/codes/entra-id/aadsts-error-codes
AADSTS error codes: Microsoft Entra sign-in errors seen in admin PowerShell modules
The commands on this page have not been executed by our verification runner yet.updated
- tool
- Microsoft Entra ID
- versions
- Microsoft Entra ID
- os
- any
AADSTS codes are errors from the Microsoft Entra security token service (STS). Admin modules such as Connect-ExchangeOnline, Connect-MgGraph, Connect-MicrosoftTeams and Connect-SPOService pass them through when sign-in fails. The number identifies the problem; the text after it often includes the app ID, tenant or user. The names and meanings below are from Microsoft's AADSTS error code reference.
User sign-in
| Code | Name | Meaning and usual fix |
|---|---|---|
| AADSTS50034 | UserAccountNotFound | The account is not in this tenant: typo in the user name, or signing in to the wrong tenant |
| AADSTS50053 | IdsLocked | Account locked after too many failed attempts, or sign-in from a malicious IP; check the failure reason in the sign-in log |
| AADSTS50055 | InvalidPasswordExpiredPassword | Password expired; reset it |
| AADSTS50057 | UserDisabled | The account is disabled |
| AADSTS50076 | UserStrongAuthClientAuthNRequired | MFA is required (Conditional Access, per-user MFA or a new location); sign in interactively and complete MFA |
| AADSTS50079 | UserStrongAuthEnrollmentRequired | The user must register security info for MFA first |
| AADSTS50126 | InvalidUserNameOrPassword | Wrong user name or password |
| AADSTS50173 | (grant expired) | The refresh token was revoked, for example after a password change; sign in again |
| AADSTS16000 | InteractionRequired | The account does not exist in the tenant (often a personal Microsoft account); sign in with a work account |
Policy and consent
| Code | Name | Meaning and usual fix |
|---|---|---|
| AADSTS53000 | DeviceNotCompliant | Conditional Access requires a compliant device; enroll the device in Intune or use a managed one |
| AADSTS53003 | BlockedByConditionalAccess | A Conditional Access policy blocked the sign-in; see the Conditional Access tab of the sign-in log |
| AADSTS65001 | DelegationDoesNotExist | No consent for the app; consent interactively or have an admin grant consent |
| AADSTS90094 | AdminConsentRequired | The requested permissions need admin consent |
| AADSTS50105 | EntitlementGrantsNotFound | The app requires assignment and the user is not assigned to it |
| AADSTS50020 | UserUnauthorized | The account comes from another identity provider and is not a guest in this tenant |
App registrations and app-only scripts
| Code | Name | Meaning and usual fix |
|---|---|---|
| AADSTS700016 | UnauthorizedClient_DoesNotMatchRequest | The application ID was not found in the tenant: wrong -AppId/-ClientId, or wrong tenant |
| AADSTS7000215 | (invalid client secret) | The client secret value is wrong (often the secret ID was used instead of the value) |
| AADSTS7000222 | InvalidClientSecretExpiredKeysProvided | The client secret expired; create a new one or use a certificate |
| AADSTS700027 | (client assertion failed) | Certificate sign-in failed signature validation; the certificate does not match the one on the app |
| AADSTS500011 | InvalidResourceServicePrincipalNotFound | The resource API has no service principal in the tenant, or the request went to the wrong tenant |
| AADSTS90002 | InvalidTenantName | The tenant name or ID was not found; check -TenantId or -Organization |
| AADSTS70011 | InvalidScope | The requested scope is invalid |
| AADSTS50011 | InvalidReplyTo | The redirect URI does not match the app registration |
Find the details of a failure
- Copy the Correlation ID and timestamp from the error, if shown.
- In the Microsoft Entra admin center open Monitoring and health > Sign-in logs (for app-only failures, the Service principal sign-ins tab) and filter on the user or app.
- The sign-in shows the error code, the failure reason and, for policy errors, the Conditional Access policies that applied.
Sources
Related pages
errors · entra-idAADSTS700016: Application with identifier was not found in the directoryEntra ID found no app with that client ID in the tenant: a wrong -AppId or -ClientId, an object ID instead of the app ID, the wrong tenant, or no consent.errors · exchange-onlineConnect-ExchangeOnline: AADSTS53003: Access has been blocked by Conditional Access policiesEntra ID refused a token to Exchange Online PowerShell because a Conditional Access policy blocks the sign-in. Find that policy in the Entra sign-in logs.glossary · entra-idWhat is Conditional Access in Microsoft Entra ID?Conditional Access is the Entra ID if-then policy engine: it checks user, app, location, device and risk, then blocks access or requires MFA or a compliant PC.