| AADSTS50053 |
AADSTS50053: Your account is locked (Smart Lockout) / sign-in blocked due to suspicious activity |
Too many failed sign-ins (or sign-ins from a malicious IP) triggered Entra Smart Lockout. |
| MissingSubscriptionRegistration |
MissingSubscriptionRegistration: The subscription is not registered to use namespace 'Microsoft.X' |
The resource provider (Microsoft.Web, Microsoft.ContainerService, …) isn’t registered for the subscription. |
| AuthorizationPermissionMismatch |
Azure Storage: AuthorizationPermissionMismatch (403) — This request is not authorized to perform this operation using this permission |
You’re accessing blob/queue data with Microsoft Entra ID, but the identity has only management roles (Owner/C… |
| AADSTS50173 |
AADSTS50173: The provided grant has expired due to it being revoked, a fresh auth token is needed |
The refresh token was revoked — usually because the user changed or reset their password, or an admin revoked… |
| AADSTS50076 |
Azure AD (Entra ID): AADSTS50076 / AADSTS50079 — multi-factor authentication required |
A Conditional Access policy requires MFA, but the sign-in flow (often a script, legacy client or ROPC passwor… |
| Our services aren't available right now |
Azure Front Door: Our services aren't available right now (503/502 from Front Door) |
Front Door couldn’t get a valid response from your origin — origin down, health probes failing, TLS/host head… |
| 40615 |
Azure SQL: Cannot open server 'x' requested by the login. Client with IP address 'y' is not allowed to access the server (Error 40615) |
The Azure SQL server firewall doesn’t allow your client’s IP address. |
| AuthorizationFailed |
Azure: AuthorizationFailed — The client does not have authorization to perform action |
The signed-in identity (user, service principal or managed identity) lacks an Azure RBAC role for that action… |
| InvalidTemplateDeployment |
ARM/Bicep: DeploymentFailed / InvalidTemplateDeployment / InvalidTemplate |
An Azure Resource Manager (ARM/Bicep/Terraform) deployment failed; the inner error under “details” has the re… |
| Please run 'az login' |
Azure CLI: Please run 'az login' to setup account / No subscription found |
The Azure CLI has no signed-in account (or its token expired), or the account has no subscriptions. |
| ACR unauthorized |
Azure Container Registry: unauthorized: authentication required, visit https://aka.ms/acr/authorization (AKS ErrImagePull 401) |
Pulling/pushing to ACR wasn’t authenticated — Docker not logged in, or AKS/App Service lacks AcrPull on the r… |
| AuthenticationFailed |
Azure Storage: Server failed to authenticate the request. Make sure the value of Authorization header is formed correctly including the signature (AuthenticationFailed) |
The storage request’s signature or SAS token is invalid — wrong/rotated account key, expired SAS, or clock sk… |
| OSProvisioningTimedOut |
Azure VM: OSProvisioningTimedOut — OS Provisioning for VM did not finish in the allotted time |
The VM booted but its guest agent didn’t report provisioning success in time — usually a generalisation probl… |
| Request rate is large |
Cosmos DB 429: Request rate is large (TooManyRequests, RU/s exceeded) |
The container or database used more Request Units per second than provisioned, so Cosmos DB throttled request… |
| StorageAccountAlreadyTaken |
StorageAccountAlreadyTaken: The storage account named x is already taken |
Storage account names are globally unique across Azure; another customer (or you elsewhere) already uses the… |
| AADSTS50055 |
AADSTS50055: The password is expired |
The user’s password expired under the tenant/on-prem password policy and must be changed before signing in. |
| AADSTS50057 |
AADSTS50057: The user account is disabled |
The account exists but is blocked from signing in. |
| DefaultAzureCredential failed |
DefaultAzureCredential failed to retrieve a token from the included credentials / ManagedIdentityCredential authentication unavailable |
The Azure SDK tried every credential source (env vars, workload identity, managed identity, CLI…) and none wo… |
| InvalidAuthenticationTokenTenant |
InvalidAuthenticationTokenTenant: The access token is from the wrong issuer |
The token was issued by a different tenant than the one that owns the subscription/resource. |
| Key Vault Forbidden |
Key Vault: (Forbidden) The user, group or application does not have secrets get permission on key vault |
The caller authenticated but has no permission on the vault — missing access policy or RBAC role, or the vaul… |
| RequestDisallowedByPolicy |
RequestDisallowedByPolicy: Resource 'x' was disallowed by policy |
An Azure Policy assignment denied the request — allowed locations, SKUs, required tags, public network access… |
| AADSTS53003 |
AADSTS53003: Access has been blocked by Conditional Access policies |
Sign-in succeeded, but a Conditional Access policy blocked access — device, location, app or risk conditions… |
| AADSTS7000222 |
AADSTS7000222: The provided client secret keys for app are expired |
The app registration’s client secret has expired, so service-to-service authentication fails. |
| AADSTS700082 |
AADSTS700082: The refresh token has expired due to inactivity |
A cached refresh token wasn’t used for 90 days (the inactivity limit) and is no longer valid. |
| AADSTS70021 |
AADSTS70021: No matching federated identity record found for presented assertion (GitHub Actions / workload identity) |
The OIDC token from GitHub Actions/Kubernetes/another IdP doesn’t match any federated credential on the app —… |
| No job functions found |
Azure Functions: No job functions found. Try making your job classes and methods public / Error indexing method |
The Functions host started but couldn’t discover or index any functions — wrong project structure, extension/… |
| Login failed for user '<token-identified principal>' |
Azure SQL: Login failed for user '<token-identified principal>' (Microsoft Entra / managed identity) |
Entra ID authentication succeeded, but there’s no database user for that identity (or it lacks permission to… |
| SkuNotAvailable |
Azure: SkuNotAvailable / QuotaExceeded when creating a VM or resource |
The VM size isn’t offered in that region/zone for your subscription, or you’ve hit the vCPU quota. |
| ResourceGroupNotFound |
ResourceGroupNotFound: Resource group 'x' could not be found |
The resource group doesn’t exist in the subscription the command or deployment is using. |
| ScopeLocked |
ScopeLocked: The scope cannot perform write/delete operation because following scope(s) are locked |
A resource lock (CanNotDelete or ReadOnly) on the resource, group or subscription blocks the change. |
| AADSTS50020 |
AADSTS50020: User account from identity provider does not exist in tenant and cannot access the application |
The signed-in user belongs to another tenant (or is a personal Microsoft account) and isn’t a guest in the ap… |
| AADSTS50105 |
AADSTS50105: Your administrator has configured the application to block users unless they are specifically granted access |
The enterprise app requires assignment (“Assignment required? Yes”) and the user isn’t assigned to it, direct… |
| AADSTS65001 |
AADSTS65001: The user or administrator has not consented to use the application |
The app needs permissions that haven’t been granted for this user or tenant. |
| AADSTS700016 |
Azure AD (Entra ID): AADSTS700016 Application not found in the directory |
The client ID in your sign-in request doesn’t exist in the tenant you’re authenticating against. |
| App Service Application Error |
Azure App Service: ":( Application Error" / container didn’t respond to HTTP pings |
App Service started your app but it crashed or never listened on the expected port. |
| AllocationFailed |
Azure VM: AllocationFailed / ZonalAllocationFailed — Allocation failed. We do not have sufficient capacity for the requested VM size |
Azure has no capacity for that VM size in the region/zone (or in the cluster the VM is pinned to) right now. |
| SecretNotFound |
Key Vault: (SecretNotFound) A secret with (name/id) x was not found in this key vault |
The secret name (or version) doesn’t exist in that vault — typo, wrong vault, or the secret is deleted (soft-… |
| SubscriptionNotFound |
SubscriptionNotFound: The subscription 'x' could not be found |
The subscription ID doesn’t exist in the current tenant or the identity has no access to it. |
| AADSTS50034 |
AADSTS50034: The user account does not exist in the directory |
There’s no user with that sign-in name in the tenant. |
| AzureWebJobsStorage |
Azure Functions: Value cannot be null. (Parameter 'connectionString') / Missing value for AzureWebJobsStorage |
A Functions app setting or binding connection string is missing — most often AzureWebJobsStorage locally (loc… |
| No hosted parallelism |
Azure Pipelines: No hosted parallelism has been purchased or granted |
The Azure DevOps organization has no Microsoft-hosted parallel jobs, so pipelines can’t run on hosted agents. |
| AnotherOperationInProgress |
Conflict: AnotherOperationInProgress — Another operation is in progress on the resource |
Azure is still processing a previous change on the same resource, so new operations are rejected until it fin… |
| LocationNotAvailableForResourceType |
LocationNotAvailableForResourceType / InvalidResourceLocation |
The resource type isn’t offered in that region, or the resource already exists in a different region than the… |
| AADSTS500113 |
AADSTS500113: No reply address is registered for the application |
The app registration has no redirect URI for the platform being used, so Entra ID has nowhere to send the res… |
| AADSTS50126 |
AADSTS50126: Error validating credentials due to invalid username or password |
Microsoft Entra ID (Azure AD) rejected the sign-in because the username or password is wrong — or the flow ca… |
| ContainerNotFound |
Azure Storage: ContainerNotFound / BlobNotFound — The specified container (or blob) does not exist |
The container or blob path doesn’t exist in that storage account. |
| TF401019 |
TF401019: The Git repository with name or identifier x does not exist or you do not have permissions for the operation |
The repo doesn’t exist in that project, or the identity (user, PAT, pipeline build service) lacks permission… |
| service connection could not be found |
Azure Pipelines: There was a resource authorization issue: The pipeline is not valid. Could not find a service connection with identifier x |
The pipeline references a service connection that doesn’t exist in the project or isn’t authorized for this p… |
| ResourceNotFound |
ResourceNotFound: The Resource 'Microsoft.X/...' under resource group 'y' was not found |
The specific resource doesn’t exist in that resource group/subscription — wrong name, group or subscription,… |
| AADSTS90002 |
AADSTS90002: Tenant 'x' not found |
The tenant ID or domain in the authority URL doesn’t exist — or isn’t in the cloud you’re calling (public vs… |