AADSTS50126 — "Error validating credentials due to invalid username or password." The username resolved to an account, but the password check failed. One-off occurrences are just typos; sustained streams of 50126 in the sign-in logs are diagnostic gold — they identify stale credentials, misconfigured clients or attack traffic.
AADSTS50126
Invalid username or password
What it means
Common causes
Plain wrong password, including passwords typed into the wrong account after a rename.
A saved/stale credential replaying an old password: mobile mail profiles, background services, scripts, legacy protocol clients (SMTP/IMAP/POP).
Hybrid password hash sync lag right after an on-prem password change.
Password-spray attacks — many accounts, few attempts each, legacy auth endpoints.
How to fix it
Check the sign-in logs for the failing entries' client app, IP and device — 'Other clients'/legacy protocol entries point at old clients replaying credentials.
After on-prem password changes, allow a couple of minutes for password hash sync; verify Entra Connect health if delays persist.
Reset the password if the user is simply stuck, and clear saved credentials on their devices (Windows Credential Manager, mail apps).
Block legacy authentication with Conditional Access to remove the favourite target of spray attacks producing 50126 noise.
Frequently asked
The password is definitely correct — why AADSTS50126?
Check where the attempt actually comes from: sign-in logs show the client and IP. It is very often not the user at all but a saved credential on another device or a background script replaying an old password. In hybrid setups, also check password hash sync recency.
What do the Trace ID, Correlation ID and Timestamp in the message mean?
Nothing you can act on. Every Entra sign-in error carries a per-request Trace ID and Correlation ID so Microsoft support can find the exact request in their logs; they carry no meaning about the cause. Search the sign-in logs by the Correlation ID to find the matching entry and its client, IP and device — that is where the diagnosis is.
My app or VPN says 'error authenticating to IdP: login error 50126' — is that the same thing?
Yes. Applications, VPN gateways and third-party identity brokers that federate to Entra ID relay the AADSTS code they received, sometimes wrapped in their own wording. Treat it as AADSTS50126: the credentials the app forwarded were rejected by Entra ID, so check the account the app is actually using and the sign-in logs for that user.