct.reject: DMARC policy applied to a percentage below 100Message header (Authentication-Results)Anti-spam message headers in Microsoft 365: SFV, CAT, SCL, BCL and compauth values
action=permerror or action=temperror: DMARC evaluation error (bad record or DNS)Message header (Authentication-Results)Anti-spam message headers in Microsoft 365: SFV, CAT, SCL, BCL and compauth values
BCL:4 to BCL:7: bulk sender with a mixed number of complaintsMessage header (X-Microsoft-Antispam)Anti-spam message headers in Microsoft 365: SFV, CAT, SCL, BCL and compauth values
BCL:8 or BCL:9: bulk sender with a high number of complaintsMessage header (X-Microsoft-Antispam)Anti-spam message headers in Microsoft 365: SFV, CAT, SCL, BCL and compauth values
CAT:AMP: the anti-malware policy acted on the messageMessage header (X-Forefront-Antispam-Report)Anti-spam message headers in Microsoft 365: SFV, CAT, SCL, BCL and compauth values
CAT:BIMP: brand impersonation (Defender for Office 365)Message header (X-Forefront-Antispam-Report)Anti-spam message headers in Microsoft 365: SFV, CAT, SCL, BCL and compauth values
CAT:DIMP: domain impersonation (Defender for Office 365)Message header (X-Forefront-Antispam-Report)Anti-spam message headers in Microsoft 365: SFV, CAT, SCL, BCL and compauth values
CAT:FTBP: blocked by the anti-malware common attachments filterMessage header (X-Forefront-Antispam-Report)Anti-spam message headers in Microsoft 365: SFV, CAT, SCL, BCL and compauth values
CAT:GIMP: mailbox intelligence impersonation (Defender for Office 365)Message header (X-Forefront-Antispam-Report)Anti-spam message headers in Microsoft 365: SFV, CAT, SCL, BCL and compauth values
CAT:INTOS: intra-organization phishingMessage header (X-Forefront-Antispam-Report)Investigating a compromised Exchange Online mailbox: rules, forwarding, sign-ins and audit
CAT:MALW: malwareMessage header (X-Forefront-Antispam-Report)Anti-spam message headers in Microsoft 365: SFV, CAT, SCL, BCL and compauth values
CAT:OSPM: outbound spam sent by a user in your organizationMessage header (X-Forefront-Antispam-Report)Users blocked from sending in Exchange Online: Restricted entities and NDR 550 5.1.8
CAT:SAP: Safe Attachments detection (Defender for Office 365)Message header (X-Forefront-Antispam-Report)Safe Links and Safe Attachments: troubleshooting blocked links, missing rewrites and delays
CAT:UIMP: user impersonation (Defender for Office 365)Message header (X-Forefront-Antispam-Report)Anti-spam message headers in Microsoft 365: SFV, CAT, SCL, BCL and compauth values
compauth reason=501 or 502: DMARC not enforced for a valid NDRMessage header (Authentication-Results)Anti-spam message headers in Microsoft 365: SFV, CAT, SCL, BCL and compauth values
compauth=fail reason=002: your organization blocks this sender/domain pair from spoofingMessage header (Authentication-Results)Tenant Allow/Block List in Defender for Office 365: senders, URLs, files and spoofing
compauth=fail reason=010: DMARC failure for one of your accepted domains (self-to-self spoofing)Message header (Authentication-Results)Anti-spam message headers in Microsoft 365: SFV, CAT, SCL, BCL and compauth values
compauth=fail reason=601: the sending domain is one of your accepted domainsMessage header (Authentication-Results)Anti-spam message headers in Microsoft 365: SFV, CAT, SCL, BCL and compauth values
compauth=none reason=3xx or 4xx: composite authentication not checked or bypassedMessage header (Authentication-Results)Anti-spam message headers in Microsoft 365: SFV, CAT, SCL, BCL and compauth values
compauth=none reason=905: DMARC not enforced due to complex routingMessage header (Authentication-Results)Enhanced Filtering for Connectors: a third-party email gateway in front of Exchange Online
compauth=pass reason=100: SPF or DKIM passed and aligns with the From domainMessage header (Authentication-Results)Anti-spam message headers in Microsoft 365: SFV, CAT, SCL, BCL and compauth values
compauth=pass reason=101: DKIM-signed by the From address domainMessage header (Authentication-Results)Anti-spam message headers in Microsoft 365: SFV, CAT, SCL, BCL and compauth values
compauth=pass reason=102: SPF passed and the MAIL FROM and From domains alignMessage header (Authentication-Results)Anti-spam message headers in Microsoft 365: SFV, CAT, SCL, BCL and compauth values
compauth=pass reason=103 or 104: From domain aligns with the source IP's PTR recordMessage header (Authentication-Results)Anti-spam message headers in Microsoft 365: SFV, CAT, SCL, BCL and compauth values
compauth=pass reason=108: DKIM broken by body changes on earlier legitimate hopsMessage header (Authentication-Results)Anti-spam message headers in Microsoft 365: SFV, CAT, SCL, BCL and compauth values
compauth=pass reason=109: no DMARC record, but the message would pass anywayMessage header (Authentication-Results)Anti-spam message headers in Microsoft 365: SFV, CAT, SCL, BCL and compauth values
compauth=pass reason=111: DMARC error, but the SPF or DKIM domain aligns with FromMessage header (Authentication-Results)Anti-spam message headers in Microsoft 365: SFV, CAT, SCL, BCL and compauth values
compauth=pass reason=112: DNS timeout prevented retrieving the DMARC recordMessage header (Authentication-Results)Anti-spam message headers in Microsoft 365: SFV, CAT, SCL, BCL and compauth values
compauth=pass reason=115: sent from a Microsoft 365 organization where the From domain is acceptedMessage header (Authentication-Results)Anti-spam message headers in Microsoft 365: SFV, CAT, SCL, BCL and compauth values
compauth=pass reason=116: From domain's MX aligns with the connecting IP's PTR recordMessage header (Authentication-Results)Anti-spam message headers in Microsoft 365: SFV, CAT, SCL, BCL and compauth values
compauth=pass reason=130: a trusted ARC sealer overrode the DMARC failureMessage header (Authentication-Results)Enhanced Filtering for Connectors: a third-party email gateway in front of Exchange Online
compauth=pass reason=701 to 704: DMARC not enforced, history of legitimate mailMessage header (Authentication-Results)Anti-spam message headers in Microsoft 365: SFV, CAT, SCL, BCL and compauth values
compauth=softpass reason=201 or 202: soft pass based on PTR record alignmentMessage header (Authentication-Results)Anti-spam message headers in Microsoft 365: SFV, CAT, SCL, BCL and compauth values
dkim=fail (body hash did not verify): message body changed after signingMessage header (Authentication-Results)Enhanced Filtering for Connectors: a third-party email gateway in front of Exchange Online
dkim=fail (no key for signature): DKIM public key not found in DNSMessage header (Authentication-Results)SPF, DKIM and DMARC for your Microsoft 365 custom domain: a practical setup guide
dkim=none: the message wasn't DKIM-signedMessage header (Authentication-Results)Anti-spam message headers in Microsoft 365: SFV, CAT, SCL, BCL and compauth values
dmarc=bestguesspass: no DMARC record, but the message would have passedMessage header (Authentication-Results)Anti-spam message headers in Microsoft 365: SFV, CAT, SCL, BCL and compauth values
dmarc=fail action=oreject: DMARC failed and the sender publishes p=rejectMessage header (Authentication-Results)SPF, DKIM and DMARC for your Microsoft 365 custom domain: a practical setup guide
dmarc=fail action=quarantine: DMARC failed and the sender publishes p=quarantineMessage header (Authentication-Results)Anti-spam message headers in Microsoft 365: SFV, CAT, SCL, BCL and compauth values
dmarc=none: no DMARC TXT record for the From domainMessage header (Authentication-Results)Anti-spam message headers in Microsoft 365: SFV, CAT, SCL, BCL and compauth values
IPV:CAL: spam filtering skipped, source IP is on the IP Allow ListMessage header (X-Forefront-Antispam-Report)Anti-spam message headers in Microsoft 365: SFV, CAT, SCL, BCL and compauth values
IPV:NLI: source IP not found on any IP reputation listMessage header (X-Forefront-Antispam-Report)Anti-spam message headers in Microsoft 365: SFV, CAT, SCL, BCL and compauth values
SCL:5 or SCL:6: spam on the legacy SCL scale (CAT decides in the cloud)Message header (X-Forefront-Antispam-Report)Anti-spam message headers in Microsoft 365: SFV, CAT, SCL, BCL and compauth values
SCL:9: high confidence spam on the legacy SCL scaleMessage header (X-Forefront-Antispam-Report)Anti-spam message headers in Microsoft 365: SFV, CAT, SCL, BCL and compauth values
SCL:-1: spam filtering bypass requested, for example by a mail flow ruleMessage header (X-Forefront-Antispam-Report)Anti-spam message headers in Microsoft 365: SFV, CAT, SCL, BCL and compauth values
SFTY:9.25: first contact safety tipMessage header (X-Forefront-Antispam-Report)Anti-spam message headers in Microsoft 365: SFV, CAT, SCL, BCL and compauth values
SFV:NSPM: spam filtering marked the message as not spamMessage header (X-Forefront-Antispam-Report)Anti-spam message headers in Microsoft 365: SFV, CAT, SCL, BCL and compauth values
SFV:SFE: filtering skipped, sender is in the user's Safe Senders listMessage header (X-Forefront-Antispam-Report)Legitimate email landing in Junk: how EOP decides and the right way to fix it
SFV:SKA: filtering skipped, sender is on an anti-spam policy allow listMessage header (X-Forefront-Antispam-Report)Legitimate email landing in Junk: how EOP decides and the right way to fix it
SFV:SKI: filtering skipped, source IP is on the IP Allow ListMessage header (X-Forefront-Antispam-Report)Anti-spam message headers in Microsoft 365: SFV, CAT, SCL, BCL and compauth values
SFV:SKN: spam filtering bypassed by a mail flow ruleMessage header (X-Forefront-Antispam-Report)Legitimate email landing in Junk: how EOP decides and the right way to fix it
SFV:SKQ: message released from quarantineMessage header (X-Forefront-Antispam-Report)Handling false-positive quarantined email in Defender for Office 365 the right way
SFV:SKS: marked as spam before filtering (mail flow rule or on-premises verdict)Message header (X-Forefront-Antispam-Report)Anti-spam message headers in Microsoft 365: SFV, CAT, SCL, BCL and compauth values
spf=fail: hard fail, source isn't in the domain's SPF record (-all)Message header (Authentication-Results)SPF, DKIM and DMARC for your Microsoft 365 custom domain: a practical setup guide
spf=neutral: source isn't in the SPF record and the domain gives no instruction (?all)Message header (Authentication-Results)Anti-spam message headers in Microsoft 365: SFV, CAT, SCL, BCL and compauth values
spf=none: the domain has no SPF record, or it doesn't evaluate to a resultMessage header (Authentication-Results)Anti-spam message headers in Microsoft 365: SFV, CAT, SCL, BCL and compauth values
spf=softfail: soft fail, source isn't in the domain's SPF record (~all)Message header (Authentication-Results)SPF, DKIM and DMARC for your Microsoft 365 custom domain: a practical setup guide
spf=temperror: temporary error, such as a DNS failure, during the SPF checkMessage header (Authentication-Results)Anti-spam message headers in Microsoft 365: SFV, CAT, SCL, BCL and compauth values
X-CustomSpam: an Advanced Spam Filter (ASF) setting matchedMessage header (X-CustomSpam)Anti-spam message headers in Microsoft 365: SFV, CAT, SCL, BCL and compauth valuesASR rules & event IDs
Every code in the quick reference “Attack surface reduction (ASR) rules: every rule name, GUID, event ID and Intune setting”: what it means, the usual cause and the first check. Open the quick reference
3b576869-a4ec-4529-8536-b80a7769e899: Block Office applications from creating executable contentEvent Viewer (Windows Defender/Operational)Attack surface reduction (ASR) rules: every rule name, GUID, event ID and Intune setting
5beb7efe-fd9a-4556-801d-275e5ffc04cc: Block execution of potentially obfuscated scriptsEvent Viewer (Windows Defender/Operational)Attack surface reduction (ASR) rules: every rule name, GUID, event ID and Intune setting
9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2: Block credential stealing from the Windows local security authority subsystemEvent Viewer (Windows Defender/Operational)Rolling out ASR rules safely: audit mode, exclusions and advanced hunting
33ddedf1-c6e0-47cb-833e-de6133960387: Block rebooting machine in Safe ModeEvent Viewer (Windows Defender/Operational)Attack surface reduction (ASR) rules: every rule name, GUID, event ID and Intune setting
56a863a9-875e-4185-98a7-b882c64b5ce5: Block abuse of exploited vulnerable signed driversEvent Viewer (Windows Defender/Operational)Rolling out ASR rules safely: audit mode, exclusions and advanced hunting
92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b: Block Win32 API calls from Office macrosEvent Viewer (Windows Defender/Operational)Attack surface reduction (ASR) rules: every rule name, GUID, event ID and Intune setting
7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c: Block Adobe Reader from creating child processesEvent Viewer (Windows Defender/Operational)Attack surface reduction (ASR) rules: every rule name, GUID, event ID and Intune setting
75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84: Block Office applications from injecting code into other processesEvent Viewer (Windows Defender/Operational)Attack surface reduction (ASR) rules: every rule name, GUID, event ID and Intune setting
01443614-cd74-433a-b99e-2ecdc07bfc25: Block executable files unless they meet a prevalence, age, or trusted list criterionEvent Viewer (Windows Defender/Operational)Attack surface reduction (ASR) rules: every rule name, GUID, event ID and Intune setting
26190899-1602-49e8-8b27-eb1d0a1ce869: Block Office communication application from creating child processesEvent Viewer (Windows Defender/Operational)Attack surface reduction (ASR) rules: every rule name, GUID, event ID and Intune setting
a8f5898e-1dc8-49a9-9878-85004b8a61e6: Block Webshell creation for ServersEvent Viewer (Windows Defender/Operational)Attack surface reduction (ASR) rules: every rule name, GUID, event ID and Intune setting
AsrAbusedSystemToolAudited / AsrAbusedSystemToolBlocked / AsrAbusedSystemToolWarnBypassed: copied system tools ruleAdvanced hunting (DeviceEvents)Attack surface reduction (ASR) rules: every rule name, GUID, event ID and Intune setting
AsrAdobeReaderChildProcessAudited / AsrAdobeReaderChildProcessBlocked: Adobe Reader child process ruleAdvanced hunting (DeviceEvents)Attack surface reduction (ASR) rules: every rule name, GUID, event ID and Intune setting
AsrExecutableEmailContentAudited / AsrExecutableEmailContentBlocked: executable content from email ruleAdvanced hunting (DeviceEvents)Attack surface reduction (ASR) rules: every rule name, GUID, event ID and Intune setting
AsrExecutableOfficeContentAudited / AsrExecutableOfficeContentBlocked: Office executable content ruleAdvanced hunting (DeviceEvents)Attack surface reduction (ASR) rules: every rule name, GUID, event ID and Intune setting
AsrLsassCredentialTheftAudited / AsrLsassCredentialTheftBlocked: LSASS credential theft ruleAdvanced hunting (DeviceEvents)Attack surface reduction (ASR) rules: every rule name, GUID, event ID and Intune setting
AsrObfuscatedScriptAudited / AsrObfuscatedScriptBlocked: potentially obfuscated scripts ruleAdvanced hunting (DeviceEvents)Attack surface reduction (ASR) rules: every rule name, GUID, event ID and Intune setting
AsrOfficeChildProcessBlocked: Office child process rule fired in Block modeAdvanced hunting (DeviceEvents)Rolling out ASR rules safely: audit mode, exclusions and advanced hunting
AsrOfficeCommAppChildProcessAudited / AsrOfficeCommAppChildProcessBlocked: Outlook child process ruleAdvanced hunting (DeviceEvents)Attack surface reduction (ASR) rules: every rule name, GUID, event ID and Intune setting
AsrOfficeMacroWin32ApiCallsAudited / AsrOfficeMacroWin32ApiCallsBlocked: Win32 API calls from macros ruleAdvanced hunting (DeviceEvents)Attack surface reduction (ASR) rules: every rule name, GUID, event ID and Intune setting
AsrOfficeProcessInjectionAudited / AsrOfficeProcessInjectionBlocked: Office code injection ruleAdvanced hunting (DeviceEvents)Attack surface reduction (ASR) rules: every rule name, GUID, event ID and Intune setting
AsrPersistenceThroughWmiAudited / AsrPersistenceThroughWmiBlocked: WMI event subscription persistence ruleAdvanced hunting (DeviceEvents)Attack surface reduction (ASR) rules: every rule name, GUID, event ID and Intune setting
AsrPsexecWmiChildProcessAudited / AsrPsexecWmiChildProcessBlocked: PsExec and WMI process creation ruleAdvanced hunting (DeviceEvents)Attack surface reduction (ASR) rules: every rule name, GUID, event ID and Intune setting
AsrRansomwareAudited / AsrRansomwareBlocked: advanced ransomware protection ruleAdvanced hunting (DeviceEvents)Attack surface reduction (ASR) rules: every rule name, GUID, event ID and Intune setting
AsrSafeModeRebootedAudited / AsrSafeModeRebootBlocked / AsrSafeModeRebootWarnBypassed: Safe Mode reboot ruleAdvanced hunting (DeviceEvents)Attack surface reduction (ASR) rules: every rule name, GUID, event ID and Intune setting
AsrScriptExecutableDownloadAudited / AsrScriptExecutableDownloadBlocked: JavaScript or VBScript download ruleAdvanced hunting (DeviceEvents)Attack surface reduction (ASR) rules: every rule name, GUID, event ID and Intune setting
AsrUntrustedExecutableAudited / AsrUntrustedExecutableBlocked: prevalence, age or trusted list ruleAdvanced hunting (DeviceEvents)Attack surface reduction (ASR) rules: every rule name, GUID, event ID and Intune setting
AsrUntrustedUsbProcessAudited / AsrUntrustedUsbProcessBlocked: untrusted USB process ruleAdvanced hunting (DeviceEvents)Attack surface reduction (ASR) rules: every rule name, GUID, event ID and Intune setting
AsrVulnerableSignedDriverAudited / AsrVulnerableSignedDriverBlocked: vulnerable signed driver ruleAdvanced hunting (DeviceEvents)Attack surface reduction (ASR) rules: every rule name, GUID, event ID and Intune setting
b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4: Block untrusted and unsigned processes that run from USBEvent Viewer (Windows Defender/Operational)Attack surface reduction (ASR) rules: every rule name, GUID, event ID and Intune setting
be9ba2d9-53ea-4cdc-84e5-9b1eeee46550: Block executable content from email client and webmailEvent Viewer (Windows Defender/Operational)Attack surface reduction (ASR) rules: every rule name, GUID, event ID and Intune setting
c1db55ab-c21a-4637-bb3f-a12568109d35: Use advanced protection against ransomwareEvent Viewer (Windows Defender/Operational)Attack surface reduction (ASR) rules: every rule name, GUID, event ID and Intune setting
c0033c00-d16d-4114-a5a0-dc9b3a7d2ceb: Block use of copied or impersonated system toolsEvent Viewer (Windows Defender/Operational)Attack surface reduction (ASR) rules: every rule name, GUID, event ID and Intune setting
d1e49aac-8f56-4280-b9ba-993a6d77406c: Block process creations originating from PSExec and WMI commandsEvent Viewer (Windows Defender/Operational)Rolling out ASR rules safely: audit mode, exclusions and advanced hunting
d3e037e1-3eb8-44c8-a917-57927947596d: Block JavaScript or VBScript from launching downloaded executable contentEvent Viewer (Windows Defender/Operational)Attack surface reduction (ASR) rules: every rule name, GUID, event ID and Intune setting
d4f940ab-401b-4efc-aadc-ad5f3c50688a: Block all Office applications from creating child processesEvent Viewer (Windows Defender/Operational)Rolling out ASR rules safely: audit mode, exclusions and advanced hunting
e6db77e5-3df2-4cf1-b95a-636979351e5b: Block persistence through WMI event subscriptionEvent Viewer (Windows Defender/Operational)Rolling out ASR rules safely: audit mode, exclusions and advanced hunting
Event ID 1123 (Windows Defender): controlled folder access blocked an actionEvent Viewer (Windows Defender/Operational)Attack surface reduction (ASR) rules: every rule name, GUID, event ID and Intune setting
Event ID 1124 (Windows Defender): controlled folder access audited an actionEvent Viewer (Windows Defender/Operational)Attack surface reduction (ASR) rules: every rule name, GUID, event ID and Intune setting
Event ID 1128 (Windows Defender): controlled folder access audited a sector writeEvent Viewer (Windows Defender/Operational)Attack surface reduction (ASR) rules: every rule name, GUID, event ID and Intune settingDefender Antivirus events & codes
Every code in the quick reference “Microsoft Defender Antivirus event IDs and error codes: a quick reference”: what it means, the usual cause and the first check. Open the quick reference
0x8050800C ERR_MP_BAD_INPUT_DATA: possible problem with the security productDefender event (Error Code field)Microsoft Defender Antivirus event IDs and error codes: a quick reference
0x80508007 ERR_MP_NO_MEMORY: might be out of memoryDefender event (Error Code field)Microsoft Defender Antivirus event IDs and error codes: a quick reference
0x80508020 ERR_MP_BAD_CONFIGURATION: possible engine configuration errorDefender event (Error Code field)Microsoft Defender Antivirus event IDs and error codes: a quick reference
0x80508022 ERR_MP_REBOOT_REQUIRED: restart required to complete threat removalDefender event (Error Code field)Microsoft Defender Antivirus event IDs and error codes: a quick reference
0x80508023 ERR_MP_THREAT_NOT_FOUND: threat no longer present or scan blockedDefender event (Error Code field)Microsoft Defender Antivirus event IDs and error codes: a quick reference
0x80508024 ERR_MP_FULL_SCAN_REQUIRED: full system scan might be requiredDefender event (Error Code field)Microsoft Defender Antivirus event IDs and error codes: a quick reference
0x80508025 ERR_MP_MANUAL_STEPS_REQUIRED: manual steps required to complete threat removalDefender event (Error Code field)Microsoft Defender Antivirus event IDs and error codes: a quick reference
0x80508026 ERR_MP_REMOVE_NOT_SUPPORTED: removal inside the container type not supportedDefender event (Error Code field)Microsoft Defender Antivirus event IDs and error codes: a quick reference
0x80508027 ERR_MP_REMOVE_LOW_MEDIUM_DISABLED: removal of low and medium threats disabledDefender event (Error Code field)Microsoft Defender Antivirus event IDs and error codes: a quick reference
0x80508029 ERROR_MP_RESCAN_REQUIRED: rescan of the threat requiredDefender event (Error Code field)Microsoft Defender Antivirus event IDs and error codes: a quick reference
0x80508030 ERROR_MP_CALLISTO_REQUIRED: offline scan requiredDefender event (Error Code field)Microsoft Defender Antivirus event IDs and error codes: a quick reference
0x80508031 ERROR_MP_PLATFORM_OUTDATED: platform version not supportedDefender event (Error Code field)Defender Antivirus platform and engine updates: channels, gradual rollout and rollback
0x805080211 ERR_MP_QUARANTINE_FAILED: threat couldn't be quarantinedDefender event (Error Code field)Microsoft Defender Antivirus event IDs and error codes: a quick reference
Event ID 1000 MALWAREPROTECTION_SCAN_STARTED: an antimalware scan startedEvent Viewer (Windows Defender/Operational)Defender Antivirus high CPU (MsMpEng.exe): find the cause with the performance analyzer
Event ID 1001 MALWAREPROTECTION_SCAN_COMPLETED: an antimalware scan finishedEvent Viewer (Windows Defender/Operational)Defender Antivirus high CPU (MsMpEng.exe): find the cause with the performance analyzer
Event ID 1002 MALWAREPROTECTION_SCAN_CANCELLED: scan stopped before it finishedEvent Viewer (Windows Defender/Operational)Defender Antivirus high CPU (MsMpEng.exe): find the cause with the performance analyzer
Event ID 1006 MALWAREPROTECTION_MALWARE_DETECTED: engine found malware or potentially unwanted softwareEvent Viewer (Windows Defender/Operational)Microsoft Defender Antivirus event IDs and error codes: a quick reference
Event ID 1007 MALWAREPROTECTION_MALWARE_ACTION_TAKEN: action taken to protect the systemEvent Viewer (Windows Defender/Operational)Microsoft Defender Antivirus event IDs and error codes: a quick reference
Event ID 1008 MALWAREPROTECTION_MALWARE_ACTION_FAILED: action against malware failedEvent Viewer (Windows Defender/Operational)Microsoft Defender Antivirus event IDs and error codes: a quick reference
Event ID 1009 MALWAREPROTECTION_QUARANTINE_RESTORE: item restored from quarantineEvent Viewer (Windows Defender/Operational)Microsoft Defender Antivirus event IDs and error codes: a quick reference
Event ID 1010 MALWAREPROTECTION_QUARANTINE_RESTORE_FAILED: item couldn't be restored from quarantineEvent Viewer (Windows Defender/Operational)Microsoft Defender Antivirus event IDs and error codes: a quick reference
Event ID 1012 MALWAREPROTECTION_QUARANTINE_DELETE_FAILED: item couldn't be deleted from quarantineEvent Viewer (Windows Defender/Operational)Microsoft Defender Antivirus event IDs and error codes: a quick reference
Event ID 1015 MALWAREPROTECTION_BEHAVIOR_DETECTED: suspicious behavior detectedEvent Viewer (Windows Defender/Operational)Microsoft Defender Antivirus event IDs and error codes: a quick reference
Event ID 1116 MALWAREPROTECTION_STATE_MALWARE_DETECTED: malware or potentially unwanted software detectedEvent Viewer (Windows Defender/Operational)Microsoft Defender Antivirus event IDs and error codes: a quick reference
Event ID 1117 MALWAREPROTECTION_STATE_MALWARE_ACTION_TAKEN: action taken on a detected threatEvent Viewer (Windows Defender/Operational)Microsoft Defender Antivirus event IDs and error codes: a quick reference
Event ID 1118 MALWAREPROTECTION_STATE_MALWARE_ACTION_FAILED: noncritical remediation failureEvent Viewer (Windows Defender/Operational)Microsoft Defender Antivirus event IDs and error codes: a quick reference
Event ID 1119 MALWAREPROTECTION_STATE_MALWARE_ACTION_CRITICALLY_FAILED: critical remediation failure, device might be unprotectedEvent Viewer (Windows Defender/Operational)Microsoft Defender Antivirus event IDs and error codes: a quick reference
Event ID 1121 (Windows Defender): attack surface reduction rule fired in block modeEvent Viewer (Windows Defender/Operational)Rolling out ASR rules safely: audit mode, exclusions and advanced hunting
Event ID 1127 MALWAREPROTECTION_FOLDER_GUARD_SECTOR_BLOCK: controlled folder access blocked a disk sector changeEvent Viewer (Windows Defender/Operational)Microsoft Defender Antivirus event IDs and error codes: a quick reference
Event ID 1150 MALWAREPROTECTION_SERVICE_HEALTHY: client running and healthy (hourly)Event Viewer (Windows Defender/Operational)Microsoft Defender Antivirus event IDs and error codes: a quick reference
Event ID 1151 MALWAREPROTECTION_SERVICE_HEALTH_REPORT: client health reportEvent Viewer (Windows Defender/Operational)Microsoft Defender Antivirus event IDs and error codes: a quick reference
Event ID 2000 MALWAREPROTECTION_SIGNATURE_UPDATED: security intelligence updatedEvent Viewer (Windows Defender/Operational)Microsoft Defender Antivirus event IDs and error codes: a quick reference
Event ID 2001 MALWAREPROTECTION_SIGNATURE_UPDATE_FAILED: security intelligence update failedEvent Viewer (Windows Defender/Operational)Defender Antivirus platform and engine updates: channels, gradual rollout and rollback
Event ID 2002 MALWAREPROTECTION_ENGINE_UPDATED: antimalware engine updatedEvent Viewer (Windows Defender/Operational)Microsoft Defender Antivirus event IDs and error codes: a quick reference
Event ID 2003 MALWAREPROTECTION_ENGINE_UPDATE_FAILED: antimalware engine update failedEvent Viewer (Windows Defender/Operational)Defender Antivirus platform and engine updates: channels, gradual rollout and rollback
Event ID 2004 MALWAREPROTECTION_SIGNATURE_REVERSION: definitions failed to load, reverting to known-good setEvent Viewer (Windows Defender/Operational)Microsoft Defender Antivirus event IDs and error codes: a quick reference
Event ID 2005 MALWAREPROTECTION_ENGINE_UPDATE_PLATFORMOUTOFDATE: engine failed to load because the platform is out of dateEvent Viewer (Windows Defender/Operational)Defender Antivirus platform and engine updates: channels, gradual rollout and rollback
Event ID 2006 MALWAREPROTECTION_PLATFORM_UPDATE_FAILED: platform update failedEvent Viewer (Windows Defender/Operational)Defender Antivirus platform and engine updates: channels, gradual rollout and rollback
Event ID 2007 MALWAREPROTECTION_PLATFORM_ALMOSTOUTOFDATE: platform will soon be out of dateEvent Viewer (Windows Defender/Operational)Defender Antivirus platform and engine updates: channels, gradual rollout and rollback
Event ID 2010 MALWAREPROTECTION_SIGNATURE_FASTPATH_UPDATED: cloud protection retrieved extra security intelligenceEvent Viewer (Windows Defender/Operational)Microsoft Defender Antivirus event IDs and error codes: a quick reference
Event ID 2011 MALWAREPROTECTION_SIGNATURE_FASTPATH_DELETED: out-of-date dynamic definitions deletedEvent Viewer (Windows Defender/Operational)Microsoft Defender Antivirus event IDs and error codes: a quick reference
Event ID 2012 MALWAREPROTECTION_SIGNATURE_FASTPATH_UPDATE_FAILED: error using the Dynamic Signature ServiceEvent Viewer (Windows Defender/Operational)Microsoft Defender Antivirus event IDs and error codes: a quick reference
Event ID 2021 MALWAREPROTECTION_CLOUD_CLEAN_RESTORE_FILE_DOWNLOAD_FAILED: failed to download a clean fileEvent Viewer (Windows Defender/Operational)Microsoft Defender Antivirus event IDs and error codes: a quick reference
Event ID 2031 MALWAREPROTECTION_OFFLINE_SCAN_INSTALL_FAILED: offline scan couldn't be downloaded and configuredEvent Viewer (Windows Defender/Operational)Microsoft Defender Antivirus event IDs and error codes: a quick reference
Event ID 2041 MALWAREPROTECTION_OS_EOL: antimalware support for this operating system has endedEvent Viewer (Windows Defender/Operational)Microsoft Defender Antivirus event IDs and error codes: a quick reference
Event ID 2042 MALWAREPROTECTION_PROTECTION_EOL: engine no longer protects this operating systemEvent Viewer (Windows Defender/Operational)Microsoft Defender Antivirus event IDs and error codes: a quick reference
Event ID 2050 MALWAREPROTECTION_SAMPLESUBMISSION_UPLOADED: file submitted for sample analysisEvent Viewer (Windows Defender/Operational)Microsoft Defender Antivirus event IDs and error codes: a quick reference
Event ID 3002 MALWAREPROTECTION_RTP_FEATURE_FAILURE: real-time protection encountered an error and failedEvent Viewer (Windows Defender/Operational)Microsoft Defender Antivirus event IDs and error codes: a quick reference
Event ID 3007 MALWAREPROTECTION_RTP_FEATURE_RECOVERED: real-time protection recovered from a failureEvent Viewer (Windows Defender/Operational)Microsoft Defender Antivirus event IDs and error codes: a quick reference
Event ID 5000 MALWAREPROTECTION_RTP_ENABLED: real-time protection enabledEvent Viewer (Windows Defender/Operational)Microsoft Defender Antivirus event IDs and error codes: a quick reference
Event ID 5001 MALWAREPROTECTION_RTP_DISABLED: real-time protection disabledEvent Viewer (Windows Defender/Operational)Defender Antivirus settings not applying from Intune: a troubleshooting checklist
Event ID 5004 MALWAREPROTECTION_RTP_FEATURE_CONFIGURED: real-time protection configuration changedEvent Viewer (Windows Defender/Operational)Defender Antivirus settings not applying from Intune: a troubleshooting checklist
Event ID 5007 MALWAREPROTECTION_CONFIG_CHANGED: antimalware platform configuration changedEvent Viewer (Windows Defender/Operational)Defender Antivirus settings not applying from Intune: a troubleshooting checklist
Event ID 5008 MALWAREPROTECTION_ENGINE_FAILURE: antimalware engine encountered an error and failedEvent Viewer (Windows Defender/Operational)Microsoft Defender Antivirus event IDs and error codes: a quick reference
Event ID 5010 MALWAREPROTECTION_ANTISPYWARE_DISABLED: scanning for malware and potentially unwanted software disabledEvent Viewer (Windows Defender/Operational)Defender Antivirus settings not applying from Intune: a troubleshooting checklist
Event ID 5012 MALWAREPROTECTION_ANTIVIRUS_DISABLED: scanning for viruses disabledEvent Viewer (Windows Defender/Operational)Defender Antivirus settings not applying from Intune: a troubleshooting checklist
Event ID 5013 (Windows Defender): tamper protection blocked a change to Defender AntivirusEvent Viewer (Windows Defender/Operational)Tamper protection and Intune: why a Defender setting won't change, and how to fix it
Event ID 5100 MALWAREPROTECTION_EXPIRATION_WARNING_STATE: antimalware platform will expire soonEvent Viewer (Windows Defender/Operational)Microsoft Defender Antivirus event IDs and error codes: a quick reference
Event ID 5101 MALWAREPROTECTION_DISABLED_EXPIRED_STATE: antimalware platform expired, protection disabledEvent Viewer (Windows Defender/Operational)Microsoft Defender Antivirus event IDs and error codes: a quick referenceDefender for Identity health issues
Every code in the quick reference “Defender for Identity health issues: every sensor and global alert, with severity and fix”: what it means, the usual cause and the first check. Open the quick reference
A domain controller is unreachable by a sensor: the sensor can't open LDAP connections to itDefender portal (Sensor health issues)Defender for Identity health issues: every sensor and global alert, with severity and fix
All/Some of the selected capture network adapters on the Defender for Identity sensor are disabled or disconnectedDefender portal (Sensor health issues)Defender for Identity health issues: every sensor and global alert, with severity and fix
Auditing for AD CS servers isn't enabled as required: audit policy or CA audit filter missingDefender portal (Sensor health issues)Defender for Identity sensors: installation and health issues on domain controllers
Auditing on the ADFS container is not enabled as requiredDefender portal (Global health issues)Defender for Identity sensors: installation and health issues on domain controllers
Auditing on the Configuration container is not enabled as requiredDefender portal (Global health issues)Defender for Identity sensors: installation and health issues on domain controllers
Directory Services Advanced Auditing is not enabled as required: audit subcategories missingDefender portal (Sensor health issues)Defender for Identity sensors: installation and health issues on domain controllers
Directory Services Object Auditing is not enabled as required: domain SACL entries missingDefender portal (Global health issues)Defender for Identity sensors: installation and health issues on domain controllers
Low success rate of active name resolution: IP-to-name resolution fails over 90% of the timeDefender portal (Sensor/Global health issues)Defender for Identity health issues: every sensor and global alert, with severity and fix
Network configuration mismatch for sensors running on VMware: VM network settings affect the sensorDefender portal (Sensor health issues)Defender for Identity health issues: every sensor and global alert, with severity and fix
No network traffic received from domain controller: port mirroring missing or brokenDefender portal (Sensor/Global health issues)Defender for Identity health issues: every sensor and global alert, with severity and fix
Radius accounting (VPN integration) data ingestion failures: shared secret mismatchDefender portal (Health issues)Defender for Identity health issues: every sensor and global alert, with severity and fix
Read-only user password expired: sensors stop running and collect no new dataDefender portal (Global health issues)Defender for Identity sensors: installation and health issues on domain controllers
Read-only user password to expire shortly: Directory Service account password expires within 30 daysDefender portal (Global health issues)Defender for Identity sensors: installation and health issues on domain controllers
Sensor failed to retrieve Microsoft Entra Connect service configurationDefender portal (Sensor health issues)Defender for Identity health issues: every sensor and global alert, with severity and fix
Sensor failed to write to the custom log path: SensorCustomLogLocation can't be createdDefender portal (Sensor health issues)Defender for Identity health issues: every sensor and global alert, with severity and fix
Sensor outdated (v2): the sensor version can't communicate with the cloud serviceDefender portal (Sensor/Global health issues)Defender for Identity health issues: every sensor and global alert, with severity and fix
Sensor outdated (v3): the server lacks the required Windows cumulative updateDefender portal (Sensor/Global health issues)Defender for Identity sensors: installation and health issues on domain controllers
Sensor running on an operating system that will soon become unsupportedDefender portal (Sensor health issues)Defender for Identity health issues: every sensor and global alert, with severity and fix
Sensor running on an unsupported operating systemDefender portal (Sensor health issues)Defender for Identity health issues: every sensor and global alert, with severity and fix
Some ETW events are not being analyzed: more ETW events than the sensor can processDefender portal (Sensor/Global health issues)Defender for Identity health issues: every sensor and global alert, with severity and fix
Some network traffic could not be analyzed: more traffic than the sensor can processDefender portal (Sensor/Global health issues)Defender for Identity health issues: every sensor and global alert, with severity and fix
Some Windows events are not being analyzed: more events than the sensor can processDefender portal (Sensor/Global health issues)Defender for Identity health issues: every sensor and global alert, with severity and fixDefender sensor (SENSE) events
Every code in the quick reference “Defender for Endpoint SENSE event IDs: a quick reference for onboarding and connectivity”: what it means, the usual cause and the first check. Open the quick reference
Event ID 1 (System): SenseNdrPktmon real-time session backing file reached its maximum sizeEvent Viewer (System log)Defender for Endpoint SENSE event IDs: a quick reference for onboarding and connectivity
Event ID 3 (SENSE): Defender for Endpoint service failed to startEvent Viewer (Microsoft-Windows-SENSE)Defender for Endpoint onboarding failures: SENSE event IDs, script errors and what they mean
Event ID 8 (SENSE): service failed to clean its configurationEvent Viewer (Microsoft-Windows-SENSE)Defender for Endpoint SENSE event IDs: a quick reference for onboarding and connectivity
Event ID 9 (SENSE): service failed to change its start typeEvent Viewer (Microsoft-Windows-SENSE)Defender for Endpoint onboarding failures: SENSE event IDs, script errors and what they mean
Event ID 10 (SENSE): service failed to persist the onboarding informationEvent Viewer (Microsoft-Windows-SENSE)Defender for Endpoint onboarding failures: SENSE event IDs, script errors and what they mean
Event ID 11 (SENSE): onboarding or reonboarding completedEvent Viewer (Microsoft-Windows-SENSE)Defender for Endpoint SENSE event IDs: a quick reference for onboarding and connectivity
Event ID 12 (SENSE): failed to apply the default configurationEvent Viewer (Microsoft-Windows-SENSE)Defender for Endpoint SENSE event IDs: a quick reference for onboarding and connectivity
Event ID 17 (SENSE): failed to change the Connected User Experiences and Telemetry service locationEvent Viewer (Microsoft-Windows-SENSE)Defender for Endpoint onboarding failures: SENSE event IDs, script errors and what they mean
Event ID 19 (SENSE): OOBE (Windows Welcome) hasn't completed yetEvent Viewer (Microsoft-Windows-SENSE)Defender for Endpoint SENSE event IDs: a quick reference for onboarding and connectivity
Event ID 20 (SENSE): can't wait for OOBE (Windows Welcome) to completeEvent Viewer (Microsoft-Windows-SENSE)Defender for Endpoint SENSE event IDs: a quick reference for onboarding and connectivity
Event ID 25 or 26 (SENSE): failed to reset health status or set onboarding status in the registryEvent Viewer (Microsoft-Windows-SENSE)Defender for Endpoint onboarding failures: SENSE event IDs, script errors and what they mean
Event ID 27 (SENSE): failed to enable SENSE aware mode in Defender Antivirus, onboarding failedEvent Viewer (Microsoft-Windows-SENSE)Defender Antivirus active, passive and EDR block mode next to a third-party antivirus
Event ID 28 (SENSE): Connected User Experiences and Telemetry service registration failedEvent Viewer (Microsoft-Windows-SENSE)Defender for Endpoint SENSE event IDs: a quick reference for onboarding and connectivity
Event ID 29 (SENSE): failed to read the offboarding parametersEvent Viewer (Microsoft-Windows-SENSE)Defender for Endpoint onboarding failures: SENSE event IDs, script errors and what they mean
Event ID 30 (SENSE): failed to disable SENSE aware mode in Defender AntivirusEvent Viewer (Microsoft-Windows-SENSE)Defender Antivirus active, passive and EDR block mode next to a third-party antivirus
Event ID 32 (SENSE): service failed to request to stop itself after offboardingEvent Viewer (Microsoft-Windows-SENSE)Defender for Endpoint onboarding failures: SENSE event IDs, script errors and what they mean
Event ID 33 (SENSE): service failed to persist the SENSE GUID (device can appear twice)Event Viewer (Microsoft-Windows-SENSE)Defender for Endpoint SENSE event IDs: a quick reference for onboarding and connectivity
Event ID 34 (SENSE): failed to add itself as a dependency of the telemetry service, onboarding failedEvent Viewer (Microsoft-Windows-SENSE)Defender for Endpoint SENSE event IDs: a quick reference for onboarding and connectivity
Event ID 37 (SENSE): a module is about to exceed its quotaEvent Viewer (Microsoft-Windows-SENSE)Defender for Endpoint SENSE event IDs: a quick reference for onboarding and connectivity
Event ID 38 or 40 (SENSE): network or battery identified as low, server contacted less oftenEvent Viewer (Microsoft-Windows-SENSE)Defender for Endpoint SENSE event IDs: a quick reference for onboarding and connectivity
Event ID 42 or 43 (SENSE): a sensor component failed to perform an actionEvent Viewer (Microsoft-Windows-SENSE)Defender for Endpoint SENSE event IDs: a quick reference for onboarding and connectivity
Event ID 44 (SENSE): offboarding completedEvent Viewer (Microsoft-Windows-SENSE)Defender for Endpoint SENSE event IDs: a quick reference for onboarding and connectivity
Event ID 45 (SENSE): failed to register and start the event trace sessionEvent Viewer (Microsoft-Windows-SENSE)Defender for Endpoint SENSE event IDs: a quick reference for onboarding and connectivity
Event ID 46 (SENSE): event trace session not started due to lack of resourcesEvent Viewer (Microsoft-Windows-SENSE)Defender for Endpoint SENSE event IDs: a quick reference for onboarding and connectivity
Event ID 48 (SENSE): failed to add a provider to the event trace sessionEvent Viewer (Microsoft-Windows-SENSE)Defender for Endpoint SENSE event IDs: a quick reference for onboarding and connectivity
Event ID 51 or 52 (SENSE): new cloud configuration failed to applyEvent Viewer (Microsoft-Windows-SENSE)Defender for Endpoint SENSE event IDs: a quick reference for onboarding and connectivity
Event ID 55 (SENSE): failed to create the Secure ETW autologgerEvent Viewer (Microsoft-Windows-SENSE)Defender for Endpoint onboarding failures: SENSE event IDs, script errors and what they mean
Event ID 56 (SENSE): failed to remove the Secure ETW autologgerEvent Viewer (Microsoft-Windows-SENSE)Defender for Endpoint SENSE event IDs: a quick reference for onboarding and connectivity
Event ID 62 (SENSE): failed to start the Connected User Experiences and Telemetry serviceEvent Viewer (Microsoft-Windows-SENSE)Defender for Endpoint SENSE event IDs: a quick reference for onboarding and connectivity
Event ID 65 (SENSE): failed to load the Microsoft Security Events Component Minifilter driverEvent Viewer (Microsoft-Windows-SENSE)Defender for Endpoint SENSE event IDs: a quick reference for onboarding and connectivity
Event ID 68 (SENSE): the start type of the service is unexpectedEvent Viewer (Microsoft-Windows-SENSE)Defender for Endpoint onboarding failures: SENSE event IDs, script errors and what they mean
Event ID 69 (SENSE): the service is stoppedEvent Viewer (Microsoft-Windows-SENSE)Defender for Endpoint onboarding failures: SENSE event IDs, script errors and what they mean
Event ID 74 (SENSE): device tag in registry exceeds length limitEvent Viewer (Microsoft-Windows-SENSE)Defender for Endpoint SENSE event IDs: a quick reference for onboarding and connectivity
Event ID 81 (SENSE): failed to create the Defender for Endpoint ETW autologgerEvent Viewer (Microsoft-Windows-SENSE)Defender for Endpoint SENSE event IDs: a quick reference for onboarding and connectivity
Event ID 84 (SENSE): set Microsoft Defender Antivirus running modeEvent Viewer (Microsoft-Windows-SENSE)Defender Antivirus active, passive and EDR block mode next to a third-party antivirus
Event ID 85 (SENSE): failed to trigger the SenseIR executableEvent Viewer (Microsoft-Windows-SENSE)Defender for Endpoint SENSE event IDs: a quick reference for onboarding and connectivity
Event ID 87 or 89 (SENSE): can't start an external service or update its start typeEvent Viewer (Microsoft-Windows-SENSE)Defender for Endpoint SENSE event IDs: a quick reference for onboarding and connectivity
Event ID 90 (SENSE): failed to configure System Guard Runtime Monitor for the cloud geo-regionEvent Viewer (Microsoft-Windows-SENSE)Defender for Endpoint SENSE event IDs: a quick reference for onboarding and connectivity
Event ID 92 (SENSE): stopped sending sensor cyber data because the data quota is exceededEvent Viewer (Microsoft-Windows-SENSE)Device shows "Inactive" or "No sensor data" in Microsoft Defender: how to troubleshoot
Event ID 97 (SENSE): connectivity issues to the cloud for the DLP scenarioEvent Viewer (Microsoft-Windows-SENSE)Defender for Endpoint SENSE event IDs: a quick reference for onboarding and connectivity
Event ID 99 (SENSE): Sense encountered an error while communicating with the serverEvent Viewer (Microsoft-Windows-SENSE)Moving Defender for Endpoint to streamlined connectivity: URLs, proxies and validation
Event ID 100 (SENSE): the SenseCE executable failed to startEvent Viewer (Microsoft-Windows-SENSE)Defender for Endpoint SENSE event IDs: a quick reference for onboarding and connectivity
Event ID 106 or 107 (SENSE): service failed to start, problem with the MsSense DLL moduleEvent Viewer (Microsoft-Windows-SENSE)Defender for Endpoint SENSE event IDs: a quick reference for onboarding and connectivity
Event ID 401 or 409 (SENSE): service failed to generate or open a crypto keyEvent Viewer (Microsoft-Windows-SENSE)Defender for Endpoint SENSE event IDs: a quick reference for onboarding and connectivity
Event ID 402 (SENSE): service failed to persist authentication stateEvent Viewer (Microsoft-Windows-SENSE)Defender for Endpoint SENSE event IDs: a quick reference for onboarding and connectivity
Event ID 405 (SENSE): failed to communicate with the authentication serviceEvent Viewer (Microsoft-Windows-SENSE)Moving Defender for Endpoint to streamlined connectivity: URLs, proxies and validation
Event ID 406 (SENSE): request rejected by the authentication serviceEvent Viewer (Microsoft-Windows-SENSE)Defender for Endpoint SENSE event IDs: a quick reference for onboarding and connectivity
Event ID 411 (SENSE): cyber telemetry upload suspended, invalid or expired tokenEvent Viewer (Microsoft-Windows-SENSE)Device shows "Inactive" or "No sensor data" in Microsoft Defender: how to troubleshoot
Event ID 1819 (CSP): Failed to Set Node's ValueEvent Viewer (MDM diagnostics Admin log)Defender for Endpoint onboarding failures: SENSE event IDs, script errors and what they mean
Event ID 1831 (CSP): Sense is configured as delay-start and hasn't started yetEvent Viewer (Microsoft-Windows-SENSE)Defender for Endpoint onboarding failures: SENSE event IDs, script errors and what they mean
Event ID 1836 (CSP): Set Device Tagging Group exceeded allowed limitEvent Viewer (Microsoft-Windows-SENSE)Defender for Endpoint SENSE event IDs: a quick reference for onboarding and connectivityMicrosoft 365 Apps install & activation
Every code in the quick reference “Microsoft 365 Apps install and activation error codes: a quick reference”: what it means, the usual cause and the first check. Open the quick reference
0-1011: Office install failed (network connection problem or low disk space)Office installer (Click-to-Run)Microsoft 365 Apps install and activation error codes: a quick reference
0x8004FC12: We're sorry, something went wrong and we can't do this for you right now (activation)Office app (activation dialog)Microsoft 365 Apps activation errors: Unlicensed Product, accounts and shared computers
0x80070005: We're sorry, something went wrong and we can't do this for you right now (activation)Office app (activation dialog)Microsoft 365 Apps activation errors: Unlicensed Product, accounts and shared computers
30015-4 (1392): Office install failed; restart and reinstall, or use the offline installerOffice installer (Click-to-Run)Microsoft 365 Apps install and activation error codes: a quick reference
30015-1011 (1392): Office install failed; restart and reinstall, or use the offline installerOffice installer (Click-to-Run)Microsoft 365 Apps install and activation error codes: a quick reference
30068 (any code containing it): install failed; the Click-to-Run service may be disabledOffice installer (Click-to-Run)Microsoft 365 Apps install and activation error codes: a quick reference
30088-1015: Office install failed (network connection problem or low disk space)Office installer (Click-to-Run)Microsoft 365 Apps install and activation error codes: a quick reference
30094 (any code containing it): install failed; clear temporary files, repair or reinstallOffice installer (Click-to-Run)Microsoft 365 Apps install and activation error codes: a quick reference
30174-4: antivirus, firewall, proxy settings or connection block the installOffice installer (Click-to-Run)Microsoft 365 Apps install and activation error codes: a quick reference
30180-4: antivirus, firewall, proxy settings or connection block the installOffice installer (Click-to-Run)Microsoft 365 Apps install and activation error codes: a quick reference
30183-28: internet connection, antivirus, firewall or proxy settings block the installOffice installer (Click-to-Run)Microsoft 365 Apps install and activation error codes: a quick reference
30183-1011: Office install failed (network connection problem or low disk space)Office installer (Click-to-Run)Microsoft 365 Apps install and activation error codes: a quick reference
PRODUCT NOTICE Your shared computer license expires on <date> and we're having trouble renewing it.Office app (shared computer activation)Microsoft 365 Apps activation errors: Unlicensed Product, accounts and shared computers
Sorry, this Office 365 account has recently been used to activate too many computers.Office app (shared computer activation)Microsoft 365 Apps activation errors: Unlicensed Product, accounts and shared computers
Sorry, we cannot verify the license currently installed for this product.Office app (shared computer activation)Microsoft 365 Apps activation errors: Unlicensed Product, accounts and shared computers
The products we found in your account cannot be used to activate Office in shared computer scenarios.Office app (shared computer activation)Microsoft 365 Apps activation errors: Unlicensed Product, accounts and shared computers
UNLICENSED PRODUCT Most features are turned off because a shared computer license isn't available.Office app (shared computer activation)Microsoft 365 Apps activation errors: Unlicensed Product, accounts and shared computersOneDrive sync error codes
Every code in the quick reference “OneDrive sync app error codes: a quick reference with meanings and fixes”: what it means, the usual cause and the first check. Open the quick reference
0x8004de8a: account problem, missing account or personal/work account mismatchOneDrive sign-inOneDrive sync app error codes: a quick reference with meanings and fixes
0x8004de40: OneDrive can't connect to the cloud at sign-in (Login was either interrupted or unsuccessful)OneDrive sign-inOneDrive sync app error codes: a quick reference with meanings and fixes
0x8004de42: Your proxy settings require authenticationOneDrive sign-inOneDrive sync app error codes: a quick reference with meanings and fixes
0x8004de44: Your proxy settings require authenticationOneDrive sign-inOneDrive sync app error codes: a quick reference with meanings and fixes
0x8004de80: app problem fixed by reinstalling OneDriveOneDrive sync appOneDrive sync app error codes: a quick reference with meanings and fixes
0x8004de85: account problem, missing account or personal/work account mismatchOneDrive sign-inOneDrive sync app error codes: a quick reference with meanings and fixes
0x8004de86: app problem fixed by reinstalling OneDriveOneDrive sync appOneDrive sync app error codes: a quick reference with meanings and fixes
0x8004de88: can't sign in to the account, same connection causes as 0x8004de40OneDrive sign-inOneDrive sync app error codes: a quick reference with meanings and fixes
0x8004de90: OneDrive setup hasn't been completedOneDrive sign-inOneDrive sync app error codes: a quick reference with meanings and fixes
0x8004de96: sign-in fails after a password change (You're syncing a different account)OneDrive sign-inOneDrive sync app error codes: a quick reference with meanings and fixes
0x8004dea3: Windows functions failing or Windows crashingOneDrive sync appOneDrive sync app error codes: a quick reference with meanings and fixes
0x8004deb4: sign-in failure with its own Microsoft articleOneDrive sign-inOneDrive sync app error codes: a quick reference with meanings and fixes
0x8004ded2: work or school account from an organization that doesn't support OneDriveOneDrive sign-inOneDrive sync app error codes: a quick reference with meanings and fixes
0x8004ded7: old OneDrive version used with a work or school accountOneDrive sync appOneDrive sync app error codes: a quick reference with meanings and fixes
0x8004dedc: OneDrive for work or school used in a different region (geo)OneDrive sync appOneDrive sync app error codes: a quick reference with meanings and fixes
0x8004def0: account credentials have changed or expiredOneDrive sign-inOneDrive sync app error codes: a quick reference with meanings and fixes
0x8004def1: An update is requiredOneDrive sync appOneDrive sync app error codes: a quick reference with meanings and fixes
0x8004def4: sync app runs alongside the Store app, or OneNote notebooks weren't moved correctlyOneDrive sync appOneDrive sync app error codes: a quick reference with meanings and fixes
0x8004def5: expired credentials on the computer; duplicate files named after the PCOneDrive sign-inOneDrive sync app error codes: a quick reference with meanings and fixes
0x8004def7: storage capacity exceeded or account suspendedOneDrive sync appOneDrive sync app error codes: a quick reference with meanings and fixes
0x8004e4f1: OneDrive settings open as a blank pageOneDrive sync appOneDrive sync app error codes: a quick reference with meanings and fixes
0x80040c81: OneDrive has difficulty connecting to the cloudOneDrive sync appOneDrive sync app error codes: a quick reference with meanings and fixes
0x80049d61: OneDrive Store app fails to launchOneDrive Store appOneDrive sync app error codes: a quick reference with meanings and fixes
0x8007016a: The cloud file provider is not running (Files On-Demand)File Explorer / OneDrive sync appOneDrive sync app error codes: a quick reference with meanings and fixes
0x8007018b: file open or in use by OneDrive during a delete, move or renameFile Explorer / OneDrive sync appOneDrive sync app error codes: a quick reference with meanings and fixes
0x80010007: OneDrive has difficulty syncing with the PCOneDrive sync appOneDrive sync app error codes: a quick reference with meanings and fixes
0x80048823: proxy authentication required at sign-inOneDrive sign-inOneDrive sync app error codes: a quick reference with meanings and fixes
0x80070005: An unknown error occurred, while setting up Known Folder MoveOneDrive (Known Folder Move)OneDrive Known Folder Move with Intune: silent sign-in, silent move and stuck folders
0x80070005: problem with OneDrive updatesOneDrive sync appOneDrive sync app error codes: a quick reference with meanings and fixes
0x80070194: cloud files error that a OneDrive reset usually clearsOneDrive sync appOneDrive sync stuck on "Processing changes": causes and fixes for work and school accounts
0x80071128: The data present in the reparse point buffer is invalidFile Explorer / OneDrive sync appOneDrive sync app error codes: a quick reference with meanings and fixes
0x80071129: The tag present in the reparse point buffer is invalidFile Explorer / OneDrive sync appOneDrive sync app error codes: a quick reference with meanings and fixes
Can't open file (online-only file while OneDrive isn't running)File ExplorerOneDrive sync app error codes: a quick reference with meanings and fixes
Couldn't start Files on DemandFile Explorer (Files On-Demand)OneDrive sync app error codes: a quick reference with meanings and fixes
Error code 1: unknown errorOneDrive sync appOneDrive sync app error codes: a quick reference with meanings and fixes
Error code 2: problem fetching the account detailsOneDrive sync appOneDrive sync app error codes: a quick reference with meanings and fixes
Error code 6: timeoutOneDrive sync appOneDrive sync app error codes: a quick reference with meanings and fixes
Error code 36: more items than SharePoint can manage at one time (list view threshold)OneDrive sync appOneDrive sync stuck on "Processing changes": causes and fixes for work and school accounts
Error code 49: older version of OneDriveOneDrive sync appOneDrive sync app error codes: a quick reference with meanings and fixes
OneDrive cannot connect to Windows (Files On-Demand)File Explorer (Files On-Demand)OneDrive sync app error codes: a quick reference with meanings and fixes
The file or folder already exists on OneDriveOneDrive sync appOneDrive sync app error codes: a quick reference with meanings and fixes
This file can't be syncedOneDrive sync appOneDrive sync stuck on "Processing changes": causes and fixes for work and school accounts
Upload blocked: signed in to an Office app with an account that can't uploadMicrosoft 365 app / OneDriveOneDrive sync app error codes: a quick reference with meanings and fixes
You do not have access permissions to the itemOneDrive sync appOneDrive sync app error codes: a quick reference with meanings and fixes
You're already syncing this accountOneDrive for MacOneDrive sync app error codes: a quick reference with meanings and fixes
You're syncing a different accountOneDrive sign-inOneDrive sync app error codes: a quick reference with meanings and fixesTeams sign-in error codes
Every code in the quick reference “Microsoft Teams sign-in error codes: a quick reference for admins”: what it means, the usual cause and the first check. Open the quick reference
0xCAA82EE2: The request has timed outTeams sign-in screenMicrosoft Teams sign-in error codes: a quick reference for admins
0xCAA82EE7: The server name couldn't be resolvedTeams sign-in screenMicrosoft Teams sign-in error codes: a quick reference for admins
0xCAA20003: You ran into an authorization problem (device date and time)Teams sign-in screenMicrosoft Teams sign-in error codes: a quick reference for admins
0xCAA20004: Your request needs to be approved by a resource owner or authorization serverTeams sign-in screenAADSTS53000 vs AADSTS53003: troubleshooting Conditional Access sign-in blocks
0xCAA70004: The server or proxy wasn't foundTeams sign-in screenMicrosoft Teams sign-in error codes: a quick reference for admins
0xCAA70007: The download has failed because the connection was interruptedTeams sign-in screenMicrosoft Teams sign-in error codes: a quick reference for admins
0xCAA90018: You're not using the right credentialsTeams sign-in screenMicrosoft Teams sign-in error codes: a quick reference for admins
80090016: Your computer's Trusted Platform Module has malfunctionedTeams / Microsoft 365 app sign-inPrimary Refresh Token (PRT) explained: fixing SSO and repeated sign-in prompts
AADSTS50020 UserUnauthorized: guest or external account isn't in the tenant the user opened in TeamsSign-in page / Microsoft Entra sign-in logGuest sign-in errors in Microsoft Entra ID: AADSTS90072, AADSTS50020 and cross-tenant blocks
AADSTS50076 UserStrongAuthClientAuthNRequired: MFA required to sign in to TeamsMicrosoft Entra sign-in logAADSTS50076, AADSTS50079 and AADSTS50158: fixing MFA and authentication-strength sign-in errors
AADSTS50079 UserStrongAuthEnrollmentRequired: MFA registration needed before Teams sign-inMicrosoft Entra sign-in logAADSTS50076, AADSTS50079 and AADSTS50158: fixing MFA and authentication-strength sign-in errors
AADSTS53000 DeviceNotCompliant: Teams access requires a compliant deviceMicrosoft Entra sign-in logAADSTS53000 vs AADSTS53003: troubleshooting Conditional Access sign-in blocks
AADSTS53003 BlockedByConditionalAccess: a policy blocked the Teams sign-inMicrosoft Entra sign-in logAADSTS53000 vs AADSTS53003: troubleshooting Conditional Access sign-in blocks
AADSTS70043 BadTokenDueToSignInFrequency: Teams asks the user to sign in againMicrosoft Entra sign-in logUsers keep being asked to sign in again: Entra sign-in frequency and AADSTS70043
AADSTS90072: external account doesn't exist in the tenant, so MFA can't be satisfied (Teams guest)Sign-in pageGuest sign-in errors in Microsoft Entra ID: AADSTS90072, AADSTS50020 and cross-tenant blocks
AADSTS500014: the service principal for a resource Teams needs is disabledTeams sign-in screen / Entra sign-in logMicrosoft Entra AADSTS error codes: a quick reference with meanings and fixes
AADSTS500213 NotAllowedByInboundPolicyTenant: cross-tenant access blocks the Teams userSign-in page / Microsoft Entra sign-in logGuest sign-in errors in Microsoft Entra ID: AADSTS90072, AADSTS50020 and cross-tenant blocks
No code: Teams web client stuck in a sign-in loopTeams web clientMicrosoft Teams sign-in error codes: a quick reference for admins
No code: You'll need to re-enter your PIN using a smart cardTeams sign-in screenMicrosoft Teams sign-in error codes: a quick reference for adminsNo match yet. Try fewer words or just the code. If your error isn't here, email me the exact text — new errors are added to the library.
All 157 guides
Browse all articles Every Entra ID, Defender & Microsoft 365 guide, by area
Troubleshooting guides, how-tos and deep dives for Microsoft Entra ID, Microsoft Defender, Exchange Online and Microsoft 365.
Entra ID 65
- "Need admin approval": AADSTS65001 and AADSTS90094 consent errors in Microsoft Entra ID
- A Conditional Access baseline: the first policies every tenant should deploy
- AADSTS error codes 120000 and above: password change, NGC, devices and more (part 5 of 5)
- AADSTS error codes 65001–81012: the complete list with fixes (part 3 of 5)
- AADSTS error codes 90002–90130: the complete list with fixes (part 4 of 5)
- AADSTS50053 account locked in Microsoft Entra ID: smart lockout and on-premises lockouts
- AADSTS50076, AADSTS50079 and AADSTS50158: fixing MFA and authentication-strength sign-in errors
- AADSTS53000 vs AADSTS53003: troubleshooting Conditional Access sign-in blocks
- Access reviews and entitlement management basics: a starter plan for Entra ID Governance
- Active Directory domain join errors: NetSetup.log codes and messages with fixes
- Active Directory event IDs: Directory Service, Netlogon and DNS events and their fixes
- Active Directory replication errors: repadmin and dcdiag codes with causes and fixes
- AD FS errors and event IDs: 364, 411, 1203, certificate events and MSIS codes with fixes
- App registrations and service principals: secrets, consent and over-privileged apps
- App sign-in errors in Microsoft Entra ID: AADSTS7000215, AADSTS700016, AADSTS50011 and more
- B2B guest access and cross-tenant access settings: inbound, outbound and trust
- Conditional Access now evaluates OIDC-only sign-ins: the 2026 baseline scopes change
- Configuring Microsoft Entra hybrid join: SCP, targeted deployment and validation
- Continuous access evaluation in Entra ID: how it works, strict location and IP mismatches
- Deploying Windows Hello for Business with cloud Kerberos trust using Intune
- Dual state, Pending and duplicate device objects in Microsoft Entra ID: a clean-up guide
- Dynamic device groups for Intune: membership rules that actually work
- Emergency access (break-glass) accounts in Microsoft Entra ID: set up, exclude and monitor
- Entra Connect sync errors: duplicates, InvalidSoftMatch and objects that never sync
- Entra hybrid join and device registration error codes: dsregcmd, DSREG and 0x801C
- Entra ID SSPR and password writeback errors: SSPR_00xx codes, event IDs and fixes
- Filtering Microsoft Entra Connect Sync by OU, group and attribute without deleting users
- Group Policy processing errors: event IDs 1058, 1030, 1129 and more with fixes
- Guest sign-in errors in Microsoft Entra ID: AADSTS90072, AADSTS50020 and cross-tenant blocks
- Keeping Microsoft Entra Connect Sync supported: versions, auto-upgrade, in-place upgrades
- Kerberos error codes: KDC_ERR and KRB_AP_ERR results in events 4768, 4769 and 4771
- LDAP bind errors in Active Directory: error 49 data codes (52e, 525, 775) and LDAP results
- Mandatory MFA for Azure and admin portals: fix scripts, service accounts and break-glass accounts
- Microsoft Entra AADSTS error codes 16000–50079: the complete list with fixes (part 1 of 5)
- Microsoft Entra AADSTS error codes 50085–54005: the complete list with fixes (part 2 of 5)
- Microsoft Entra AADSTS error codes: a quick reference with meanings and fixes
- Microsoft Entra application proxy errors: connector events, gateway messages and fixes
- Microsoft Entra CBA sign-in errors: trust store, CRL checks, bindings and AADSTS500173
- Microsoft Entra Cloud Sync vs Connect Sync: choosing the right tool and migrating safely
- Microsoft Entra Connect Health: installing the agents and acting on sync alerts
- Microsoft Entra Connect staging mode: swing migrations, disaster recovery and safe upgrades
- Microsoft Entra Connect sync errors: export errors, event IDs and Cloud Sync quarantine
- Microsoft Entra Domain Services alerts: every AADDS alert ID with its fix
- Microsoft Entra ID Protection: risk policies, self-remediation and false positives
- Microsoft Entra Password Protection, PTA and Seamless SSO errors: events and fixes
- Microsoft Entra provisioning error codes: SCIM apps, HR-driven and cross-tenant sync
- Migrating to the authentication methods policy: retiring legacy MFA and SSPR settings
- Moving from AD FS to cloud authentication: inventory, staged rollout and domain cutover
- Named locations in Conditional Access: IP ranges, countries, trusted IPs and the pitfalls
- NPS extension for Microsoft Entra MFA errors: NPS event IDs, log messages and fixes
- Password hash sync, pass-through authentication or federation: choosing hybrid sign-in
- Primary Refresh Token (PRT) explained: fixing SSO and repeated sign-in prompts
- Privileged Identity Management: just-in-time Microsoft Entra roles done properly
- Reading Microsoft Entra sign-in logs like an engineer
- Rolling out passkeys in Microsoft Authenticator: policy, registration and the errors users hit
- Seamless SSO not working: the AZUREADSSOACC account, Kerberos and the intranet zone
- Self-service password reset and password writeback: fixing the usual failures
- SYSVOL replication events: DFSR and FRS event IDs with causes and fixes
- Temporary Access Pass: onboarding users to passwordless and Windows Hello for Business
- Test before you enforce: Conditional Access What If and report-only mode
- Token protection in Conditional Access: binding sign-in sessions to the device
- Training path: Microsoft Entra ID for administrators (SC-300 study plan)
- Troubleshooting Microsoft Entra hybrid join with dsregcmd /status
- Users keep being asked to sign in again: Entra sign-in frequency and AADSTS70043
- Windows logon failure codes: event 4625 and 4776 status codes and account lockout 4740
Exchange Online 32
- ActiveSync device access in Exchange Online: quarantine, access rules and blocked devices
- Distribution groups vs Microsoft 365 Groups vs shared mailboxes: which one to use and how to convert
- Email never arrived? Using message trace in Exchange Online to find out why
- Enabling and troubleshooting auto-expanding archiving in Exchange Online
- Enhanced Filtering for Connectors: a third-party email gateway in front of Exchange Online
- EWS switch-off in Exchange Online: EwsEnabled, the app allow list and finding EWS usage
- Exchange Online mailbox permissions: fixing Full Access, Send As and Send on Behalf errors
- Exchange Online migration batch errors: IMAP, cutover, Google Workspace and cross-tenant
- Exchange Online NDR and SMTP error codes: a quick reference with causes and fixes
- Exchange Online PowerShell V3 errors: Connect-ExchangeOnline, module install and cmdlets
- Exchange Online PowerShell V3: connect, automate with certificates, run everyday reports
- Investigating a compromised Exchange Online mailbox: rules, forwarding, sign-ins and audit
- Legitimate email landing in Junk: how EOP decides and the right way to fix it
- Mail flow rules that don't backfire: external sender tagging, priorities and exceptions
- Microsoft Purview Message Encryption not working in Exchange Online: test, fix and verify
- Moving from a third-party email gateway to Exchange Online Protection: a cutover runbook
- NDR 550 5.1.10 RESOLVER.ADR.RecipientNotFound in Exchange Online: causes and fixes
- NDR 550 5.4.1 “Recipient address rejected: Access denied”: Directory-Based Edge Blocking
- NDR 550 5.7.1 Delivery not authorized, message refused: fixing it in Exchange Online
- NDR 550 5.7.520: fixing “Your organization does not allow external forwarding”
- NDR 550 5.7.708 in Exchange Online: Access denied, traffic not accepted from this IP
- NDR 550 5.7.750 in Exchange Online: Client blocked from sending from unregistered domains
- Outlook can't connect or set up the account: Autodiscover troubleshooting for Exchange Online
- Printers and apps can't send via Microsoft 365: SMTP AUTH, relay connectors and 5.7.57
- Restoring deleted email and mailboxes in Exchange Online: items, soft-deleted and inactive
- Retention policies, labels, MRM and litigation hold in Exchange Online: which one does what
- Room and equipment mailboxes in Exchange Online: creation, booking policies and Room Finder
- Shared mailbox automapping in Outlook: why it appears (or doesn't) and how to control it
- SPF, DKIM and DMARC for your Microsoft 365 custom domain: a practical setup guide
- Training path: MS-102 Microsoft 365 Administrator study plan with Exchange Online depth
- Users blocked from sending in Exchange Online: Restricted entities and NDR 550 5.1.8
- “Mailbox full” in Exchange Online: quotas, Recoverable Items and the 554 5.2.2 NDR
Defender 46
- Advanced hunting for Intune admins: KQL queries that answer everyday device questions
- Anti-spam message headers in Microsoft 365: SFV, CAT, SCL, BCL and compauth values
- Attack simulation training in Defender for Office 365: a phishing campaign done right
- Attack surface reduction (ASR) rules: every rule name, GUID, event ID and Intune setting
- Automatic attack disruption in Defender XDR: what it does and how to prepare
- Controlling USB and removable storage with Defender device control and Intune
- Defender Antivirus active, passive and EDR block mode next to a third-party antivirus
- Defender Antivirus high CPU (MsMpEng.exe): find the cause with the performance analyzer
- Defender Antivirus platform and engine updates: channels, gradual rollout and rollback
- Defender Antivirus settings not applying from Intune: a troubleshooting checklist
- Defender for Cloud Apps app connectors: connect Microsoft 365 and fix connector errors
- Defender for Cloud Apps Conditional Access app control: session policies and common errors
- Defender for Endpoint AIR: device groups, automation levels and undoing remediation
- Defender for Endpoint client analyzer: run it, read the results and fix connectivity
- Defender for Endpoint custom indicators: block or allow files, IPs, URLs and certificates
- Defender for Endpoint on iOS and Android: Intune onboarding, VPN, MTD and sign-in errors
- Defender for Endpoint on Linux: installation, onboarding and mdatp health errors
- Defender for Endpoint onboarding failures: SENSE event IDs, script errors and what they mean
- Defender for Endpoint SENSE event IDs: a quick reference for onboarding and connectivity
- Defender for Identity health issues: every sensor and global alert, with severity and fix
- Defender for Identity sensors: installation and health issues on domain controllers
- Defender for Office 365 presets: Standard vs Strict, and why custom policies seem ignored
- Defender for Office 365 user-reported messages: Report button, reporting mailbox, triage
- Defender Vulnerability Management: from security recommendation to Intune security task
- Defender XDR custom detection rules: from advanced hunting query to alert and action
- Defender XDR unified RBAC: workload activation, custom roles and portal access errors
- Device shows "Inactive" or "No sensor data" in Microsoft Defender: how to troubleshoot
- From Symantec Endpoint Protection to Defender for Endpoint: prepare, set up, onboard
- Handling false-positive quarantined email in Defender for Office 365 the right way
- Live response in Defender for Endpoint: collecting evidence and running scripts safely
- Managing Defender settings on devices not enrolled in Intune: security settings management explained
- Microsoft Defender Antivirus event IDs and error codes: a quick reference
- Microsoft Security Exposure Management: initiatives, scores and attack paths explained
- Moving Defender for Endpoint to streamlined connectivity: URLs, proxies and validation
- Onboarding macOS to Defender for Endpoint with Intune: profiles, app and onboarding package
- Onboarding Windows devices to Defender for Endpoint with Intune (and proving it worked)
- Onboarding Windows Server 2012 R2 and 2016 to Defender for Endpoint: the unified solution
- Rolling out ASR rules safely: audit mode, exclusions and advanced hunting
- Safe Links and Safe Attachments: troubleshooting blocked links, missing rewrites and delays
- Security settings management enrollment errors: decoding SenseCM EnrollmentStatus codes
- Shadow IT with Defender for Cloud Apps and Defender for Endpoint: discover, warn, block
- Tamper protection and Intune: why a Defender setting won't change, and how to fix it
- Tenant Allow/Block List in Defender for Office 365: senders, URLs, files and spoofing
- Training path: SC-200 Security Operations Analyst study plan (Defender XDR and Sentinel)
- Web content filtering in Defender for Endpoint: network protection, categories and indicators
- Your first hour with a Defender XDR incident: triage, scoping and containment
Microsoft 365 14
- A Microsoft 365 tenant hardening checklist: Secure Score, admin roles and risky defaults
- Adding a domain to Microsoft 365: verification, DNS records and "already added" errors
- External access vs guest access in Microsoft Teams: configuring federation safely
- Group-based licensing errors in Microsoft 365: conflicts, usage location and fixes
- Microsoft 365 Apps activation errors: Unlicensed Product, accounts and shared computers
- Microsoft 365 Apps install and activation error codes: a quick reference
- Microsoft 365 change management: Message center, service health and release preferences
- Microsoft Teams sign-in error codes: a quick reference for admins
- OneDrive sync app error codes: a quick reference with meanings and fixes
- OneDrive sync stuck on "Processing changes": causes and fixes for work and school accounts
- Preparing for Microsoft 365 Copilot: finding and fixing SharePoint oversharing
- SharePoint and OneDrive "Access Denied" and sharing link errors: causes and fixes
- SharePoint and OneDrive external sharing explained: tenant, site and link settings
- Teams meeting recording or transcription not available: policy, storage and license checks
Hit a Microsoft 365 error that isn't here?
Send me the exact error and what you were doing — the most-requested errors become the next guides.