AADSTS50126 — "Error validating credentials due to invalid username or password." The username resolved to an account, but the password check failed. One-off occurrences are just typos; sustained streams of 50126 in the sign-in logs are diagnostic gold — they identify stale credentials, misconfigured clients or attack traffic.
AADSTS50126
Invalid username or password
What it means
Common causes
Plain wrong password, including passwords typed into the wrong account after a rename.
A saved/stale credential replaying an old password: mobile mail profiles, background services, scripts, legacy protocol clients (SMTP/IMAP/POP).
Hybrid password hash sync lag right after an on-prem password change.
Password-spray attacks — many accounts, few attempts each, legacy auth endpoints.
How to fix it
Check the sign-in logs for the failing entries' client app, IP and device — 'Other clients'/legacy protocol entries point at old clients replaying credentials.
After on-prem password changes, allow a couple of minutes for password hash sync; verify Entra Connect health if delays persist.
Reset the password if the user is simply stuck, and clear saved credentials on their devices (Windows Credential Manager, mail apps).
Block legacy authentication with Conditional Access to remove the favourite target of spray attacks producing 50126 noise.
Frequently asked
The password is definitely correct — why AADSTS50126?
Check where the attempt actually comes from: sign-in logs show the client and IP. It is very often not the user at all but a saved credential on another device or a background script replaying an old password. In hybrid setups, also check password hash sync recency.