AADSTS50055 (InvalidPasswordExpiredPassword): The Password Has Expired

What it means

AADSTS50055 is the error Entra ID returns when the account’s password has expired: “The user’s password is expired, and therefore their login or session was ended.” The flow that follows is part of the description — “They will be offered the opportunity to reset it, or can ask an admin to reset it.” For an interactive user that is a password-change screen; for a script, an older mail client or anything else that cannot show it, the sign-in simply keeps failing.

The code only appears where the password is subject to an expiration policy in Entra ID. For hybrid accounts whose on-premises Active Directory password expired, Microsoft documents a separate code, AADSTS50144 (InvalidPasswordExpiredOnPremPassword), and on the domain itself the equivalents are the Kerberos 0x17 KDC_ERR_KEY_EXPIRED failure and the Windows status code 0xC0000071 (STATUS_PASSWORD_EXPIRED). After the password is changed, earlier sessions can fail with AADSTS50133 (SsoArtifactRevoked), which Microsoft describes as a session that “isn’t valid due to password expiration or recent password change.”

Is it an attack?

Context	Reading
Interactive sign-in from the user’s usual device, password change follows	The policy working as intended
Non-interactive sign-ins for one account, same app and IP every few minutes	A job or script using the old password
Mobile mail app or Outlook failing repeatedly after the expiry date	A client that cannot show the change screen; update the password on the device
Hosting, VPN or Tor IP, or a country the user has never signed in from	Someone is trying an old password — possibly from a past breach
Same IP producing 50055 for one account and 50126 for others	Part of a password spray; 50055 marks the accounts with expired passwords
Password change shortly after 50055, from an unfamiliar address	Treat as account takeover until the user confirms it

The interesting cases are the unusual sources. Old passwords circulate in breach dumps for years, and an expired one is often the version an attacker has. Because Microsoft describes the reset as offered to the user after this error, the response to a 50055 nobody can explain is to make sure that offer did not go to the wrong person.

How to investigate

Group the expired-password failures by account, source and client to separate users from automation:

union SigninLogs, AADNonInteractiveUserSignInLogs
| where TimeGenerated > ago(14d)
| where ResultType == "50055"
| summarize Failures = count(), IPs = make_set(IPAddress, 10), Locations = make_set(Location, 5),
            Apps = make_set(AppDisplayName, 5), Clients = make_set(ClientAppUsed, 5),
            FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
    by UserPrincipalName
| extend PerHour = round(1.0 * Failures / max_of(1, datetime_diff("hour", LastSeen, FirstSeen)), 1)
| order by Failures desc

A steady per-hour rate from one app and IP is automation. Then check who changed the password afterwards and from where:

let expired = union SigninLogs, AADNonInteractiveUserSignInLogs
    | where TimeGenerated > ago(14d) and ResultType == "50055"
    | summarize FirstExpired = min(TimeGenerated), SignInIPs = make_set(IPAddress, 10) by UserPrincipalName;
AuditLogs
| where TimeGenerated > ago(14d)
| where OperationName has "password"
| extend UserPrincipalName = tostring(TargetResources[0].userPrincipalName), ChangedFrom = tostring(InitiatedBy.user.ipAddress)
| join kind=inner expired on UserPrincipalName
| where TimeGenerated >= FirstExpired
| project TimeGenerated, UserPrincipalName, OperationName, Result, ChangedFrom, SignInIPs
| order by TimeGenerated desc

If a change came from an address that never appears in the user’s history, reset the password again through an administrator, revoke sessions, review the account’s authentication methods and look at its mailbox and application consents. For service accounts, fix the stored credential and consider replacing the password entirely with a managed identity or certificate. And if the expiring account is a person’s, a policy that forces a change on a schedule mostly produces these errors; Microsoft’s current password guidance favours long passwords plus MFA over periodic expiry.