Error code search

Assertion isn't within its valid time range. Ensure that the access token isn't expired before using it for user assertion, or request a new token. Current time: {curTime}, expiry time of assertion {expTime}. Assertion is invalid because of various reasons: The token issuer doesn't match the API version within its valid time range Expired Malformed Refresh token in the assertion isn't a primary refresh token

GuestUserInPendingState - The user account doesn’t exist in the directory. An application likely chose the wrong tenant to sign into, and the currently logged in user was prevented from doing so since they didn't exist in your tenant. If this user should be able to sign in, add them as a guest. For further information, please visit add B2B users.

The user's redemption is complete but the request was not initiated by the target application.

ViralUserLegalAgeConsentRequiredState - The user requires legal age group consent.

CertificateValidationFailed - Certification validation failed, reasons for the following reasons: Cannot find issuing certificate in trusted certificates list Unable to find expected CrlSegment Cannot find issuing certificate in trusted certificates list Delta CRL distribution point is configured without a corresponding CRL distribution point Unable to retrieve valid CRL segments because of a timeout issue Unable to download CRL Contact the tenant admin.

UserUnauthorized - Users are unauthorized to call this endpoint. User account '{email}' from identity provider '{idp}' does not exist in tenant '{tenant}' and cannot access the application '{appid}'({appName}) in that tenant. This account needs to be added as an external user in the tenant first. Sign out and sign in again with a different Microsoft Entra user account. If this user should be a member of the tenant, they should be invited via the B2B system. For additional information, visit AADSTS50020.

The account type can't be used for the resource you're trying to access.

The domain is not a valid login domain for the account type - This situation occurs when the user's account does not match the expected account type for the given tenant. For instance, if the tenant is configured to allow only work or school accounts, and the user tries to sign in with a personal Microsoft account, they will receive this error.

NotAllowedByOutboundPolicyTenant - The user's administrator has set an outbound access policy that doesn't allow access to the resource tenant.

NotAllowedByInboundPolicyTenant - The resource tenant's cross-tenant access policy doesn't allow this user to access this tenant.

InvalidJwtToken - Invalid JWT token because of the following reasons: doesn't contain nonce claim, sub claim subject identifier mismatch duplicate claim in idToken claims unexpected issuer unexpected audience not within its valid time range token format isn't proper External ID token from issuer failed signature verification.

Invalid URI - domain name contains invalid characters. Contact the tenant admin.

WeakRsaKey - Indicates the erroneous user attempt to use a weak RSA key.

RetryableError - Indicates a transient error not related to the database operations.

UserAccountNotFound - To sign into this application, the account must be added to the directory. This error can occur because the user mis-typed their username, or isn't in the tenant. An application might have chosen the wrong tenant to sign into, and the currently logged in user was prevented from doing so since they did not exist in your tenant. If this user should be able to log in, add them as a guest. See docs here: Add B2B users.

UnableToGeneratePairwiseIdentifierWithMissingSalt - The salt required to generate a pairwise identifier is missing in principle. Contact the tenant admin.

UnableToGeneratePairwiseIdentifierWithMultipleSalts

SubjectMismatchesIssuer - Subject mismatches Issuer claim in the client assertion. Contact the tenant admin.

NoSuchInstanceForDiscovery - Unknown or invalid instance.

MalformedDiscoveryRequest - The request is malformed.

This error can result from two different reasons: IdsLocked - The account is locked because the user tried to sign in too many times with an incorrect user ID or password. The user is blocked due to repeated sign-in attempts. See Remediate risks and unblock users. Or, sign-in was blocked because it came from an IP address with malicious activity. To determine which failure reason caused this error, sign in to the Microsoft Entra admin center as at least a Cloud Application Administrator. Navigate to your Microsoft Entra tenant and then Monitoring & health > Sign-in logs. Find the failed user sign-in with Sign-in error code 50053 and check the Failure reason.

InvalidPasswordExpiredPassword - The password is expired. The user's password is expired, and therefore their login or session was ended. They will be offered the opportunity to reset it, or can ask an admin to reset it via Reset a user's password using Microsoft Entra ID.

Invalid or null password: password doesn't exist in the directory for this user. The user should be asked to enter their password again.

UserDisabled - The user account is disabled. The user object in Active Directory backing this account has been disabled. An admin can re-enable this account through PowerShell

UserInformationNotProvided - Session information isn't sufficient for single-sign-on. This means that a user isn't signed in. This is a common error that's expected when a user is unauthenticated and hasn't yet signed in. If this error is encountered in an SSO context where the user has previously signed in, this means that the SSO session was either not found or invalid. This error might be returned to the application if prompt=none is specified.

MissingTenantRealmAndNoUserInformationProvided - Tenant-identifying information wasn't found in either the request or implied by any provided credentials. The user can contact the tenant admin to help resolve the issue.

SignoutInvalidRequest - Unable to complete sign out. The request was invalid.

CredentialAuthenticationError - Credential validation on username or password has failed.

SignoutInitiatorNotParticipant - Sign out has failed. The app that initiated sign out isn't a participant in the current session.

SignoutUnknownSessionIdentifier - Sign out has failed. The sign out request specified a name identifier that didn't match the existing session(s).

SignoutMessageExpired - The logout request has expired.

UserStrongAuthEnrollmentRequiredInterrupt - User needs to enroll for second factor authentication (interactive).

UserStrongAuthClientAuthNRequiredInterrupt - Strong authentication is required and the user did not pass the MFA challenge.

UserStrongAuthClientAuthNRequired - Due to a configuration change made by the admin such as a Conditional Access policy, per-user enforcement, or because you moved to a new location, the user must use multifactor authentication to access the resource. Retry with a new authorize request for the resource.

UserStrongAuthExpired- Presented multifactor authentication has expired due to policies configured by your administrator. You must refresh your multifactor authentication to access '{resource}'.

UserStrongAuthEnrollmentRequired - Due to a configuration change made by the admin such as a Conditional Access policy, per-user enforcement, or because the user moved to a new location, the user is required to use multifactor authentication. Either a managed user needs to register security info to complete multifactor authentication, or a federated user needs to get the multifactor claim from the federated identity provider.

Refresh token needs social IDP login. Have user try signing-in again with username -password

SasNonRetryableError

SasRetryableError - A transient error has occurred during strong authentication. Please try again.

Limit on telecom MFA calls reached. Please try again in a few minutes.