Skip to content
DevOps AI ToolKit
All troubleshooting hubs Troubleshooting hub

Microsoft Entra ID (Azure AD) Sign-in Errors

The AADSTS error codes that block sign-in and app auth across Microsoft Entra ID (Azure AD), Teams, and Azure apps — conditional-access blocks, missing admin consent, expired client secrets, redirect-URI mismatches. Each guide decodes the exact AADSTS number and the admin fix. Find your code below, or describe the failure to the assistant.

Fix your error now

Paste the error or logs and let the Incident Assistant diagnose it, or run a guided triage prompt with AI — no copy-paste.

Diagnose with the Incident Assistant →

AADSTS error code reference

The sign-in error codes Entra ID (Azure AD) returns most often, what each one actually means, and the first thing to change. Codes in colour link to a full guide.

CodeWhat it meansFirst fix to try
AADSTS50011 The redirect URI in the request does not match one registered on the app. Add the exact URI (scheme, host, port, path, trailing slash) under App registrations → Authentication.
AADSTS50020 The user account is from another tenant and cannot access this application. Invite the account as a guest, or make the app multi-tenant if external access is intended.
AADSTS50034 The account does not exist in the tenant the request was sent to. Check for a typo in the username, and confirm you are signing in against the right tenant.
AADSTS50053 The account is locked by smart lockout after repeated failed sign-ins. Wait out the lockout window, then find the source of the bad credentials in the sign-in logs.
AADSTS50055 The password has expired. Reset the password, or exempt the service account from expiry if it is non-interactive.
AADSTS50058 A silent sign-in was attempted but no user session exists. Fall back to an interactive prompt; silent-only auth cannot establish a first session.
AADSTS50076 Multi-factor authentication is required for this resource. Complete an interactive MFA prompt; a client-credentials or silent flow cannot satisfy MFA.
AADSTS50105 The signed-in user is not assigned a role for the application. Assign the user or group to the enterprise app, or turn off "User assignment required".
AADSTS50126 The username or password is invalid. Re-check the credential; if it is a service account, confirm nothing rotated it underneath you.
AADSTS50194 A single-tenant app was called through the /common endpoint. Use the tenant-specific authority, or register the app as multi-tenant.
AADSTS53003 Access was blocked by a Conditional Access policy. Open the sign-in log entry and read which policy matched — location, device state and MFA are the usual causes.
AADSTS65001 The user or administrator has not consented to the application. Grant admin consent for the requested scopes under Enterprise applications → Permissions.
AADSTS90002 The tenant was not found. Verify the tenant ID or domain in the authority URL; a deleted or mistyped tenant produces this.
AADSTS500011 The resource principal was not found in the tenant. Check the scope/audience you requested, and confirm the API’s service principal exists in the tenant.
AADSTS700016 The application was not found in the directory. Confirm the client ID and the tenant; a multi-tenant app also needs consent in the signing-in tenant.
AADSTS7000215 The client secret provided is invalid. Use the secret VALUE, not its ID — and confirm it has not been rotated or removed.
AADSTS7000222 The client secret has expired. Create a new secret under Certificates & secrets and roll it into the app configuration.
AADSTS900023 The tenant identifier is neither a valid GUID nor a valid domain name. Fix the authority URL — this is a malformed tenant value, not a permissions problem.
AADSTS9002325 A single-page app redeemed an auth code without PKCE. Register the redirect URI under the SPA platform and use the authorization-code flow with PKCE.

Every guide in this cluster

10 guides

Azure with AI AI prompts

Copy-paste, production-safe prompts for this stack.

More Azure with AI guides

Every Azure with AI prompt and troubleshooting guide.

Frequently asked questions

What does an AADSTS error code tell me?
The AADSTS number pinpoints the failure stage. AADSTS50105 is a conditional-access / assignment block, AADSTS65001 is missing user or admin consent, AADSTS7000215 is an invalid client secret, AADSTS90002 is a tenant-not-found. Look up your exact code in the guides below for the specific fix.
Why does the same AADSTS code appear in both Teams and Azure guides?
Teams, the Azure portal, and custom apps all authenticate through the same Entra ID (Azure AD) token service, so they surface identical AADSTS codes. The root cause and the admin-center fix are the same regardless of which app reported it — these hubs group them so you can jump straight to the code.
My client secret "just expired" — where do I fix it?
In the Entra admin center under App registrations → your app → Certificates & secrets, create a new client secret, update it in the app configuration, and remove the expired one. See AADSTS7000215.