Forum Discussion
Code - 50173
If you get an alert from Identity Protection, you can never be 100% sure why it was flagged as risky as Microsoft keeps these methods confidential.
I would suggest you check with the never if he has any clue why this login occurred ( he might be travelling, using roaming data or VPN).
If he doesn't know anything about this login, I would advise you to change his password and expire all his tokens. Even if he has MFA, his account could still be breached.
Thanks for your advice. I have reset the password.
If the status of the code shows "Failure", is that also indicating that the user account has been compromise? Or someone did successfully gain access to the account prior to this?
Or it could be just an attempt? Thanks.
You need to review the sign-in and check what the failure reason is.
If it failed because of a bad PW, no harm done
If it failed because of MFA, this is a breach as the password has been breached.
I think is not MFA. This is the failure reason.
Sign-in error code : 50173Failure reason: Fresh auth token is needed. Have the user re-sign using fresh credentials.
I assume someone out there is trying to established the connection. But I wasn't sure whether by "token auth", does it mean somebody has successfully created/login to the account before.I haven't seen this before.
A token is given to the user after successful authentication.
The error makes it seem that the token is expired, which would indicate that the user has signed into that device before.
- Hi cllee,
Failure means not ‘compromised’ and didn’t get access. Anytime you mistype your password or someone tries to brute force your account, it gets logged on Azure/ MCAS.
You can use Security & Compliance Console (Compliance now)->Search->Audit Log Search. This should give you more details about the incident.
Moe
