| Previous | Next |
| MSSIPOTF_E_STRUCTURE | WINBIO_E_UNSUPPORTED_FACTOR |
ERROR_CRED_REQUIRES_CONFIRMATION
credential selection that requires user confirmation identifies a scoped API or runtime boundary rather than a general machine failure. A credential candidate was found, but the provider or policy will not release or use it silently. The caller must move to an interactive confirmation path rather than looping a silent credential request.
Where the result is produced
The declared return type and source header determine the relevant status namespace.
This result is not equivalent to bad credentials or access denied. The material may be valid; the missing condition is an explicit user-confirmation transition. Keep the numeric value, declared return type, and first returning operation together with ERROR_CRED_REQUIRES_CONFIRMATION; the same integer can belong to a different status namespace in another API.
Evidence to preserve
| Capture | Diagnostic value |
|---|---|
| Originating credential API, target name, credential type, and whether UI was explicitly suppressed. | Identifies the concrete object and operation associated with credential selection that requires user confirmation. |
| Selected provider and credential tile, caller integrity level, desktop/session, and user identity. | Separates argument or lifecycle state from a lower-layer provider failure. |
| Policy that controls consent, presence, PIN, biometric, or account confirmation for the requested operation. | Creates a stable before-and-after comparison. |
| Whether the same credential succeeds only after a visible confirmation step. | Shows whether this condition is the first result or a translated summary. |
Preserve whether the same credential succeeds only after a visible confirmation step before reinstalling, rebooting, clearing state, or substituting another device or provider. A success observed only after such a change is useful comparison data, but it does not identify the original cause.
A controlled diagnostic sequence
- Repeat with the documented interactive flag on the same desktop and target. Repeat the original supported operation so the check remains tied to the same API boundary.
- Use a known test credential whose provider permits silent retrieval to isolate provider policy from target policy. Keep unrelated inputs fixed so the changed result remains attributable to the tested variable.
- Capture provider events while changing only the confirmation mode, not the credential or relying party. Record the first returned status and any state transition observed.
How nearby outcomes differ
| Observed comparison | Next conclusion to test |
|---|---|
| The first control changes the result | Concentrate on the variable isolated by this check: Repeat with the documented interactive flag on the same desktop and target. |
| The second comparison reproduces the same first status | Preserve lower-layer provider, driver, service, or runtime evidence before editing application data. The second controlled check was: Use a known test credential whose provider permits silent retrieval to isolate provider policy from target policy. |
| A different status appears after the bounded change | The operation moved to another boundary after the third controlled check. That check was: Capture provider events while changing only the confirmation mode, not the credential or relying party. Retain both results and interpret the replacement through its own API contract. |
Correction and proof
Targeted correction. Invoke the supported interactive flow, surface the exact target and action to the user, and persist only the minimum state needed to resume after confirmation. Modify only the object, argument, policy, provider, or lifecycle state identified by the collected evidence.
Acceptance criterion. The confirmed request succeeds once, cancellation remains distinguishable from authentication failure, and a silent retry no longer spins or displays repeated prompts. Re-run the original operation that produced this condition under its original identity and supported configuration, then keep one negative control that still produces the expected neighboring outcome.
Technical references
References for ERROR_CRED_REQUIRES_CONFIRMATION on the deployed platform version.
- Microsoft Open Specifications: HRESULT values — defines the status namespace used.
- Microsoft: HRESULT facility extraction — documents the API or lifecycle boundary behind this condition.
- Microsoft: CredUIPromptForWindowsCredentials — provides ABI, implementation, or protocol context.
- Microsoft: Windows credential providers — supports the portability and verification limits.
Looking for a different code? Search another status or error code.