What causes AADSTS70012?

Transient outage or degraded service on the MSA (consumer identity) authentication backend at login.live.com / login.microsoftonline.com. User is signing in with a personal Microsoft Account (outlook.com, hotmail.com, live.com, gmail-as-MSA) into an app that federates to MSA, and the MSA STS returned a 5xx. App registration is configured for 'Personal Microsoft accounts' or 'Both' audience — work-account-only apps don't hit this codepath. Token broker / WAM on Windows holding a stale MSA refresh token that fails server-side exchange. Region-specific incident on the MSA endpoint coinciding with the sign-in attempt

How do I fix AADSTS70012?

Retry the sign-in after 30–60 seconds — AADSTS70012 is explicitly a transient server error and most occurrences self-resolve. Check the Microsoft 365 Service health dashboard and Azure status page for an active Identity / MSA incident before troubleshooting further. Have the user sign in from an incognito/private browser window to bypass cached MSA cookies and broker tokens; on Windows, sign out of the Microsoft Account in Settings → Accounts and retry. Confirm the account type: if the app should only accept work/school accounts, change the app registration's 'Supported account types' to 'Accounts in this organizational directory only' so MSA isn't involved at all. If the error persists for >15 minutes across multiple users and networks, open a Microsoft support ticket with the timestamp, the full correlation ID from the error page, and the user's UPN — Microsoft needs these to trace the MSA STS logs

Low severityauthentication

Power BI Error:
AADSTS70012

What does this error mean?

Microsoft Entra ID (Azure AD) hit a transient server-side error while authenticating a Microsoft Account (MSA / consumer) user.

Common causes

1Transient outage or degraded service on the MSA (consumer identity) authentication backend at login.live.com / login.microsoftonline.com
2User is signing in with a personal Microsoft Account (outlook.com, hotmail.com, live.com, gmail-as-MSA) into an app that federates to MSA, and the MSA STS returned a 5xx
3App registration is configured for 'Personal Microsoft accounts' or 'Both' audience — work-account-only apps don't hit this codepath
4Token broker / WAM on Windows holding a stale MSA refresh token that fails server-side exchange
5Region-specific incident on the MSA endpoint coinciding with the sign-in attempt

How to fix it

1Retry the sign-in after 30–60 seconds — AADSTS70012 is explicitly a transient server error and most occurrences self-resolve
2Check the Microsoft 365 Service health dashboard and Azure status page for an active Identity / MSA incident before troubleshooting further
3Have the user sign in from an incognito/private browser window to bypass cached MSA cookies and broker tokens; on Windows, sign out of the Microsoft Account in Settings → Accounts and retry
4Confirm the account type: if the app should only accept work/school accounts, change the app registration's 'Supported account types' to 'Accounts in this organizational directory only' so MSA isn't involved at all
5If the error persists for >15 minutes across multiple users and networks, open a Microsoft support ticket with the timestamp, the full correlation ID from the error page, and the user's UPN — Microsoft needs these to trace the MSA STS logs

Frequently asked questions

What does AADSTS70012 mean?

A server error occurred while authenticating an MSA (consumer) user. Try again. If it continues to fail, open a support ticket

How do I fix this error?

Check your application registration, token configuration, and user permissions in the Azure portal. Review Conditional Access policies if the error is policy-related.

Source · learn.microsoft.com/en-us/entra/identity-platform/reference-error-codes#aadsts-error-codes