When a managed device can't get into Microsoft 365, the answer is usually an AADSTS code on the sign-in page or in the Microsoft Entra sign-in log. This quick reference covers the 44 codes Intune and Jamf admins meet most, from compliance blocks and MFA to tokens, accounts and the app-registration errors behind Jamf Connect and Jamf Pro SSO, with Microsoft's meaning, the usual cause on a managed device and the first check.
Codes in this quick reference
AADSTS53000 DeviceNotCompliant: Conditional Access requires a compliant deviceSign-in page / Microsoft Entra sign-in logAADSTS53001 DeviceNotDomainJoined: policy requires a domain-joined deviceSign-in page / Microsoft Entra sign-in logAADSTS53002 ApplicationUsedIsNotAnApprovedApp: app isn't approved for Conditional AccessSign-in page / Microsoft Entra sign-in logAADSTS53003 BlockedByConditionalAccess: a policy doesn't allow token issuanceSign-in page / Microsoft Entra sign-in logAADSTS50131 ConditionalAccessFailed: Conditional Access error such as a bad Windows device stateMicrosoft Entra sign-in logAADSTS50005 DevicePolicyError: platform not supported by a Conditional Access policyMicrosoft Entra sign-in logAADSTS50097 DeviceAuthenticationRequired: device authentication is requiredMicrosoft Entra sign-in log (Interrupted)AADSTS50155 DeviceAuthenticationFailed: device authentication failed for this userSign-in log / dsregcmd /status
+ 34 more codes in the tables below.
How to read these codes#
Microsoft Entra ID returns an AADSTS code whenever its token service refuses or interrupts a sign-in. You'll find it in four places:
- Sign-in page or app dialog: the code and a short message, plus a request ID, correlation ID and timestamp in the troubleshooting details. Ask users to copy them.
- Microsoft Entra sign-in log (Entra ID › Monitoring & health › Sign-in logs): the number without the prefix, the failure reason and the Device info, Authentication Details and Conditional Access tabs.
- Windows: Applications and Services Logs › Microsoft › Windows › AAD › Operational in Event Viewer, and the PRT diagnostics in
dsregcmd /status. - Jamf Connect: the login window shows Microsoft's sign-in page, so the error appears there.
Some codes are interrupts, not failures: Entra ID asks for device proof, MFA or a Keep me signed in answer, and a success often follows, so check the next sign-in before you troubleshoot. Codes and messages change over time; for the current text, add the number to https://login.microsoftonline.com/error?code=53000.
PowerShell
# Recent failures with one code (needs AuditLog.Read.All, Directory.Read.All)
Connect-MgGraph -Scopes "AuditLog.Read.All","Directory.Read.All"
Get-MgAuditLogSignIn -Filter "status/errorCode eq 53000" -Top 20 |
Select-Object CreatedDateTime, UserPrincipalName, AppDisplayName,
@{n='Device';e={$_.DeviceDetail.DisplayName}}, @{n='Compliant';e={$_.DeviceDetail.IsCompliant}}
# On the Windows device, in the user's session
dsregcmd /status
Get-WinEvent -LogName 'Microsoft-Windows-AAD/Operational' -MaxEvents 50 |
Where-Object LevelDisplayName -eq 'Error' | Format-List TimeCreated, Id, MessageDevice state and Conditional Access#
Conditional Access never asks Intune or Jamf Pro. It reads the Microsoft Entra device object the browser or app presents, so start with Device info: no device ID means the client didn't present the device; Compliant set to No means compliance hasn't reached Entra ID. For Macs, see AADSTS53000 on a Jamf-managed Mac.
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
AADSTS53000DeviceNotCompliant | A policy requires a compliant device, and this one isn't | Not enrolled, a failing setting, compliance not yet reported, or a private window hiding the device | Device info, then compliance in Intune (or Jamf's compliance group). Guide |
AADSTS53001DeviceNotDomainJoined | A policy requires a domain-joined device (in practice, the Require Microsoft Entra hybrid joined device control) | The device isn't hybrid joined, or the policy also targets macOS, iOS or Android | dsregcmd /status; scope the control to Windows or pair it with the compliant-device control. Guide |
AADSTS53002ApplicationUsedIsNotAnApprovedApp | The app isn't approved for Conditional Access | Only approved or app-protected apps are allowed, and the user opened another mail app or browser | Use Outlook or Edge; check the policy's grant controls (app protection guide) |
AADSTS53003BlockedByConditionalAccess | A policy doesn't allow a token to be issued | A block policy: location, platform, client app or authentication flow | Conditional Access tab, then What If. With Automated Device Enrollment, Jamf advises keeping the Jamf Connect app out of Conditional Access; excluding it from all-cloud-apps policies takes Jamf's custom-API app registration. Guide |
AADSTS50131ConditionalAccessFailed | A Conditional Access error: bad Windows device state, suspicious activity or a policy decision | Varies; the failure reason names it | Failure reason and Conditional Access tab; on Windows, dsregcmd /status |
AADSTS50005DevicePolicyError | The device platform isn't supported by a policy that applies | The client reported a platform the policy's platform condition doesn't cover | Device info's operating system vs the policy's Device platforms condition |
AADSTS50097DeviceAuthenticationRequired | Device authentication is required | Usually an interrupt: Entra ID asks the client to prove the device, then succeeds | Act only if no success follows: browser support and the device's registration |
AADSTS50155DeviceAuthenticationFailed | Device authentication failed for this user | The device object was deleted or disabled in Entra ID while the device still uses that registration | Re-enable the device object, or re-register the device. Guide |
AADSTS50187DeviceInformationNotProvided | The service couldn't perform device authentication | The client didn't supply usable device information | The device's registration; browser or app support for device sign-in |
AADSTS50129DeviceIsNotWorkplaceJoined | Workplace join (registration) is required | The device isn't Microsoft Entra registered | Register through Company Portal, or on Macs the Jamf Self Service registration policy (registration guide) |
AADSTS135011 | Device used during the authentication is disabled | An admin, a policy or the user disabled the device object | Entra ID › Devices › All devices: enable it if the device is legitimate (device clean-up guide) |
AADSTS50127BrokerAppNotInstalled | The user needs a broker app | App protection or device-based access on a phone without Microsoft Authenticator (iOS/iPadOS) or Company Portal (Android) | Install the broker app and sign in again |
MFA and authentication strength#
On devices these appear at first sign-in (Autopilot, a new phone, the Jamf Connect login window) and with tools that can't prompt. Full walkthrough: AADSTS50076, 50079 and 50158.
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
AADSTS50072UserStrongAuthEnrollmentRequiredInterrupt | The user must register for MFA (interactive) | First sign-in before any security info exists | Let the user register; for new hires, a Temporary Access Pass |
AADSTS50074UserStrongAuthClientAuthNRequiredInterrupt | MFA required and not yet passed | Interrupt while the prompt is shown | The next sign-in; act only if it fails |
AADSTS50076UserStrongAuthClientAuthNRequired | MFA is required (a policy, per-user MFA or a new location) | A client that can't prompt, such as a password-only (ROPG) check | The policy that demands MFA; for Jamf Connect, the Jamf Connect guide |
AADSTS50079UserStrongAuthEnrollmentRequired | MFA is required and the user must register security info | No methods registered, or a federated user without the MFA claim | Registration status; a Temporary Access Pass |
AADSTS50078UserStrongAuthExpired | The MFA presented has expired under your policies | Sign-in frequency or MFA freshness requirements | Session controls in the matching policy |
AADSTS50158 | External security challenge not satisfied | A redirect to terms of use or a third-party MFA provider; not a failure on its own | The following sign-in shows whether it passed |
AADSTS53004ProofUpBlockedDueToRisk | MFA registration is required first | A risky sign-in prevented the registration | Risk detections in ID Protection; remediate, then register with a Temporary Access Pass |
AADSTS53010ProofUpBlockedDueToSecurityInfoAcr | Security info must be set from specific locations or devices | A policy on the Register security information action requires a compliant device or trusted location | Register from a compliant device or trusted network, or use a Temporary Access Pass |
AADSTS500121 | Authentication failed during strong authentication request | The prompt was denied, ignored or timed out, or the method is broken (a new phone) | Authentication Details tab; the user's registered methods |
Tokens, sessions and single sign-on#
Silent sign-in on Windows depends on the Primary Refresh Token (PRT); on Apple devices, on the Enterprise SSO plug-in or Platform SSO. Guides: PRT, Platform SSO with Intune, Platform SSO with Jamf Pro.
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
AADSTS50058UserInformationNotProvided | Session information isn't sufficient for single sign-on | Expected before sign-in; in an SSO flow, no valid session was found | AzureAdPrt in dsregcmd /status; Edge profile sign-in; the SSO plug-in on Apple devices |
AADSTS50132 / AADSTS50133 | The session isn't valid after a password expiry or change | A password change, including SSPR or an admin reset | Sign in with the new password; on Windows, lock and unlock to refresh the PRT |
AADSTS50173 | The grant was revoked; a fresh token is needed | A password change or reset, or revoked sessions | Sign in again; check the audit log for revoked sessions |
AADSTS70043BadTokenDueToSignInFrequency | Refresh token expired under a sign-in frequency check | A Conditional Access session control | Expected; review the policy's frequency |
AADSTS700082ExpiredOrRevokedGrantInactiveToken | Refresh token expired through inactivity | The app wasn't used for a long time | Expected; sign in again |
AADSTS50140KmsiInterrupt | "Keep me signed in" interrupt | The user was asked whether to stay signed in | Expected; no action |
AADSTS50199CmsiInterrupt | User confirmation is required for this request | A native app used a system web view; an anti-spoofing prompt | Expected; no action |
AADSTS50168 | No valid SSO token from the Windows 10 Accounts extension; the request is interrupted to fetch one | Usually an interrupt; if it repeats, no valid PRT or a broken extension | AzureAdPrt in dsregcmd /status; the extension installed and enabled |
Accounts and passwords#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
AADSTS50126InvalidUserNameOrPassword | Invalid username or password | Typos, or a new password that hasn't synced to Entra ID yet | Password sync and recent changes. Guide |
AADSTS50034UserAccountNotFound | The account isn't in this directory | A typo, the wrong tenant, or a UPN suffix that isn't a verified domain | Compare the UPN on the device with Entra ID. Guide |
AADSTS50053 | Account locked (IdsLocked), or sign-in from a malicious IP address | Repeated failures, for example a device or app still using an old password | The failure reason in the sign-in log |
AADSTS50055 / AADSTS50144 | Password expired (cloud; on-premises Active Directory) | Password age policy | Reset the password; for 50144 it must change on-premises |
AADSTS50057UserDisabled | The user account is disabled | A disabled account, such as a leaver's device still signing in | Account state; expected for leavers |
App registrations, consent and SAML (Jamf Connect, Jamf Pro SSO)#
These point at an app registration or enterprise app, not the device. Jamf documents the Jamf Connect registration as single-tenant, with a public client redirect URI (https://127.0.0.1/jamfconnect by default) and Allow public client flows enabled for its Resource Owner Password Grant (ROPG) password checks.
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
AADSTS50011InvalidReplyTo | The reply address is missing, misconfigured or doesn't match the app's reply addresses | Jamf Pro: Reply URL differs from its /saml/SSO address. Jamf Connect: the profile's redirect URI differs from the app registration | Make both sides identical, character for character. Guide |
AADSTS700016UnauthorizedClient_DoesNotMatchRequest | Application with identifier '...' was not found in the directory '...' | Wrong client ID or tenant, or a SAML Identifier (Entity ID) that differs from Jamf Pro's | Client and tenant IDs in the profile; paste Jamf Pro's Entity ID exactly. Guide |
AADSTS50105EntitlementGrantsNotFound | The user isn't assigned to a role for the app | Assignment required is Yes and the user isn't assigned, or only through a nested group | Assign the user or a group they're a direct member of. Guide |
AADSTS50020UserUnauthorized | An account from another tenant can't access the app | A consultant's or guest's home-tenant account | Invite as a B2B guest and assign, or issue a tenant account. Guide |
AADSTS65001DelegationDoesNotExist | No user or admin consent for the app | Admin consent not granted for the app's permissions | API permissions › Grant admin consent on the app registration. Guide |
AADSTS7000218 | The request body must contain the following parameter: 'client_assertion' or 'client_secret'. | A password (ROPG) or device code flow against an app treated as a confidential client | Authentication › Allow public client flows: Yes (Microsoft KB). Guide |
AADSTS50194 | The app isn't multitenant, so the /common endpoint isn't supported | A tenant or discovery setting of common with a single-tenant app | Put the tenant ID in the tool's tenant or discovery URL setting |
AADSTS501241 | A mandatory input is missing from a claims transformation; usually the NameID | The attribute the Name ID is built from is empty for this user | Entra ID › Enterprise apps › (app) › Single sign-on, Attributes & Claims: Unique User Identifier |
How to verify a fix#
- Same path: repeat the sign-in in the same app, browser and device, not a private window.
- Sign-in log: the new event shows Success. For device codes, Device info lists the expected device ID with Compliant and Managed set to Yes, and the Conditional Access tab shows the policy as Success.
- Interrupts: a 50097, 50074, 50140, 50168 or 50199 entry is followed by a success.
- Windows:
dsregcmd /statusshowsAzureAdPrt : YESwith a recent update time. - App registrations: the enterprise app's Single sign-on › Test passes, and Jamf Connect signs in at the login window.
More on the log in reading Microsoft Entra sign-in logs like an engineer; test policy changes with What If and report-only mode.
References#
- Microsoft Entra authentication and authorization error codes (Microsoft Learn): the source of most code names and meanings
- Error AADSTS7000218 when a confidential client application authenticates (Microsoft Learn)
- Creating a Jamf Connect App Registration in Microsoft Entra ID (Jamf Learning Hub)
- Making Jamf Connect Compatible with Microsoft Conditional Access Policies (Jamf Learning Hub): ROPG, public client flows and the custom-scope exclusion
