Forum Discussion

Brass Contributor

Apr 11, 2020

Code - 50173

Hi, I see a number of Risky Sign-ins with the code 50173 - Fresh auth token is needed. Have the user re-sign using fresh credentials. And the status is "Failure". But I noticed the IP address c...

Azure Active Directory (AAD)

cllee

Brass Contributor

Apr 13, 2020

Thijs Lecomte

Thanks for your advice. I have reset the password.
If the status of the code shows "Failure", is that also indicating that the user account has been compromise? Or someone did successfully gain access to the account prior to this?

Or it could be just an attempt? Thanks.

Thijs Lecomte

Bronze Contributor

Apr 14, 2020

cllee

You need to review the sign-in and check what the failure reason is.

If it failed because of a bad PW, no harm done

If it failed because of MFA, this is a breach as the password has been breached.

cllee
Brass Contributor
Apr 14, 2020
Thijs Lecomte

I think is not MFA. This is the failure reason.

Sign-in error code : 50173
Failure reason: Fresh auth token is needed. Have the user re-sign using fresh credentials.

I assume someone out there is trying to established the connection. But I wasn't sure whether by "token auth", does it mean somebody has successfully created/login to the account before.
- Thijs Lecomte
  Bronze Contributor
  Apr 14, 2020
  cllee
  
  I haven't seen this before.
  
  A token is given to the user after successful authentication.
  The error makes it seem that the token is expired, which would indicate that the user has signed into that device before.
  - cllee
    Brass Contributor
    Apr 14, 2020
    Thijs Lecomte
    
    Is this anything we can do based on the information captured by the Sign-In data? Like the IP address of the session? Block it or any security measure? Thanks.