Is AADSTS50074 a failed login?

It is a sign-in that stopped at the MFA step and was logged with a failure code. In an ordinary interactive sign-in the user approves the prompt a few seconds later and a successful entry follows from the same IP and device, so a 50074 paired with a success is routine. A 50074 with nothing after it is either a user who gave up or someone who had the password but not the second factor.

What is the difference between AADSTS50074 and AADSTS50076?

Both mean MFA was required after the password was accepted. Microsoft describes 50074 as the user not passing the MFA challenge and 50076 as MFA being required because of a policy, per-user enforcement or a new location. For an investigation both confirm that the first factor succeeded; 50076 is also what clients that cannot perform MFA at all, such as scripts and legacy protocols, typically receive.

Should I reset the password after an unpaired AADSTS50074?

If it came from an IP, country or device the user does not recognise, yes: the log shows the password worked. Reset it, revoke the user's sessions and review the registered MFA methods so the attacker has not added their own. Then search the account's other sign-ins for the same IP, because one success anywhere turns an attempt into a compromise.

Can repeated AADSTS50074 be an MFA fatigue attack?

Yes. An attacker with the password can trigger push notifications repeatedly, hoping the user approves one to make them stop. A burst of 50074 entries for one user from one unfamiliar IP, especially at night, followed by a success, is the pattern. Number matching in Microsoft Authenticator makes blind approval harder but does not remove the need to investigate the burst.

AADSTS50074: Password Accepted, MFA Not Completed

AADSTS50074: Password Accepted, MFA Not Completed — Triage Guide

Published October 6, 2026

The password was correct and Entra ID asked for multifactor authentication, which this request did not complete. Followed by a success it is routine; alone, from an unfamiliar place, it means someone else knows the password.

Did the attacker have the password? Yes — the password was accepted; the sign-in failed at a later step. Treat the credential as known to whoever attempted it.

Microsoft's definition

UserStrongAuthClientAuthNRequiredInterrupt

UserStrongAuthClientAuthNRequiredInterrupt - Strong authentication is required and the user did not pass the MFA challenge.

Source: Microsoft Entra authentication and authorization error codes · checked against the published table on every build

Where it appears

Microsoft Sentinel / Log Analytics: the ResultType column of SigninLogs and AADNonInteractiveUserSignInLogs
Microsoft Graph signIns API and JSON exports: status.errorCode, with the text in status.failureReason
Entra admin center sign-in log download (CSV): the Sign-in error code column
Typically logged seconds before a successful sign-in from the same IP when a user approves an MFA prompt

What it means

An interactive sign-in to Entra ID happens in steps: the username and password are checked, Conditional Access and MFA requirements are evaluated, the MFA challenge runs, and only then is a token issued. AADSTS50074 is logged at the MFA step when strong authentication was required and the request did not satisfy it.

For an investigation the important part is everything before that step: the password was accepted. Whether that is good news depends on who was signing in.

Is it an attack?

Most 50074 entries are routine. A user signs in, the MFA prompt appears, the interrupted step is logged with 50074, and a successful sign-in from the same IP, device and session follows within a minute. In a Graph export the shared correlationId ties the two entries together.

It becomes an attack signal when:

no success follows from the same IP within a few minutes,
the IP, country or ASN is new for the user, or belongs to hosting, VPN or Tor ranges,
the user agent is a script or a client the user does not use,
many 50074 entries hit one user in a short burst — push-notification fatigue (MITRE T1621),
the same IP produces 50074 for several users — a spray that found working passwords.

How to investigate

Find MFA-stage stops that were never completed from the same IP within ten minutes — the ones worth a human look:

let lookback = 7d;
let stops = SigninLogs
    | where TimeGenerated > ago(lookback) and ResultType in ("50074", "50076")
    | project StopTime = TimeGenerated, UserPrincipalName, IPAddress, AppDisplayName, Location;
let wins = SigninLogs
    | where TimeGenerated > ago(lookback) and ResultType == "0"
    | project WinTime = TimeGenerated, UserPrincipalName, IPAddress;
stops
| join kind=leftouter wins on UserPrincipalName, IPAddress
| summarize CompletedLater = countif(WinTime between (StopTime .. (StopTime + 10m)))
    by StopTime, UserPrincipalName, IPAddress, AppDisplayName, Location
| where CompletedLater == 0
| order by StopTime desc

For each unpaired entry from an unfamiliar source, assume the password is known: reset it, revoke the user’s sessions, list the user’s registered authentication methods and remove any the user did not add, and review recent mailbox rules and application consents. Then check whether the same IP appears in AADSTS50126 failures for other accounts — if it does, this is one result of a wider spray. Related codes AADSTS50076 and AADSTS53003 carry the same “first factor passed” meaning.

Related codes

AADSTS50076 UserStrongAuthClientAuthNRequired Entra ID accepted the username and password, then required multifactor authentication that this request did not provide. From scripts or legacy mail clients it is strong evidence that whoever sent it knows the password.
AADSTS50079 UserStrongAuthEnrollmentRequired
AADSTS50158
AADSTS53003 BlockedByConditionalAccess A Conditional Access policy blocked the sign-in. Conditional Access is enforced after first-factor authentication completes, so for an interactive sign-in an unexpected 53003 usually means the password was right.
AADSTS50126 InvalidUserNameOrPassword Entra ID rejected the password (or the username) for this sign-in. One failure is a typo; the same failure across many accounts from one IP is password spraying.
AADSTS50072 UserStrongAuthEnrollmentRequiredInterrupt

Frequently Asked Questions

Is AADSTS50074 a failed login?: It is a sign-in that stopped at the MFA step and was logged with a failure code. In an ordinary interactive sign-in the user approves the prompt a few seconds later and a successful entry follows from the same IP and device, so a 50074 paired with a success is routine. A 50074 with nothing after it is either a user who gave up or someone who had the password but not the second factor.
What is the difference between AADSTS50074 and AADSTS50076?: Both mean MFA was required after the password was accepted. Microsoft describes 50074 as the user not passing the MFA challenge and 50076 as MFA being required because of a policy, per-user enforcement or a new location. For an investigation both confirm that the first factor succeeded; 50076 is also what clients that cannot perform MFA at all, such as scripts and legacy protocols, typically receive.
Should I reset the password after an unpaired AADSTS50074?: If it came from an IP, country or device the user does not recognise, yes: the log shows the password worked. Reset it, revoke the user's sessions and review the registered MFA methods so the attacker has not added their own. Then search the account's other sign-ins for the same IP, because one success anywhere turns an attempt into a compromise.
Can repeated AADSTS50074 be an MFA fatigue attack?: Yes. An attacker with the password can trigger push notifications repeatedly, hoping the user approves one to make them stop. A burst of 50074 entries for one user from one unfamiliar IP, especially at night, followed by a success, is the pattern. Number matching in Microsoft Authenticator makes blind approval harder but does not remove the need to investigate the burst.

Find AADSTS50074 in your own logs

Drop an Entra ID sign-in export into the free browser analyzer to see which users and IPs hit this code (nothing is uploaded), or run it through LogTriage for threat-intel enrichment and an AI-written incident report.

Open the free analyzer → Analyze Your Own Logs