Microsoft error codes

Unable to load CustomClaimsTransformer '{type}' was specified for principal '{principalId}'.

There was an error transforming the claims for the token: {errorMessage}

EntitlementGrantsNotFound - The signed in user isn't assigned to a role for the signed in app. Assign the user to the app. To learn more, see the troubleshooting article for error AADSTS50105.

The requested federation realm object '{name}' doesn't exist. Application error - the login request was malformed and couldn't be matched with an existing authentication endpoint or instance.

Claims transformation configuration could not be retrieved.

Claim transformation is unknown from configuration.

Unknown claim transformation was asked to be applied.

Failed to deserialize policy specified in the request's claim parameter.

Unknown credential type, issue with the JWT header. Contact the tenant admin.

Unknown claims transformation method '{method}' was specified for principal '{principalId}'.

Invalid regular expression configured for claims transformation for this application. Contact your tenant admin to fix the claims mapping configuration. See Customize SAML token claims

Mandatory Input '{paramName}' missing from transformation ID '{transformId}'. This error is returned while Microsoft Entra ID is trying to build a SAML response to the application. NameID claim or NameIdentifier is mandatory in SAML response and if Microsoft Entra ID failed to get source attribute for NameID claim, it returns this error. As a resolution, ensure that you add claim rules. To add claim rules, sign in to the Microsoft Entra admin center as at least a Cloud Application Administrator, and then browse to Entra ID > Enterprise apps. Select your application, select Single Sign-On and then in User Attributes & Claims enter the Unique User Identifier (Name ID).

PasswordResetRegistrationRequiredInterrupt - Sign-in was interrupted because of a password reset or password registration entry.

InvalidUserNameOrPassword - Error validating credentials due to invalid username or password. The user didn't enter the right credentials. Expect to see some number of these errors in your logs due to users making mistakes.

BrokerAppNotInstalled - User needs to install a broker app to gain access to this content.

Invalid domain name - No tenant-identifying information found in either the request or implied by any provided credentials.

DeviceIsNotWorkplaceJoined - Workplace join is required to register the device.

The claim value(s) '{value}' cannot be interpreted as known auth method(s).

ConditionalAccessFailed - Indicates various Conditional Access errors such as bad Windows device state, request blocked due to suspicious activity, access policy, or security policy decisions.

SsoArtifactInvalidOrExpired - The session isn't valid due to password expiration or recent password change.

SsoArtifactRevoked - The session isn't valid due to password expiration or recent password change.

DeviceFlowAuthorizeWrongDatacenter - Wrong data center. To authorize a request that was initiated by an app in the OAuth 2.0 device flow, the authorizing party must be in the same data center where the original request resides.

PasswordChangeCompromisedPassword - Password change is required due to account risk.

RedirectMsaSessionToApp - Single MSA session detected.

Password needs to be changed due to security policy rule.

Invalid encryption key environment.

SessionMissingMsaOAuth2RefreshToken - The session is invalid due to a missing external refresh token.

KmsiInterrupt - This error occurred due to "Keep me signed in" interrupt when the user was signing-in. This is an expected part of the sign in flow, where a user is asked if they want to remain signed into their current browser to make further logins easier. For more information, see The new Microsoft Entra sign-in and “Keep me signed in” experiences rolling out now!. You can open a support ticket with Correlation ID, Request ID, and Error code to get more details.

Protected key isn't intended for the authenticated user.

Password change is required due to a Conditional Access policy.

Session mismatch - Session is invalid because user tenant doesn't match the domain hint due to different resource. Open a support ticket with Correlation ID, Request ID, and Error code to get more details.

InvalidPasswordExpiredOnPremPassword - User's Active Directory password has expired. Generate a new password for the user or have the user use the self-service reset tool to reset their password.

MissingCustomSigningKey - This app is required to be configured with an app-specific signing key. It's either not configured with one, or the key has expired or isn't yet valid. Please contact the owner of the application.

AcceptMappedClaims is only supported for a token audience matching the application GUID or an audience within the tenant's verified domains. Either change the resource identifier, or use an application-specific signing key.

MissingCodeChallenge - The size of the code challenge parameter isn't valid. Invalid size of the code challenge parameter. Contact the application owner to correct their use of the PKCE parameters.

The code_verifier doesn't match the code_challenge supplied in the authorization request for PKCE. Contact the application owner to correct their use of the PKCE parameters.

The Code_Verifier doesn't match the code_challenge supplied in the authorization request.

Invalid Code_Challenge_method parameter.

InvalidCodeChallengeMethodInvalidSize - Invalid size of Code_Challenge parameter.

The provided credentials does not have a valid user consent approval information.