AADSTS50126: invalid username or password
Likely causes
- A typo in the password, or Caps Lock is on.
- The user recently changed their password and a device or app still has the old one saved.
- The wrong account or UPN is being used.
- Hybrid: the password changed on-premises and hasn't synced yet.
How to fix it
- Have the user retype the password slowly, checking Caps Lock and keyboard layout.
- Confirm they’re using the right sign-in name (their UPN, usually their email address).
- If they changed their password recently, update it on phones, mail apps and saved credentials. Old passwords saved in apps cause repeat failures and can lead to a lockout.
- Let the user reset it with self-service password reset if it’s set up. Otherwise an admin with password reset rights can reset it.
- Admins: check the Entra sign-in logs for the failure. A flood of 50126 errors from unknown IPs can mean a password spray attack, not a forgetful user.
Checked against: learn.microsoft.com, learn.microsoft.com