Reading sign-in failure codes (AADSTS)

Every failed sign-in in the Microsoft Entra sign-in logs carries a numeric code. The

code tells you which stage failed, and that alone eliminates most of the

possibilities before you touch anything.

A cloud sign-in has three stages:

Primary authentication — the password (or passwordless credential) is validated.
Strong authentication — the MFA challenge is issued and satisfied.
Authorization — Conditional Access evaluates the request and grants or blocks.

If you know the stage, you know the class of cause.

Code	Meaning	What it tells you
50126	Invalid username or password	Stage 1. The credential itself is wrong, expired, or not yet synced.
50053	Account locked (smart lockout)	Stage 1. Repeated bad attempts — often a symptom, not the cause.
50055	Password expired	Stage 1. The user must change it.
50057	User account is disabled	Stage 1. The account is blocked or has been offboarded.
50074	Strong authentication required, not satisfied	Stage 2. The password worked. The second factor did not.
50076	MFA required due to a configuration change	Stage 2. Usually a new or changed policy.
500121	Authentication failed during strong authentication request	Stage 2. The challenge was issued and never completed — expired, denied, or no usable method.
53000	Device is not compliant	Stage 3. Conditional Access. The identity is fine.
53003	Blocked by Conditional Access	Stage 3. Read the policy name in the log entry.
530002	Device not compliant or not managed	Stage 3. Enrolment or compliance, not credentials.
50097	Device authentication required	Stage 3. The device is not registered as required.
700016	Application not found in directory	The app registration, not the user.

A stage-2 or stage-3 code means the password is not the problem. This is the

single most useful thing the codes give you. Resetting a password in response to a

50074 or a 53000 changes nothing, costs the user time, and adds a temporary

credential they have to memorise while still locked out.

Read the detail string, not just the number. Stage-3 failures name the

Conditional Access policy that blocked the request. That takes you straight to the

grant control that was not satisfied.

Look at the pattern across the log, not one row. A single 50126 is a typo. A wall

of 50126 across many users starting at a specific time is a directory sync failure,

a password-writeback failure, or an on-premises outage — a very different ticket.

Check whether primary auth is succeeding elsewhere. A user who can sign in to a

domain-joined Windows device but not to cloud services has a working credential and

a failing cloud stage. That comparison is free and takes ten seconds.