Microsoft error codes

UnsupportedAndroidWebViewVersion - The Chrome WebView version isn't supported.

InvalidCrlDownload

DeviceOnlyTokensNotSupportedByResource - The resource isn't configured to accept device-only tokens.

CachedCredentialNonGWAuthNRequestsNotSupported - Backup Auth Service only allows AuthN requests from Microsoft Entra Gateway. This error is returned when traffic targets the backup auth service directly instead of going through the reverse proxy.

BulkAADJTokenUnauthorized - The user isn't authorized to register devices in Microsoft Entra ID.

RequiredClaimIsMissing - The id_token can't be used as urn:ietf:params:oauth:grant-type:jwt-bearer grant.

Unexpected result from authorize endpoint call.

Authorization code not received from authorize endpoint call. Error: {errorInfo}.

Provided value for the input parameter scope '{scope}' isn't valid when requesting an access token. Specify a valid scope.

Provided value for the input parameter scope can't be empty when requesting an access token using the provided authorization code. Specify a valid scope.

InboundIdTokenIssuerInvalid - The inbound ID token received in the federation has an invalid issuer. Either it is empty, or it does not match the realm identifier.

OAuth2IdPUnretryableServerError - There's an issue with your federated Identity Provider. Contact your IDP to resolve this issue.

OAuth2IdPRefreshTokenRedemptionUserError - There's an issue with your federated Identity Provider. Contact your IDP to resolve this issue.

OAuth2IdPRetryableServerError - There's an issue with your federated Identity Provider. Contact your IDP to resolve this issue.

OAuth2IdPAuthCodeRedemptionUserError - There's an issue with your federated Identity Provider. Contact your IDP to resolve this issue.

TokenIssuanceError - There's an issue with the sign-in service. Open a support ticket to resolve this issue.

InvalidResource - The resource is disabled or doesn't exist. Check your app's code to ensure that you have specified the exact resource URL for the resource you're trying to access.

InvalidResourceServicePrincipalNotFound - The resource principal named {name} wasn't found in the tenant named {tenant}. This can happen if the application hasn't been installed by the administrator of the tenant or consented to by any user in the tenant. You might have sent your authentication request to the wrong tenant. If you expect the app to be installed, you might need to provide administrator permissions to add it. Check with the developers of the resource and application to understand what the right setup for your tenant is.

InvalidResourceServicePrincipalDisabled - The service principal for resource '{identifier}' is disabled. This indicates that a subscription within the tenant has lapsed, or that an administrator for this tenant has disabled the application's service principal, preventing tokens from being issued for it. For more information, see Disable user sign-in for application.

NotAllowedTenant - Sign-in failed because of a restricted proxy access on the tenant. If it's your own tenant policy, you can change your restricted tenant settings to fix this issue.

Access to '{tenant}' tenant is denied. AADSTS500021 indicates that the tenant restriction feature is configured and that the user is trying to access a tenant that isn't in the list of allowed tenants specified in the header Restrict-Access-To-Tenant. For more information, see Use tenant restrictions to manage access to SaaS cloud applications.

Access to '{tenant}' tenant is denied. AADSTS500022 indicates that the tenant restriction feature is configured and that the user is trying to access a tenant that isn't in the list of allowed tenants specified in the header Restrict-Access-To-Tenant. For more information, see Use tenant restrictions to manage access to SaaS cloud applications.

NotAllowedTenantBlockedTenantFraud - We are sorry, this resource is not available. If you are seeing this message by mistake, please contact Microsoft support.

MissingSigningKey - Sign-in failed because of a missing signing key or certificate. This might be because there was no signing key configured in the app. To learn more, see the troubleshooting article for error AADSTS50003. If you still see issues, contact the app owner or an app admin.

DevicePolicyError - User tried to sign in to a device from a platform not currently supported through Conditional Access policy.

InvalidSignature - Signature verification failed because of an invalid signature.

PartnerEncryptionCertificateMissing - The partner encryption certificate wasn't found for this app. Open a support ticket with Microsoft to get this fixed.

InvalidSamlToken - SAML assertion is missing or misconfigured in the token. Contact your federation provider.

InvalidSamlTokenEmailMissingOrInvalid - SAML Assertion is invalid. Email address claim is missing or doesn't match domain from an external realm.

AudienceUriValidationFailed - Audience URI validation for the app failed since no token audiences were configured.

InvalidReplyTo - The reply address is missing, misconfigured, or doesn't match reply addresses configured for the app. As a resolution ensures to add this missing reply address to the Microsoft Entra application or have someone with the permissions to manage your application in Microsoft Entra IF do this for you. To learn more, see the troubleshooting article for error AADSTS50011.

AuthenticationFailed - Authentication failed for one of the following reasons: The subject name of the signing certificate isn't authorized A matching trusted authority policy wasn't found for the authorized subject name The certificate chain isn't valid The signing certificate isn't valid Policy isn't configured on the tenant Thumbprint of the signing certificate isn't authorized Client assertion contains an invalid signature

Failed to complete authentication with external provider due to invalid id_token. Failure details: {details}

InvalidAssertion - Assertion is invalid because of various reasons - The token issuer doesn't match the API version within its valid time range -expired -malformed - Refresh token in the assertion isn't a primary refresh token. Contact the app developer.

Assertion isn't within its valid time range. Ensure that the access token isn't expired before using it for user assertion, or request a new token. Current time: {curTime}, expiry time of assertion {expTime}. Assertion is invalid because of various reasons: The token issuer doesn't match the API version within its valid time range Expired Malformed Refresh token in the assertion isn't a primary refresh token

GuestUserInPendingState - The user account doesn’t exist in the directory. An application likely chose the wrong tenant to sign into, and the currently logged in user was prevented from doing so since they didn't exist in your tenant. If this user should be able to sign in, add them as a guest. For further information, please visit add B2B users.

The user's redemption is complete but the request was not initiated by the target application.

ViralUserLegalAgeConsentRequiredState - The user requires legal age group consent.

CertificateValidationFailed - Certification validation failed, reasons for the following reasons: Cannot find issuing certificate in trusted certificates list Unable to find expected CrlSegment Cannot find issuing certificate in trusted certificates list Delta CRL distribution point is configured without a corresponding CRL distribution point Unable to retrieve valid CRL segments because of a timeout issue Unable to download CRL Contact the tenant admin.

UserUnauthorized - Users are unauthorized to call this endpoint. User account '{email}' from identity provider '{idp}' does not exist in tenant '{tenant}' and cannot access the application '{appid}'({appName}) in that tenant. This account needs to be added as an external user in the tenant first. Sign out and sign in again with a different Microsoft Entra user account. If this user should be a member of the tenant, they should be invited via the B2B system. For additional information, visit AADSTS50020.