High Volume of Entra ID Sign-In Errors (Code 70043) Triggering MS Sentinel Alerts

Question

I'm monitoring a tenant with about 2000 users with E5 licenses using Microsoft Sentinel with the Microsoft Entra ID solution from Content Hub. In the "Summary of top errors" section of the Microsoft Entra ID Sign-in logs workbook, the top entry is always:

Error Code: 70043
Reason: Other
Category: NonInteractiveSignInLogs

with an error count of about 250.000 for the default time range of 14 days. This outdistances all other entries by at least a factor of 10.

At the same time, the analytics rule "Attempt to bypass conditional access rule in Microsoft Entra ID" produces a steady stream of alerts, most of them triggered by sign-in events with result code 70043.

The sign-in error decoder at https://login.microsoftonline.com/error?code=70043 tells me the message associated with that code isn't "Other" after all, but:

"The refresh token has expired or is invalid due to sign-in frequency checks by conditional access. The token was issued on {issueDate} and the maximum allowed lifetime for this request is {time}."

(The {issueDate} and {time} information seems to be unavailable in MS Sentinel.)

This looks to me like a normal event and not a failure or attempt to bypass at all.

Questions:

• Is it normal to see such a big number of 70043 errors?
• If so, how can I tell Sentinel to shut up about it?
• If not, what may be the problem and how would I go about to fix it?

Answer 1

As already written in the comments, the answer to the first question is:

Yes, it is absolutely normal to see sign-in events with status code 70043. This status code does not indicate a sign-in failure or error, but is part of the normal course of events. It should definitely not cause any alarm. There are quite a number status codes like that. The ones I found so far:

50074 - Strong Authentication is required

50076 - Due to a configuration change made by your administrator, or because you moved to a new location, you must use multi-factor authentication to access '{resource}'.

50097 - Device Authentication is required.

50125 - Sign-in was interrupted due to a password reset or password registration entry.

50140 - This occurred due to 'Keep me signed in' interrupt when the user was signing-in.#

530003 - Other MFA requirement satisfied by claim in the token

70043 - The refresh token has expired or is invalid due to sign-in frequency checks by conditional access. The token was issued on {issueDate} and the maximum allowed lifetime for this request is {time}.

70044 - The session has expired or is invalid due to sign-in frequency checks by conditional access.

700082 - The refresh token has expired due to inactivity. The token was issued on {issueDate} and was inactive for {time}.

So it is in fact a bug if a Sentinel workbook or Analytics rule flags these as errors or creates alerts for them. Unfortunately there are several occurrences of that bug in Microsoft's own standard solution "Microsoft Entra ID" from the Sentinel Content hub.

There doesn't seem to be a way to report such bugs. So the answer to the second question, for me, is to fix them myself by editing the KQL code of the affected Analytics rules and Workbooks. As an example, I have patched the Analytics rule "Attempt to bypass conditional access rule in Microsoft Entra ID" like this:

@@ -10,6 +10,8 @@
 | extend OS = DeviceDetail.operatingSystem, Browser = DeviceDetail.browser
 | extend State = tostring(LocationDetails.state), City = tostring(LocationDetails.city), Region = tostring(LocationDetails.countryOrRegion)
 | extend StatusCode = tostring(Status.errorCode), StatusDetails = tostring(Status.additionalDetails)
+// ignore non-failure status codes
+| where StatusCode !in (50074, 50076, 50097, 50125, 50140, 530003, 70043, 70044, 700082)
 | extend Status = strcat(StatusCode, ": ", ResultDescription)
 | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), Status = make_list(Status,10), StatusDetails = make_list(StatusDetails,50), IPAddresses = make_list(IPAddress,100), IPAddressCount = dcount(IPAddress), CorrelationIds = make_list(CorrelationId,100), ConditionalAccessPoliciesName = make_list(ConditionalAccessPoliciesName,100)
 by UserPrincipalName, UserId, AppDisplayName, tostring(Browser), tostring(OS), City, State, Region, Type

(Please ignore the language setting "Scala". The forum software won't accept "KQL" as language.)