AiTM Phishing: Sign-In Errors 50074/50140 on Unmanaged Device

Ibrahim Saud@tektrix

•updated Sep 16, 2026•1•0•2

Detects multiple authentication failures in Azure AD (specifically error codes 50074: strong authentication required/MFA failure and 50140: interruption of MFA completion) originating from devices identified as either unmanaged or non-compliant. This pattern often indicates an adversary attempting to brute force or bypass conditional access policies by leveraging credentials where the device security posture is insufficient.