AADSTS sign-in errors decoded: the codes you'll actually meet
Microsoft's list of AADSTS sign-in errors runs to hundreds of codes. These are the thirty or so that appear in real apps, connectors and pipelines, grouped by what's wrong (the app registration, consent, the credential, the user, MFA and Conditional Access, federated credentials), each with the cause and the one fix.
Identity & securityQuick reference8 min read
Every sign-in failure against Microsoft Entra ID comes back as an AADSTS code, and Microsoft's reference lists several hundred of them in numerical order, one line each. In practice a few dozen account for nearly every failure a Power Platform connector, a web app, a script or a pipeline will ever show you, and the fix is usually one setting. This page is that shorter list, grouped by what has actually gone wrong, with the fix beside each code. Two habits first: the error text names the app ID, tenant and the offending value, so read the whole message; and for any code you can paste it at https://login.microsoftonline.com/error to get Microsoft's own explanation.
The app registration
| Code | What it means | Fix |
|---|---|---|
| AADSTS50011 | The redirect (reply) URL in the request doesn't match any configured on the app registration | Copy the URL from the error message and add it under Authentication > Platform configurations; it must match exactly, including scheme and trailing slash. Allow a few minutes. Custom connectors have their own unique redirect URL on the Security tab |
| AADSTS700016 | The application (client ID) wasn't found in this tenant | The client ID is wrong, or the sign-in went to the wrong tenant (common or another tenant ID). Check both. A multi-tenant app must have been consented in the target tenant first |
| AADSTS500011 | The resource (the API you're asking a token for) has no service principal in this tenant | The API's app registration isn't provisioned or consented in the tenant, or the resource URL or tenant ID is wrong. Check Enterprise applications for the API |
| AADSTS50001 | The resource is disabled or doesn't exist | Use the exact resource identifier or scope (https://graph.microsoft.com/.default, api://<client-id>/.default) |
| AADSTS65005 | The app asks for a resource that isn't in its required permissions list, or a SAML app has the wrong Identifier | Add the permission under API permissions, or fix the SAML Identifier (Entity ID) |
| AADSTS70011 | The scope requested is invalid | Scopes are <resource>/<permission> or <resource>/.default; check for typos and the right resource |
| AADSTS90002 | The tenant name wasn't found | The tenant ID or domain is wrong, often an app from one cloud (public, Government, China) pointed at another |
| AADSTS9002313 | The request is malformed | A missing or misencoded parameter; capture the request and compare it with the protocol documentation |
Consent and assignment
| Code | What it means | Fix |
|---|---|---|
| AADSTS65001 | Nobody has consented to this app using that permission | Send an interactive sign-in so the person can consent, or an admin grants consent under API permissions > Grant admin consent |
| AADSTS90094 | Admin consent is required for this permission | An admin grants consent; application permissions always need it |
| AADSTS65004 | The person declined consent | Ask them to sign in again and accept, or an admin consents for everyone |
| AADSTS50105 | The app requires user assignment and this person isn't assigned | In Enterprise applications > the app > Users and groups, assign them, or turn off Assignment required |
The app's credential
| Code | What it means | Fix |
|---|---|---|
| AADSTS7000215 | The client secret is wrong | You pasted the secret's ID instead of its value, or a stale value. Create a new secret, copy the Value immediately, and update the app |
| AADSTS7000222 | The client secret has expired | Create a new secret; consider a certificate or a federated credential instead, which don't leak the same way |
| AADSTS7000218 | The request has no client_secret or client_assertion | The app is treated as a confidential client but sent none; add the credential, or register it as a public client if it's a desktop or mobile app |
| AADSTS700027 | The client assertion's signature failed, or the certificate isn't known | Upload the certificate under Certificates & secrets; check the thumbprint the app signs with |
| AADSTS70000 | The refresh token is invalid (token binding) | Sign in again; if it persists, the app's token-binding configuration is wrong |
| AADSTS700082 | The refresh token expired through inactivity | Normal: the person hasn't used the app in a long time; sign in again |
| AADSTS50173 | The grant was revoked, usually because the password changed or an admin revoked sessions | Sign in again with a fresh token |
The person signing in
| Code | What it means | Fix |
|---|---|---|
| AADSTS50126 | Wrong username or password | Expect some of these; a flood of them against one account is a password-spray signal |
| AADSTS50034 | The account isn't in this tenant | The person typed the wrong name, or the app chose the wrong tenant; if they should be in, add them as a user or guest |
| AADSTS50020 | The account from another identity provider isn't a user in this tenant | Add them as an external (guest) user first, or have them sign in with the right account |
| AADSTS50053 | The account is locked after repeated failed sign-ins, or the sign-in came from a blocked IP | Wait, or an admin unblocks in ID Protection |
| AADSTS50055 | The password has expired | The person resets it, or an admin does |
| AADSTS50057 | The account is disabled | An admin re-enables it, in Entra or in on-premises Active Directory if it's synced |
| AADSTS50058 | No signed-in session for silent sign-in | Expected when nobody is signed in; the app should fall back to an interactive sign-in |
| AADSTS50059 / 50128 | No tenant information in the request or the credentials | Pass the tenant ID or a verified domain |
MFA and Conditional Access
| Code | What it means | Fix |
|---|---|---|
| AADSTS50076 | MFA is required by a Conditional Access policy, per-user MFA or a new location | Retry with an interactive request so the person can complete MFA. For scripts and pipelines, a user account can't do this: use a managed or workload identity (our mandatory MFA guide) |
| AADSTS50079 / 50072 | The person must register security information before MFA can work | They complete registration at aka.ms/mysecurityinfo |
| AADSTS50074 | The MFA challenge wasn't passed | Try again; check the authentication methods registered |
| AADSTS53003 | A Conditional Access policy blocked the sign-in | Open the sign-in in Sign-in logs > Conditional Access to see which policy; use the What If tool to test a fix (our break-glass and Conditional Access guide) |
| AADSTS50158 | An external challenge (terms of use, a third-party MFA provider) must be satisfied | Not a failure by itself; the person is being redirected to complete it |
| AADSTS90072 | An external account can't satisfy this tenant's MFA, or a synced account's anchor doesn't match | Add the account as an external user, or fix the ImmutableID mismatch between Active Directory and Entra |
Federated credentials for pipelines
| Code | What it means | Fix |
|---|---|---|
| AADSTS70021 | No federated identity credential matches the token the pipeline presented: issuer or subject differs | Compare the issuer and subject in the error with the federated credential on the app or managed identity. Renaming a GitHub repository, environment or branch, or an Azure DevOps organisation, project or service connection, breaks the match; a trailing slash on the issuer does too. New credentials take a few minutes to replicate |
| AADSTS700211 | No credential matches the issuer | Fix the issuer. Azure DevOps's new issuer is https://login.microsoftonline.com/<tenant id>/v2.0; GitHub's is https://token.actions.githubusercontent.com |
| AADSTS700213 | No credential matches the subject | Fix the subject: repo:<org>/<repo>:environment:<name> (GitHub) or sc://<org>/<project>/<connection> (Azure DevOps legacy issuer); it must match the workflow's trigger exactly |
| AADSTS70025 | The app has no federated credentials at all | Add one under Certificates & secrets > Federated credentials |
| AADSTS700223 | Workload identity federation is disabled or constrained on the tenant | Ask the tenant admin, or federate against a user-assigned managed identity instead |
Reading the message
The text after the code carries the values you need: the client ID (application with identifier '…'), the tenant, the redirect URI or the assertion's issuer and subject. The Sign-in logs in the Entra admin centre show the same failure with the Conditional Access and Authentication details tabs, which say which policy or method was involved. And a code that isn't on this page is on Microsoft's full list; paste it at the error lookup address above before you search anywhere else.
Sources
- Microsoft Entra authentication and authorization error codes, Microsoft Learn (the full list)
- Error AADSTS50011: the redirect URI does not match, Microsoft Learn
- AADSTS500011: resource principal not found, Microsoft Learn
- Troubleshoot an Azure Resource Manager workload identity service connection, Microsoft Learn (70021, 700211, 700213, 70025, 700223)
- Important considerations and restrictions for federated identity credentials, Microsoft Learn
- Mandatory multifactor authentication for Azure and admin portals, Microsoft Learn
Was this helpful?
Comments
No comments yet. Share what worked for you.
Sign in to comment. Comments show under a display name you choose, never your email.