Azure AD Error Codes – Documentation
This documentation provides an overview of common Azure AD error codes that result in failed login attempts, even when valid credentials are entered. Each error code includes a detailed description, potential causes, and recommended solutions to help administrators quickly identify and resolve issues related to account access, MFA challenges, Conditional Access policies, and Identity Protection.
50053 – Account Locked Out
Description:
The account is temporarily locked due to multiple failed credential attempts.
Purpose: Protects against brute-force attacks or repeated password guessing attempts.
Potential Causes:
- Too many incorrect password attempts.
- Risk-based policies (e.g., Identity Protection) enforcing temporary lockouts.
Solution:
- Wait for the lockout duration to expire (e.g., 30 minutes).
- If needed, reset the password or unlock the account manually in Azure AD.
50126 – Invalid Credentials
Description:
The credentials provided (username/password) are incorrect.
Potential Causes:
- The user mistyped their password.
- Password mismatch between Azure AD and on-premises AD (if using Password Hash Sync or Pass-through Authentication).
- Expired or recently changed password.
Solution:
- Verify that the correct username and password were entered.
- If necessary, reset the password or check for sync issues if on-prem AD is involved.
53003 – Access Blocked by Conditional Access Policies
Description:
The sign-in attempt was blocked by a Conditional Access policy (e.g., access from restricted locations or devices).
This error occurs after the user successfully enters valid credentials.
Potential Causes:
- Attempt from a blocked IP address or country.
- Untrusted device attempting to access resources.
- User not meeting MFA or compliance requirements.
Solution:
- Review the Conditional Access policy settings under:
- Azure AD > Security > Conditional Access.
- If the block was caused by location, check Named Locations and allow access if appropriate.
- Ensure the user complies with MFA policies and device compliance requirements.
500121 – Correct Credentials but MFA Failed
Description:
The user entered correct credentials, but the MFA challenge failed.
Potential Causes:
- The user didn’t complete the MFA prompt (e.g., push notification not approved).
- Network issues on the user’s device.
- Credentials may have been leaked and are being misused from a suspicious device or location.
Solution:
- Confirm that the user’s credentials have not been leaked by reviewing sign-in patterns.
- Verify the MFA prompt was received and completed.
- Review the MFA setup in Azure AD > Security > MFA.
50076 – MFA Required but Not Fulfilled
Description:
The user entered valid credentials, but MFA was required and not completed.
Potential Causes:
- The user failed to complete the MFA challenge.
- Network issues or device misconfiguration prevented MFA completion.
Solution:
- Verify the user received the MFA prompt and check for network issues.
- Ensure the MFA setup is correct under Azure AD > Security > MFA.
50144 – Sign-in Blocked due to Risk
Description:
The sign-in was blocked by Identity Protection due to detected risky behavior.
Potential Causes:
- Suspicious login patterns triggered a block.
- Identity Protection flagged the sign-in as risky.
Solution:
- Review the user’s risk level in Identity Protection.
- If incorrectly flagged, dismiss the user’s risk.
50158 – Consent Required
Description:
The user entered valid credentials, but the application requires user consent, which was not granted.
Potential Causes:
- The user needs to provide consent to access the requested application.
Solution:
- Review the application settings and grant the required user consent.
Summary Table
| Error Code | Description | Potential Causes | Solution | Valid Credentials Passed |
|---|---|---|---|---|
| 50053 | Account locked out (multiple failed attempts) | Too many failed login attempts; brute-force lockout | Wait for lockout to expire or manually unlock | No |
| 50126 | Invalid credentials | Mistyped password; password mismatch | Verify credentials or reset password | No |
| 53003 | Access blocked by Conditional Access policies | Blocked IP/country; device non-compliance; credentials leaked | Confirm credentials are not leaked; review policies | Yes |
| 500121 | Correct credentials but MFA failed | User didn’t complete MFA prompt or network issue; credentials leaked | Confirm credentials are not leaked, verify MFA prompt | Yes |
| 50076 | MFA required but not fulfilled | User failed to complete MFA challenge | Verify network issues or device configuration | Yes |
| 50144 | Sign-in blocked due to risk | Identity Protection flagged risky behavior | Dismiss risk if flagged incorrectly | Yes |
| 50158 | Consent required | App requires user consent | Grant consent for required application access | Yes |