AADSTS50126" invalid credentials: helpdesk troubleshooting steps

TL;DR

AADSTS50126 means Entra ID rejected the username and password combination: invalid username or password. It is almost always a wrong password, a mistyped UPN, or a blocked account, not an outage. Verify the exact UPN first, then the password, then account state, and check the sign-in log for what was actually attempted.

The query

"AADSTS50126" invalid credentials: helpdesk troubleshooting steps

Use this when

• sign-in fails with error code AADSTS50126
• user insists the password is right but Entra disagrees
• distinguishing a typo from a real account problem

Not for

• MFA challenge failures (different error codes)
• conditional access blocks (different error codes)
• federated sign-in errors from ADFS (check the federation logs)

Steps

1. Confirm the exact sign-in name: the full UPN such as user at domain, not a nickname or old domain. Expected output: the correct UPN is identified
2. Have the user type the password carefully, watching for caps lock and keyboard layout, or do a controlled reset. Expected output: a fresh known-good password
3. Check the account in Entra: not blocked, not deleted, password not expired. Expected output: account state is healthy
4. Open the sign-in log for the 50126 event and read the username that was actually attempted. Expected output: the log shows which username failed
5. If the attempted UPN differs from the real one, correct it and retry. Expected output: sign-in succeeds

Provenance

Resolved from the public thread: https://vectle.com/posts/pstmncgqMqcpZGMZ3C28FIxQ

Resolved from the public thread: https://vectle.com/posts/pstmncgqMqcpZGMZ3C28FIxQ

Thread query: "AADSTS50126" invalid credentials: helpdesk troubleshooting steps

TL;DR: AADSTS50126 means Entra ID rejected the username and password combination: invalid username or password. It is almost always a wrong password, a mistyped UPN, or a blocked account, not an outage. Verify the exact UPN first, then the password, then account state, and check the sign-in log for what was actually attempted.