Error code search

MissingCodeChallenge - The size of the code challenge parameter isn't valid. Invalid size of the code challenge parameter. Contact the application owner to correct their use of the PKCE parameters.

The code_verifier doesn't match the code_challenge supplied in the authorization request for PKCE. Contact the application owner to correct their use of the PKCE parameters.

The Code_Verifier doesn't match the code_challenge supplied in the authorization request.

Invalid Code_Challenge_method parameter.

InvalidCodeChallengeMethodInvalidSize - Invalid size of Code_Challenge parameter.

The provided credentials does not have a valid user consent approval information.

DeviceAuthenticationFailed - Device authentication failed for this user.

Device tokens are not supported for V2 resource.

User redirection required for routing.

External security challenge not satisfied. User will be redirected to another page or authentication provider to satisfy additional authentication challenges. The user is required to satisfy additional requirements before finishing authentication, and was redirected to another page (such as terms of use or a third party MFA provider). This code alone doesn't indicate a failure on your users' part to sign in. The sign in logs may indicate that this challenge was successfully passed or failed.

The selected external provider authentication method configuration does not exist or is not enabled.

Claims sent by external provider are not enough.

Different target tenant is preferred.

Failed to validate authorization url of external claims provider.

Claims transformation has timed out. This indicates too many or too complex transformations may have been configured for this application. A retry of the request may succeed. Otherwise, please contact your admin to fix the configuration.

ClaimsTransformationTimeoutRegularExpressionTimeout - Regular expression replacement for claims transformation has timed out. This indicates a too complex regular expression may have been configured for this application. A retry of the request may succeed. Otherwise, please contact your admin to fix the configuration.

Regular expression replacement for claims transformation has resulted in a claim which exceeds the size limit. Please contact your admin to fix the configuration.

Regular expression replacement for claims transformation results in too many replacements in the input sourceClaim. Please contact your admin to fix the configuration.

Regular expression replacement for claims transformation has too many substitution parameters in the replacement input parameter. Please contact your admin to fix the configuration.

The supplied access token was not issued for the purpose for which it is being used. Expected a token with purpose '{name}'.

The token encrypting algorithm '{algorithm}' requested by the application isn't supported for this type of token. This indicates the application is misconfigured.

Request to External OIDC endpoint failed.

Invalid pop_jwk key.

The client is capable of utilizing the Windows 10 Accounts extension to perform SSO but no SSO token was found in the request or the token was expired. Request has been interrupted to attempt to pull an SSO token.

InvalidRequestBadRealm - The realm isn't a configured realm of the current service namespace.

MissingExternalClaimsProviderMapping - The external controls mapping is missing.

The given audience can only be used in Mutual-TLS token calls.

External claims provider {provider} isn't approved.

The provided grant has expired due to it being revoked, a fresh auth token is needed. The user might have changed or reset their password. The grant was issued on '{authTime}' and the TokensValidFrom date (before which tokens are not valid) for this user is '{validDate}'. To learn more, see the troubleshooting article for error AADSTS50173.

Missing definition of external control: {controlId}.

ExternalChallengeNotSupportedForPassthroughUsers - External challenge isn't supported for passthrough users.

SessionControlNotSupportedForPassthroughUsers - Session control isn't supported for passthrough users.

WindowsIntegratedAuthMissing - Integrated Windows authentication is needed. Enable the tenant for Seamless SSO.

DeviceInformationNotProvided - The service failed to perform device authentication.

Invalid Request - RawCredentialExpectedNotFound - No Credential was included in the sign-in request. Example: user is performing certificate-based authentication (CBA) and no certificate is sent (or Proxy removes) the user's certificate in the sign-in request.

Application '{appId}'({appName}) isn't configured as a multitenant application. Usage of the /common endpoint isn't supported for such applications created after '{time}'. Use a tenant-specific endpoint or configure the application to be multitenant.

LoopDetected - A client loop has been detected. Check the app’s logic to ensure that token caching is implemented, and that error conditions are handled correctly. The app has made too many of the same request in too short a period, indicating that it is in a faulty state or is abusively requesting tokens.

ConflictingIdentities - The user could not be found. Try signing in again.

CmsiInterrupt - For security reasons, user confirmation is required for this request. Interrupt is shown for all scheme redirects in mobile browsers. No action required. The user was asked to confirm that this app is the application they intended to sign into. This is a security feature that helps prevent spoofing attacks. This occurs because a system webview has been used to request a token for a native application. To avoid this prompt, the redirect URI should be part of the following safe list: http:// https:// chrome-extension:// (desktop Chrome browser only)

RequiredFeatureNotEnabled - The feature is disabled.