Field Notes · Sheet 09 / 30 · Conditional Access and MFA
Read the sign-in log first
Five things to read in the Entra sign-in log, in order, before changing any setting, and the seven AADSTS error codes worth knowing by heart.
Bradley Baker · · 1 min read
When I teach a newer admin to troubleshoot a failed sign-in, we read five things in the Entra sign-in log, in the same order, before anyone changes a setting. This is the longer version of Sheet 09.
Five things, in order
- Status and error code. The code usually tells you which layer said no.
- Authentication Details. Which methods were used, in what order, and whether MFA was satisfied or covered by a claim already in the token.
- The Conditional Access tab. Each policy shows whether it applied and whether it passed. Sheet 07 covers how Entra decides between them.
- The Report-only tab. What policies still in testing would have done. Sheet 06 covers the four results you'll see there.
- Device info and Location. Compliant, hybrid joined, or unknown, and from where.
Error codes worth knowing by heart
| Code | What it means |
|---|---|
| AADSTS50126 | Invalid username or password. |
| AADSTS50076 | MFA required because of a policy, per-user enforcement, or a new location. |
| AADSTS50074 | Strong authentication was required and the user didn't pass the MFA challenge. |
| AADSTS53003 | Blocked by Conditional Access. Go straight to step 3. |
| AADSTS50053 | The account is locked or the sign-in was blocked. The code covers two causes, so read the full message. |
| AADSTS50097 | Device authentication is required. |
| AADSTS50055 | The password has expired. |
Microsoft says error codes and messages are subject to change, so read the full failure reason, not just the number.
Read the log before touching a policy
Mentoring junior admins was part of my role for years, and this is the habit I push hardest. Read the log first. It answers most tickets before anyone touches a policy.
Which error code shows up most in your tenant?
Sources
- Sign-in logs in Microsoft Entra IDlearn.microsoft.com
- Microsoft Entra authentication and authorization error codeslearn.microsoft.com
- Entra ID
- Sign-in logs
- Troubleshooting
- AADSTS
- Conditional Access