Entra ID (AADSTS) Sign-In Error Codes for Security Triage
Every failed (and some interrupted) sign-in to Microsoft Entra ID carries an AADSTS code. In the
SigninLogs table it is the ResultType column; in a Graph API export it is
status.errorCode; in the portal's CSV download it is Sign-in error code. Microsoft's own
table describes each code from a developer's point of view. These pages answer the investigator's questions
instead: did whoever signed in have the right password, is this pattern an attack or a misconfiguration, and
what query confirms it.
The single most useful split is the "password correct?" column below. A wall of AADSTS50126 is noise until it concentrates on one IP; one AADSTS50074 or AADSTS50076 from an unfamiliar country means the password worked and only MFA stood in the way. Each page quotes Microsoft's definition verbatim, checked against the published table on every build.
| Code | What it means | Password correct? | Triage |
|---|---|---|---|
| AADSTS50053 IdsLocked | Entra ID refused the sign-in before accepting it: either smart lockout has locked the account after repeated failures, or the source IP was blocked for malicious activity. | Unclear | medium |
| AADSTS50074 UserStrongAuthClientAuthNRequiredInterrupt | The password was correct and Entra ID asked for multifactor authentication, which this request did not complete. Followed by a success it is routine; alone, from an unfamiliar place, it means someone else knows the password. | Yes | high |
| AADSTS50076 UserStrongAuthClientAuthNRequired | Entra ID accepted the username and password, then required multifactor authentication that this request did not provide. From scripts or legacy mail clients it is strong evidence that whoever sent it knows the password. | Yes | high |
| AADSTS50126 InvalidUserNameOrPassword | Entra ID rejected the password (or the username) for this sign-in. One failure is a typo; the same failure across many accounts from one IP is password spraying. | No | medium |
| AADSTS53003 BlockedByConditionalAccess | A Conditional Access policy blocked the sign-in. Conditional Access is enforced after first-factor authentication completes, so for an interactive sign-in an unexpected 53003 usually means the password was right. | Yes | medium |
Check a sign-in export for these codes
Drop an Entra ID sign-in export (JSON or the portal CSV) into the free browser analyzer: it groups failures by code, user and IP and flags spraying, lockouts and correct-password-but-MFA-blocked sign-ins. Nothing is uploaded.