application id not found

Not specified by the original author.

TL;DR

application id not found is Microsoft Entra ID error AADSTS700016: the application ID in your auth request does not exist in the tenant the request targets. The app is usually single-tenant and registered in a different directory, or the client ID was copied wrong. Check the app registration and its home tenant in the portal, then make the app multi-tenant or fix the tenant ID in the request, and retry.

AADSTS700016: Application with identifier '[app-id]' was not found in the directory '[directory]'. This can happen if the application has not been installed by the administrator of the tenant or consented to by any user in the tenant.

Use this when

• Sign-in fails with application id not found, or the full text names AADSTS700016
• The failure happens during az login, MSAL, Azure Identity, or an OAuth sign-in flow
• A single-tenant app (for example a Teams bot) works for its home tenant but fails for anyone else

Not for this skill when

• The code is AADSTS50034 (the user account does not exist) or AADSTS90002 (the tenant itself is not found). Different root causes
• The code is AADSTS65001 (admin consent missing). The app exists there, consent is the problem; see the related skill below

Steps

1. Find the app registration. In the Azure portal go to Microsoft Entra ID, then App registrations, and search for the application ID from the error. Read the home tenant on the overview page.

Expected: you find the app and can name its home tenant, or you find nothing at all.

2. Compare tenants. If the app is registered in tenant A but your auth request targets tenant B, that mismatch is the cause: a single-tenant app is not found in any other directory.

Expected: the tenant in your request and the app home tenant are either the same (go to step 4) or different (go to step 3).

3. Fix the mismatch one of two ways. Either switch the auth request to the app home tenant, or, if users from other tenants need to sign in, open Authentication, then Supported account types, and change it to Accounts in any organizational directory, so the app can be consented into other tenants.

Expected: the setting saves, and a fresh sign-in from the other tenant reaches consent instead of the not found error.

4. If the app ID matches nothing anywhere, re-copy it. Copy the Application (client) ID from the app overview page character for character; a directory ID or object ID pasted in its place produces exactly this error.

Expected: the identifier in your config matches the overview page exactly.

5. If the app was created minutes ago, wait and retry. New registrations take a few minutes to propagate across Entra ID.

Expected: the error clears on retry without any config change.

Variant phrasings

aadsts700016

The code on its own is this same failure: the application lookup failed in the targeted tenant. Work steps 1 to 3.

application with identifier was not found in the directory

The long form of the same AADSTS700016 text, without the code in front. Same tenant mismatch fix.

azure application id not found

Usually seen with az login or a service principal sign-in: check that the tenant ID in the command or environment matches the tenant where the app is registered.

the application has not been installed by the administrator of the tenant

That sentence is part of the AADSTS700016 message. It means the app has no service principal in that tenant yet, which follows from the tenant mismatch in step 2, not from a separate install step.

Root cause

Entra ID looks up the app by ID inside the tenant named in the auth request. If the app was never created or consented in that tenant, the lookup fails. The classic trigger is a single-tenant registration used from a different tenant: in the source issue a Teams bot configured single-tenant failed the moment auth came from another directory.

Edge cases

• Personal Microsoft accounts hitting this against a work app: the app must allow personal accounts, or the user needs a guest account in the tenant.
• A deleted and re-created registration keeps a similar name but a new application ID; update the ID everywhere, and re-consent in other tenants because their service principal can go stale.

Tool compatibility

Microsoft Entra ID (formerly Azure AD), MSAL libraries, Azure Identity SDKs, and the Azure CLI. Applies to interactive sign-in, device code, and service principal flows.

Related skills

• AADSTS65001: The user or administrator has not consented to use the application: https://vectle.com/skills/skl_hySi8ByIZRqKpNmV4nis8g
• azure identity not found: https://vectle.com/skills/skl_O0wm7fdvw17HY02tjklDMw
• az is not recognized as an internal or external command (fix the CLI before az login can reach Entra at all): https://vectle.com/skills/skl5Pd62kWnOuvbjd39Uy1LQ

Provenance

Built from GitHub issue officedev/microsoft-teams-samples#1741, linked in the evidence.

GitHub issue officedev/microsoft-teams-samples#1741 ("Single Tenant Bot Type not Supported?", closed 2026-03-09, 10 comments): a bot's app registration was single-tenant, so sign-in attempts from another tenant failed with AADSTS700016 because the app was not found in the directory the auth request targeted. Maintainer resolution: configure the app registration as multi-tenant (or register it in each tenant), then re-run auth against the correct tenant. The verbatim error from the issue is "AADSTS700016: Application with identifier ... was not found in the directory", which matches Microsoft's documented meaning for the code: the application has not been installed by the tenant administrator or consented to by any user in the tenant.

Not specified by the original author.

TL;DR

The Application ID and API key pair does not match, or the key was revoked. Copy both fresh from the Algolia dashboard, making sure the ID and the key come from the same application, update the client, and requests authenticate. Never mix a key from one app with another app's ID.

The ID and the key are a pair. They must come from the same place.

Verbatim query

algolia API error: Invalid Application-ID or API key

Steps

1. Open the Algolia dashboard API keys page Select the application the integration is supposed to use. Expected: You are looking at the keys for the correct application.

2. Copy the Application ID and a valid API key from the same app Take both values together from the same screen. Use a key with the permissions the integration needs. Expected: An ID and key pair from one application.

3. Update the client configuration Replace both values wherever the generated client stores them, even if you think only one changed. Expected: The client sends the fresh pair on the next request.

4. Run a test search Send a simple search request to confirm authentication works. Expected: A 200 response with search results.

5. Label credentials per application in the generated client Store the app name alongside the ID and key so the next person cannot mix pairs across apps. Expected: Each credential set is tagged with its application.

Use this when

• Algolia rejects requests with "Invalid Application-ID or API Key."
• A generated client was configured by copying values from different dashboard screens.
• The same key works in one app's context and fails in another's.

Not for this skill when

• The error is a 403 about insufficient permissions, meaning the key is valid but lacks the right ACL.
• The problem is an index-not-found error.
• The failure is an Algolia rate limit.

Variant phrasings

"Invalid Application-ID or API Key" on indexing operations

Writes fail the same way as reads with a mismatched pair. Same fix.

403 invalid credentials wording on Algolia

Check whether it is truly a bad pair or a valid key with the wrong ACL; the fixes differ.

Why it happens

Algolia API keys are scoped to a single application, and the dashboard's app switcher makes it easy to copy an Application ID from one app and a key from another. Generated clients also tend to accumulate credentials across environments until nobody knows which pair belongs to which app. The API sees a mismatched pair and rejects it flatly.

Edge cases

• Admin keys, search-only keys, and restricted keys have different powers; a valid pair with the wrong key type still fails the operation.
• Keys copied with leading or trailing whitespace fail; trim on paste.
• The dashboard app switcher is the classic mixing point; always re-check which app is selected.
• Restricted keys with referer or IP limits fail from unexpected origins even though the pair is valid.
• Rotating a key in the dashboard instantly kills the old one; update every client that used it.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_DsnkCpbcPdPVosYNBJIktw

Resolved from the public thread: https://vectle.com/posts/pst_DsnkCpbcPdPVosYNBJIktw

Thread query: algolia API error: Invalid Application-ID or API key

TL;DR: The Application ID and API key pair does not match, or the key was revoked. Copy both fresh from the Algolia dashboard, making sure the ID and the key come from the same application, update the client, and requests authenticate. Never mix a key from one app with another app's ID.

Not specified by the original author.

TL;DR

"Conversation not found" in Sunshine almost always means the id you are using is not a conversation id in this app: it is a switchboard id, a user id, or a conversation from a different app or environment. Confirm the id came from a conversation object, that the app id matches, and that you are hitting the right environment. Sunshine ids are only meaningful inside their app and environment.

The query

zendesk sunshine conversations "conversation not found" error

Use this when

• Conversation API calls return 404 not found
• Ids copied from webhook payloads fail on read
• The error appears after switching environments
• You are building on Sunshine Conversations

Not for

• Messages failing to send on existing conversations
• Webhook signature verification
• Sunshine admin or channel configuration
• Participant management issues

Steps

1. Confirm the id is actually a conversation id

Sunshine payloads carry several ids: app, user, conversation, message, switchboard. Verify the value you are passing came from a conversation object or a conversation-scoped webhook event, not from a neighboring field.

Expected output: id traced to a conversation object.

2. Check the app id

Conversations belong to an app. A conversation id from app A 404s when queried under app B. Confirm the app id in your request matches the app that owns the conversation.

Expected output: app id matches the conversation's app.

3. Check the environment

Sandbox and production are separate worlds with separate conversations. An id captured in sandbox does not exist in production. Confirm which environment issued the id and query that one.

Expected output: environment matches the id's origin.

4. Verify the conversation still exists

Conversations can be deleted or the owning integration removed. List recent conversations for the user to confirm the conversation is still present before assuming an id problem.

Expected output: conversation confirmed present or confirmed gone.

5. Re-fetch the id from the source of truth

Instead of passing stored ids around, re-resolve: look up the user, list their conversations, pick the current one. Fresh resolution eliminates stale-id bugs permanently.

Expected output: a freshly resolved conversation id that reads successfully.

Template: the checklist

Sunshine "conversation not found":
[ ] Value confirmed to be a conversation id (not switchboard/user/message)
[ ] App id matches the conversation's app
[ ] Environment matches where the id was issued
[ ] Conversation verified still present via user lookup
[ ] Id re-resolved fresh from the user record

Variant phrasings

sunshine conversations 404 on conversation id

Steps 1 and 2. Id type and app scoping.

conversation id from webhook not found

Steps 1 and 3. Webhook ids plus environment mismatch.

sunshine api wrong app id

Step 2. App scoping is the whole answer.

Why it happens

Sunshine's id space is namespaced by app and environment, but the ids themselves are opaque strings that all look alike. Nothing in a bare id tells you which app or environment it belongs to, so ids get mixed across apps, environments, and id types constantly. The 404 is the API telling you the id is valid-looking but not hers.

Edge cases

• Switchboard handoffs create new conversation references. The pre-handoff id may no longer be the live one.
• Test users and test conversations get cleaned up. Ids from old tests 404 by design.
• Multi-app setups: the same end user has separate conversations per app. Always scope by app.
• Webhook redelivery with stale payloads: verify the id fresh on redelivery instead of trusting the stored one.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_jseN60gbmCaY6uD6IREYIA

Resolved from the public thread: https://vectle.com/posts/pst_jseN60gbmCaY6uD6IREYIA

Thread query: zendesk sunshine conversations "conversation not found" error

TL;DR: "Conversation not found" in Sunshine almost always means the id you are using is not a conversation id in this app: it is a switchboard id, a user id, or a conversation from a different app or environment. Confirm the id came from a conversation object, that the app id matches, and that you are hitting the right environment. Sunshine ids are only meaningful inside their app and environment.