High Volume of Entra ID Sign-In Errors (Code 70043) Triggering MS Sentinel Alerts

Question

I'm monitoring a tenant with about 2000 users with E5 licenses using Microsoft Sentinel with the Microsoft Entra ID solution from Content Hub. In the "Summary of top errors" section of the Microsoft Entra ID Sign-in logs workbook, the top entry is always:

Error Code: 70043
Reason: Other
Category: NonInteractiveSignInLogs

with an error count of about 250.000 for the default time range of 14 days. This outdistances all other entries by at least a factor of 10.

At the same time, the analytics rule "Attempt to bypass conditional access rule in Microsoft Entra ID" produces a steady stream of alerts, most of them triggered by sign-in events with result code 70043.

The sign-in error decoder at https://login.microsoftonline.com/error?code=70043 tells me the message associated with that code isn't "Other" after all, but:

"The refresh token has expired or is invalid due to sign-in frequency checks by conditional access. The token was issued on {issueDate} and the maximum allowed lifetime for this request is {time}."

(The {issueDate} and {time} information seems to be unavailable in MS Sentinel.)

This looks to me like a normal event and not a failure or attempt to bypass at all.

Questions:

• Is it normal to see such a big number of 70043 errors?
• If so, how can I tell Sentinel to shut up about it?
• If not, what may be the problem and how would I go about to fix it?