AADSTS50055 — InvalidPasswordExpiredPassword: the password is expired. Entra ID will not
issue tokens until the password is changed. In hybrid environments this can appear even when
the user believes the password is fine, because expiry state is evaluated against policy that
may differ between on-prem AD and Entra ID.
AADSTS50055
Password expired
What it means
Common causes
The password genuinely expired under the applicable expiration policy.
Hybrid mismatch: on-prem expiry is enforced but the cloud flow cannot complete the change (e.g. no SSPR/password writeback), leaving the user stuck at the error.
Interactive password change is required but the failing sign-in is from a non-interactive client (background app, legacy protocol) that cannot render the change screen.
How to fix it
Have the user change the password — interactively via a browser sign-in, via SSPR (aka.ms/sspr) if enabled, or by admin reset in Entra admin center > Users > (user) > Reset password.
In hybrid setups, enable password writeback (Entra Connect) so cloud-initiated changes flow back on-prem, or direct users to change on-prem first and wait for sync (password hash sync propagates quickly).
For accounts that must never expire by design (service-style accounts), review whether expiry policy should apply, e.g.
Update-MgUser -UserId <upn> -PasswordPolicies DisablePasswordExpiration.