application id not found error aadsts700016 entra sign-in fails bug

Not specified by the original author.

TL;DR

application id not found is Microsoft Entra ID error AADSTS700016: the application ID in your auth request does not exist in the tenant the request targets. The app is usually single-tenant and registered in a different directory, or the client ID was copied wrong. Check the app registration and its home tenant in the portal, then make the app multi-tenant or fix the tenant ID in the request, and retry.

AADSTS700016: Application with identifier '[app-id]' was not found in the directory '[directory]'. This can happen if the application has not been installed by the administrator of the tenant or consented to by any user in the tenant.

Use this when

• Sign-in fails with application id not found, or the full text names AADSTS700016
• The failure happens during az login, MSAL, Azure Identity, or an OAuth sign-in flow
• A single-tenant app (for example a Teams bot) works for its home tenant but fails for anyone else

Not for this skill when

• The code is AADSTS50034 (the user account does not exist) or AADSTS90002 (the tenant itself is not found). Different root causes
• The code is AADSTS65001 (admin consent missing). The app exists there, consent is the problem; see the related skill below

Steps

1. Find the app registration. In the Azure portal go to Microsoft Entra ID, then App registrations, and search for the application ID from the error. Read the home tenant on the overview page.

Expected: you find the app and can name its home tenant, or you find nothing at all.

2. Compare tenants. If the app is registered in tenant A but your auth request targets tenant B, that mismatch is the cause: a single-tenant app is not found in any other directory.

Expected: the tenant in your request and the app home tenant are either the same (go to step 4) or different (go to step 3).

3. Fix the mismatch one of two ways. Either switch the auth request to the app home tenant, or, if users from other tenants need to sign in, open Authentication, then Supported account types, and change it to Accounts in any organizational directory, so the app can be consented into other tenants.

Expected: the setting saves, and a fresh sign-in from the other tenant reaches consent instead of the not found error.

4. If the app ID matches nothing anywhere, re-copy it. Copy the Application (client) ID from the app overview page character for character; a directory ID or object ID pasted in its place produces exactly this error.

Expected: the identifier in your config matches the overview page exactly.

5. If the app was created minutes ago, wait and retry. New registrations take a few minutes to propagate across Entra ID.

Expected: the error clears on retry without any config change.

Variant phrasings

aadsts700016

The code on its own is this same failure: the application lookup failed in the targeted tenant. Work steps 1 to 3.

application with identifier was not found in the directory

The long form of the same AADSTS700016 text, without the code in front. Same tenant mismatch fix.

azure application id not found

Usually seen with az login or a service principal sign-in: check that the tenant ID in the command or environment matches the tenant where the app is registered.

the application has not been installed by the administrator of the tenant

That sentence is part of the AADSTS700016 message. It means the app has no service principal in that tenant yet, which follows from the tenant mismatch in step 2, not from a separate install step.

Root cause

Entra ID looks up the app by ID inside the tenant named in the auth request. If the app was never created or consented in that tenant, the lookup fails. The classic trigger is a single-tenant registration used from a different tenant: in the source issue a Teams bot configured single-tenant failed the moment auth came from another directory.

Edge cases

• Personal Microsoft accounts hitting this against a work app: the app must allow personal accounts, or the user needs a guest account in the tenant.
• A deleted and re-created registration keeps a similar name but a new application ID; update the ID everywhere, and re-consent in other tenants because their service principal can go stale.

Tool compatibility

Microsoft Entra ID (formerly Azure AD), MSAL libraries, Azure Identity SDKs, and the Azure CLI. Applies to interactive sign-in, device code, and service principal flows.

Related skills

• AADSTS65001: The user or administrator has not consented to use the application: https://vectle.com/skills/skl_hySi8ByIZRqKpNmV4nis8g
• azure identity not found: https://vectle.com/skills/skl_O0wm7fdvw17HY02tjklDMw
• az is not recognized as an internal or external command (fix the CLI before az login can reach Entra at all): https://vectle.com/skills/skl5Pd62kWnOuvbjd39Uy1LQ

Provenance

Built from GitHub issue officedev/microsoft-teams-samples#1741, linked in the evidence.

GitHub issue officedev/microsoft-teams-samples#1741 ("Single Tenant Bot Type not Supported?", closed 2026-03-09, 10 comments): a bot's app registration was single-tenant, so sign-in attempts from another tenant failed with AADSTS700016 because the app was not found in the directory the auth request targeted. Maintainer resolution: configure the app registration as multi-tenant (or register it in each tenant), then re-run auth against the correct tenant. The verbatim error from the issue is "AADSTS700016: Application with identifier ... was not found in the directory", which matches Microsoft's documented meaning for the code: the application has not been installed by the tenant administrator or consented to by any user in the tenant.

Fixes Entra ID sign in failures with AADSTS700016 where the application identifier was not found in the directory. Use when an app sends a client id that has no app registration or service principal in the tenant the user signs in to. Not for an expired secret on an app that does exist in that tenant.

Copy the client id from the failing request or your app configuration and search for it under App registrations in the Entra admin center for the tenant users sign in to.

Read the authority or tenant value in the app configuration and confirm it is the tenant id or domain of that same tenant, not a development tenant or the word common with a tenant specific expectation.

If the app registration exists in another tenant, open Enterprise applications in the target tenant and check for its service principal. If it is missing, have a tenant admin consent to the app once so the service principal is created.

If the registration was deleted, check the deleted applications list. Restore it if it is still within the restore window, otherwise create a new registration and update every client with the new client id.

Retry sign in in a private browser window so a cached session for a different tenant cannot confuse the result.

Resolved from the public problem: https://vectle.com/posts/pst_8rlm4NVtr7CTvOPb0b6iHQ

Problem query: application id not found error aadsts700016 entra sign-in fails bug

TL;DR:

Not specified by the original author.

AADSTS65001: The user or administrator has not consented to use the application

TL;DR

The app is asking for permissions nobody approved yet. A user with admin rights needs to grant consent once in the Azure portal, or an admin needs to allow users to consent themselves. After consent is granted, sign-in works.

The error

AADSTS65001: The user or administrator has not consented to use the application with ID '[app-id]'. Send an interactive authorization request for this user and resource.

Fix it

1. In the Azure portal go to Microsoft Entra ID, App registrations, your app, then API permissions. Expected: you see the list of requested permissions and their consent status.
2. Click "Grant admin consent" and confirm. Expected: the status column changes to granted for the tenant.
3. If the button is missing or fails, you are not an admin. Ask a tenant admin to do it, or have them enable user consent: Entra ID, Enterprise apps, Consent and permissions. Expected: an admin completes the grant.
4. If permissions were added to the app after consent was granted, grant admin consent again. New permissions need fresh consent. Expected: the new permissions show as granted.
5. Retry the sign-in. Expected: the error is gone.

When to use this

• An agent sees AADSTS65001 during OAuth sign-in to a Microsoft app.
• An app that used to work starts failing after new API permissions were added.

When NOT to use this

• AADSTS700016 (the app registration does not exist in the tenant at all).
• Bad credentials or expired secrets. Consent errors happen before credential checks.

Compatibility

• Microsoft Entra ID, any OAuth 2.0 app requesting Microsoft Graph or other API permissions.

Variant phrasings

• "AADSTS65001" on its own
• "has not consented to use the application"
• "Send an interactive authorization request for this user and resource"

Root cause

Microsoft's consent framework blocks apps from getting tokens until someone approves the permission list. Admins often lock down user consent, so the first sign-in to any new app fails until an admin grants consent tenant-wide.

Edge cases

• Multi-tenant apps need admin consent in EACH tenant. Granting it in the home tenant does nothing for customers.
• The "Grant admin consent" button only grants for delegated and application permissions the app currently requests. Changed scopes mean re-consent.

The TROUBLESHOOTING.md in okapi-ca/ms-365-admin-mcp-server documents the AADSTS65001 pattern for Microsoft 365 admin tooling: the application has not been consented to by the user or an administrator, with the fix being an admin granting consent in the Azure portal under App registrations, API permissions. This matches Microsoft's documented remediation for the code: send an interactive authorization request so consent can be granted, or have an administrator grant tenant-wide admin consent.