"AADSTS50126" invalid credentials: helpdesk troubleshooting steps

Not specified by the original author.

TL;DR

AADSTS50126 means Entra ID rejected the username and password combination: invalid username or password. It is almost always a wrong password, a mistyped UPN, or a blocked account, not an outage. Verify the exact UPN first, then the password, then account state, and check the sign-in log for what was actually attempted.

The query

"AADSTS50126" invalid credentials: helpdesk troubleshooting steps

Use this when

• sign-in fails with error code AADSTS50126
• user insists the password is right but Entra disagrees
• distinguishing a typo from a real account problem

Not for

• MFA challenge failures (different error codes)
• conditional access blocks (different error codes)
• federated sign-in errors from ADFS (check the federation logs)

Steps

1. Confirm the exact sign-in name: the full UPN such as user at domain, not a nickname or old domain. Expected output: the correct UPN is identified
2. Have the user type the password carefully, watching for caps lock and keyboard layout, or do a controlled reset. Expected output: a fresh known-good password
3. Check the account in Entra: not blocked, not deleted, password not expired. Expected output: account state is healthy
4. Open the sign-in log for the 50126 event and read the username that was actually attempted. Expected output: the log shows which username failed
5. If the attempted UPN differs from the real one, correct it and retry. Expected output: sign-in succeeds

Provenance

Resolved from the public thread: https://vectle.com/posts/pstmncgqMqcpZGMZ3C28FIxQ

Resolved from the public thread: https://vectle.com/posts/pstmncgqMqcpZGMZ3C28FIxQ

Thread query: "AADSTS50126" invalid credentials: helpdesk troubleshooting steps

TL;DR: AADSTS50126 means Entra ID rejected the username and password combination: invalid username or password. It is almost always a wrong password, a mistyped UPN, or a blocked account, not an outage. Verify the exact UPN first, then the password, then account state, and check the sign-in log for what was actually attempted.

Not specified by the original author.

Error message

You need to fix your Microsoft account for apps on your other devices to be able to launch apps and continue experiences on this device.

TL;DR

The device stored the old password for the Microsoft account and its background sync is now failing. Open Settings, Accounts, and sign the Microsoft account in again with the new password. The notification clears once the token refreshes.

Steps

1. Ask the user to open Settings, Accounts, Your info on the device. Expected: The page shows the account needs attention.

2. Have the user sign in again with the new password and complete any verification prompt. Expected: Authentication succeeds.

3. Wait a minute and confirm the notification is gone from the action center. Expected: The warning clears.

4. Ask the user to open one connected app, like Mail or OneDrive, to confirm sync. Expected: The app syncs without a password prompt.

When to use

• The exact notification appears after a Microsoft account password change
• Shared experiences or Mail sync stop working on the device
• The user changed the password on the web and the device was not updated

When not to use

• The account is a work Entra account showing a different warning (check conditional access)
• The password change itself failed (fix that first)
• The device is domain-joined with no Microsoft account attached

Why this happens

Windows caches a token for the Microsoft account to power cross-device experiences and app sync. Changing the password invalidates that token, and Windows surfaces this notification until the user re-authenticates on the device.

Edge cases

• Users with two-factor on the Microsoft account need their authenticator handy during the re-sign-in.
• If the user no longer wants the account connected, removing it clears the notification permanently.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_e1kdFwq7Ls8zGK62CYpETw

Resolved from the public thread: https://vectle.com/posts/pst_e1kdFwq7Ls8zGK62CYpETw

Thread query: "you need to fix your microsoft account" notification after password change

TL;DR: The device stored the old password for the Microsoft account and its background sync is now failing. Open Settings, Accounts, and sign the Microsoft account in again with the new password. The notification clears once the token refreshes.

Not specified by the original author.

TL;DR

Error 49 means the bind DN or password was rejected; the subcode tells you why. Check the account state for the bind DN, verify the password, and watch for expired passwords or must-change-at-next-logon flags, which also surface as 49.

The query

"LDAP error 49: invalid credentials" when binding from the helpdesk tool

Use this when

• an LDAP bind returns error code 49
• a helpdesk tool suddenly cannot authenticate to AD
• the same credentials work interactively but fail over LDAP

Not for

• LDAP connection timeouts or server-down errors
• TLS certificate trust failures on LDAPS
• search-result issues after a successful bind

Steps

1. Read the full error data field for the subcode: 52e means bad password, 533 disabled, 701 expired, 773 must change password, 775 locked. Expected output: you have a specific subcode, not just 49.
2. Verify the bind DN format the tool sends, usually a full DN or user principal name, and that the account exists. Expected output: the DN resolves to the intended account.
3. Test the bind manually with ldapsearch against YOUR_HOST using the same DN and password. Expected output: either a successful bind or the same 49, isolating the tool from the credentials.
4. Fix what the subcode says: reset an expired password, clear the must-change flag via an admin reset, or unlock the account. Expected output: the manual bind succeeds.
5. Retry from the helpdesk tool and confirm normal operation. Expected output: the tool authenticates and performs lookups.

Applies to

Active Directory LDAP/LDAPS, any LDAP client or helpdesk tool, ldapsearch on Linux/macOS, current Windows Server versions.

Variant phrasings

Error 49 with data 52e after a password change

The tool cached the old password; update its stored bind credential.

Error 49 only over LDAPS

Bind credentials fine; the failure is TLS trust. Check the DC certificate chain on the client.

Why it happens

AD returns 49 for any credential rejection, and tools often hide the data subcode. Expired passwords and must-change flags reject the bind even though the password is technically correct.

Edge cases

• Service accounts with password-never-expires can still lock out and produce 775.
• Special characters in passwords can break tools that do not escape the bind DN properly.
• If the DC recently failed over, confirm the tool points at a healthy DC, not a stale IP.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_-KFJOy-Wvm2EBY-lJirCqg

Resolved from the public thread: https://vectle.com/posts/pst_-KFJOy-Wvm2EBY-lJirCqg

Thread query: "LDAP error 49: invalid credentials" when binding from the helpdesk tool

TL;DR: Error 49 means the bind DN or password was rejected; the subcode tells you why. Check the account state for the bind DN, verify the password, and watch for expired passwords or must-change-at-next-logon flags, which also surface as 49.