Microsoft error codes

The account type can't be used for the resource you're trying to access.

The domain is not a valid login domain for the account type - This situation occurs when the user's account does not match the expected account type for the given tenant. For instance, if the tenant is configured to allow only work or school accounts, and the user tries to sign in with a personal Microsoft account, they will receive this error.

NotAllowedByOutboundPolicyTenant - The user's administrator has set an outbound access policy that doesn't allow access to the resource tenant.

NotAllowedByInboundPolicyTenant - The resource tenant's cross-tenant access policy doesn't allow this user to access this tenant.

InvalidJwtToken - Invalid JWT token because of the following reasons: doesn't contain nonce claim, sub claim subject identifier mismatch duplicate claim in idToken claims unexpected issuer unexpected audience not within its valid time range token format isn't proper External ID token from issuer failed signature verification.

Invalid URI - domain name contains invalid characters. Contact the tenant admin.

WeakRsaKey - Indicates the erroneous user attempt to use a weak RSA key.

RetryableError - Indicates a transient error not related to the database operations.

UserAccountNotFound - To sign into this application, the account must be added to the directory. This error can occur because the user mis-typed their username, or isn't in the tenant. An application might have chosen the wrong tenant to sign into, and the currently logged in user was prevented from doing so since they did not exist in your tenant. If this user should be able to log in, add them as a guest. See docs here: Add B2B users.

UnableToGeneratePairwiseIdentifierWithMissingSalt - The salt required to generate a pairwise identifier is missing in principle. Contact the tenant admin.

UnableToGeneratePairwiseIdentifierWithMultipleSalts

SubjectMismatchesIssuer - Subject mismatches Issuer claim in the client assertion. Contact the tenant admin.

NoSuchInstanceForDiscovery - Unknown or invalid instance.

MalformedDiscoveryRequest - The request is malformed.

This error can result from two different reasons: IdsLocked - The account is locked because the user tried to sign in too many times with an incorrect user ID or password. The user is blocked due to repeated sign-in attempts. See Remediate risks and unblock users. Or, sign-in was blocked because it came from an IP address with malicious activity. To determine which failure reason caused this error, sign in to the Microsoft Entra admin center as at least a Cloud Application Administrator. Navigate to your Microsoft Entra tenant and then Monitoring & health > Sign-in logs. Find the failed user sign-in with Sign-in error code 50053 and check the Failure reason.

InvalidPasswordExpiredPassword - The password is expired. The user's password is expired, and therefore their login or session was ended. They will be offered the opportunity to reset it, or can ask an admin to reset it via Reset a user's password using Microsoft Entra ID.

Invalid or null password: password doesn't exist in the directory for this user. The user should be asked to enter their password again.

UserDisabled - The user account is disabled. The user object in Active Directory backing this account has been disabled. An admin can re-enable this account through PowerShell

UserInformationNotProvided - Session information isn't sufficient for single-sign-on. This means that a user isn't signed in. This is a common error that's expected when a user is unauthenticated and hasn't yet signed in. If this error is encountered in an SSO context where the user has previously signed in, this means that the SSO session was either not found or invalid. This error might be returned to the application if prompt=none is specified.

MissingTenantRealmAndNoUserInformationProvided - Tenant-identifying information wasn't found in either the request or implied by any provided credentials. The user can contact the tenant admin to help resolve the issue.

SignoutInvalidRequest - Unable to complete sign out. The request was invalid.

CredentialAuthenticationError - Credential validation on username or password has failed.

SignoutInitiatorNotParticipant - Sign out has failed. The app that initiated sign out isn't a participant in the current session.

SignoutUnknownSessionIdentifier - Sign out has failed. The sign out request specified a name identifier that didn't match the existing session(s).

SignoutMessageExpired - The logout request has expired.

UserStrongAuthEnrollmentRequiredInterrupt - User needs to enroll for second factor authentication (interactive).

UserStrongAuthClientAuthNRequiredInterrupt - Strong authentication is required and the user did not pass the MFA challenge.

UserStrongAuthClientAuthNRequired - Due to a configuration change made by the admin such as a Conditional Access policy, per-user enforcement, or because you moved to a new location, the user must use multifactor authentication to access the resource. Retry with a new authorize request for the resource.

UserStrongAuthExpired- Presented multifactor authentication has expired due to policies configured by your administrator. You must refresh your multifactor authentication to access '{resource}'.

UserStrongAuthEnrollmentRequired - Due to a configuration change made by the admin such as a Conditional Access policy, per-user enforcement, or because the user moved to a new location, the user is required to use multifactor authentication. Either a managed user needs to register security info to complete multifactor authentication, or a federated user needs to get the multifactor claim from the federated identity provider.

Refresh token needs social IDP login. Have user try signing-in again with username -password

SasNonRetryableError

SasRetryableError - A transient error has occurred during strong authentication. Please try again.

Limit on telecom MFA calls reached. Please try again in a few minutes.

Authentication failed due to flow token expired. Expected - auth codes, refresh tokens, and sessions expire over time or are revoked by the user or an admin. The app will request a new login from the user.

DeviceAuthenticationRequired - Device authentication is required.

JWT body must contain '{field}'.

PKeyAuthInvalidJwtUnauthorized - The JWT signature is invalid.

There was an error transforming the claims for the token.

Unknown claims transformer '{name}' was specified for principal '{principalId}'.