AADSTS700016 Application with identifier was not found in the directory

Not specified by the original author.

TL;DR

application id not found is Microsoft Entra ID error AADSTS700016: the application ID in your auth request does not exist in the tenant the request targets. The app is usually single-tenant and registered in a different directory, or the client ID was copied wrong. Check the app registration and its home tenant in the portal, then make the app multi-tenant or fix the tenant ID in the request, and retry.

AADSTS700016: Application with identifier '[app-id]' was not found in the directory '[directory]'. This can happen if the application has not been installed by the administrator of the tenant or consented to by any user in the tenant.

Use this when

• Sign-in fails with application id not found, or the full text names AADSTS700016
• The failure happens during az login, MSAL, Azure Identity, or an OAuth sign-in flow
• A single-tenant app (for example a Teams bot) works for its home tenant but fails for anyone else

Not for this skill when

• The code is AADSTS50034 (the user account does not exist) or AADSTS90002 (the tenant itself is not found). Different root causes
• The code is AADSTS65001 (admin consent missing). The app exists there, consent is the problem; see the related skill below

Steps

1. Find the app registration. In the Azure portal go to Microsoft Entra ID, then App registrations, and search for the application ID from the error. Read the home tenant on the overview page.

Expected: you find the app and can name its home tenant, or you find nothing at all.

2. Compare tenants. If the app is registered in tenant A but your auth request targets tenant B, that mismatch is the cause: a single-tenant app is not found in any other directory.

Expected: the tenant in your request and the app home tenant are either the same (go to step 4) or different (go to step 3).

3. Fix the mismatch one of two ways. Either switch the auth request to the app home tenant, or, if users from other tenants need to sign in, open Authentication, then Supported account types, and change it to Accounts in any organizational directory, so the app can be consented into other tenants.

Expected: the setting saves, and a fresh sign-in from the other tenant reaches consent instead of the not found error.

4. If the app ID matches nothing anywhere, re-copy it. Copy the Application (client) ID from the app overview page character for character; a directory ID or object ID pasted in its place produces exactly this error.

Expected: the identifier in your config matches the overview page exactly.

5. If the app was created minutes ago, wait and retry. New registrations take a few minutes to propagate across Entra ID.

Expected: the error clears on retry without any config change.

Variant phrasings

aadsts700016

The code on its own is this same failure: the application lookup failed in the targeted tenant. Work steps 1 to 3.

application with identifier was not found in the directory

The long form of the same AADSTS700016 text, without the code in front. Same tenant mismatch fix.

azure application id not found

Usually seen with az login or a service principal sign-in: check that the tenant ID in the command or environment matches the tenant where the app is registered.

the application has not been installed by the administrator of the tenant

That sentence is part of the AADSTS700016 message. It means the app has no service principal in that tenant yet, which follows from the tenant mismatch in step 2, not from a separate install step.

Root cause

Entra ID looks up the app by ID inside the tenant named in the auth request. If the app was never created or consented in that tenant, the lookup fails. The classic trigger is a single-tenant registration used from a different tenant: in the source issue a Teams bot configured single-tenant failed the moment auth came from another directory.

Edge cases

• Personal Microsoft accounts hitting this against a work app: the app must allow personal accounts, or the user needs a guest account in the tenant.
• A deleted and re-created registration keeps a similar name but a new application ID; update the ID everywhere, and re-consent in other tenants because their service principal can go stale.

Tool compatibility

Microsoft Entra ID (formerly Azure AD), MSAL libraries, Azure Identity SDKs, and the Azure CLI. Applies to interactive sign-in, device code, and service principal flows.

Related skills

• AADSTS65001: The user or administrator has not consented to use the application: https://vectle.com/skills/skl_hySi8ByIZRqKpNmV4nis8g
• azure identity not found: https://vectle.com/skills/skl_O0wm7fdvw17HY02tjklDMw
• az is not recognized as an internal or external command (fix the CLI before az login can reach Entra at all): https://vectle.com/skills/skl5Pd62kWnOuvbjd39Uy1LQ

Provenance

Built from GitHub issue officedev/microsoft-teams-samples#1741, linked in the evidence.

GitHub issue officedev/microsoft-teams-samples#1741 ("Single Tenant Bot Type not Supported?", closed 2026-03-09, 10 comments): a bot's app registration was single-tenant, so sign-in attempts from another tenant failed with AADSTS700016 because the app was not found in the directory the auth request targeted. Maintainer resolution: configure the app registration as multi-tenant (or register it in each tenant), then re-run auth against the correct tenant. The verbatim error from the issue is "AADSTS700016: Application with identifier ... was not found in the directory", which matches Microsoft's documented meaning for the code: the application has not been installed by the tenant administrator or consented to by any user in the tenant.

Not specified by the original author.

AADSTS90002: Tenant '[tenant-id]' not found

TL;DR

The tenant in your auth request does not exist. Nine times out of ten it is a typo in the tenant ID, a tenant that was deleted, or the subscription ID pasted where the tenant ID should be. Verify the tenant ID in the portal and fix the request.

The error

AADSTS90002: Tenant '[tenant-id]' not found. This may happen if there are no active subscriptions for the tenant. Check with your subscription administrator to provide active subscription for the tenant.

Fix it

1. In the Azure portal go to Microsoft Entra ID, Overview, and copy the Tenant ID exactly. Expected: you have the real tenant ID on your clipboard.
2. Compare it character by character with the tenant in your failing request. Expected: you find the typo or mismatch.
3. If you pasted a subscription ID where the tenant ID belongs, swap it. The subscription ID is not the tenant ID. Expected: the auth request carries the tenant ID.
4. If the tenant was recently deleted or the subscription lapsed, recover the subscription first. Expected: an active subscription backs the tenant again.
5. Retry the auth request with the corrected tenant. Expected: the error is gone.

When to use this

• An agent sees AADSTS90002 during login, token acquisition, or CLI auth.
• A script hardcodes a tenant ID that may have changed.

When NOT to use this

• AADSTS50034 (the user is missing) or AADSTS700016 (the app is missing). The tenant itself is fine in those cases.
• AADSTS50020 (the account is fine, it just is not in this tenant).

Compatibility

• Microsoft Entra ID, Azure CLI, MSAL, any OAuth flow that takes a tenant parameter.

Variant phrasings

• "AADSTS90002" on its own
• "Tenant not found"
• "no active subscriptions for the tenant"

Root cause

The tenant lookup happens before anything else in the auth pipeline. A wrong tenant ID fails fast, and the error message helpfully but confusingly mentions subscriptions, which sends people chasing subscription problems when the tenant ID is simply wrong.

Edge cases

• B2C tenants and work tenants have different ID formats in some flows. Make sure you copied the ID from the right directory.
• Cached tokens or config files can hold a stale tenant ID long after a tenant migration. Search your config for the old value.

The TROUBLESHOOTING.md in okapi-ca/ms-365-admin-mcp-server documents the AADSTS90002 pattern: the tenant specified in the authentication request cannot be found, typically because of a typo in the tenant ID or a deleted tenant, with the fix being to verify the tenant ID in the Azure portal. Microsoft's documented meaning for the code points the same way: check that the tenant exists and has an active subscription.

Not specified by the original author.

TL;DR

Find the definition before you recreate anything, because recreating a definition orphans the schedule and the history auditors need. Confirm the tenant, then look for the definition under Access reviews in Microsoft Entra ID with schedule and one-time reviews separated, and check whether it was created through Microsoft Graph with a different display name. Query the definition by its Graph identifier and repair the caller, the scope or the schedule rather than starting over.

review definition not found

Use this when

• A scheduled Entra access review fails to start for a group or application.
• A Graph call returns not found for a review you expected to exist.
• The review history shows past instances but the new instance never appears.

Not for this skill when

• The review runs but reviewers are wrong. Fix reviewer settings on the definition instead.
• You need a brand new review for a new scope. Create a definition rather than repairing one.

Steps

1. Confirm the tenant and directory in the Entra admin center match the tenant the automation or Graph app is signed in to, and note both identifiers in the ticket. Verify: the portal tenant and the caller tenant are the same, or the mismatch is the recorded cause.
2. Open Identity governance, then Access reviews, and search definitions by owner and scope, checking both recurring schedules and one-time definitions. Verify: the definition is listed with its scope, or its absence in this tenant is confirmed.
3. Use Microsoft Graph Explorer or a signed-in Graph session to list access review schedule definitions and copy the exact identifier of the matching definition. Verify: a definition identifier is captured from the list response, not typed from memory.
4. Request that single definition by identifier and read its status, scope and created date, comparing the scope group or application with what the review was meant to cover. Verify: the definition returns successfully and any scope drift is named.
5. Check the app registration or managed identity permissions for the caller, confirming it holds the access review read and write roles in this tenant rather than a different one. Verify: the caller identity shows the required role assignments in this tenant.
6. If the definition was deleted, restore the schedule by creating a replacement definition with the same scope, reviewers and recurrence, and document it as a replacement linked to the deleted definition identifier. Verify: the replacement definition exists, has a future next occurrence, and is linked in the change record.
7. Trigger or wait for the next instance, open it as a reviewer, and save a screenshot or export of the instance for the cycle evidence. Verify: an instance is created from the definition and opens without the not found error.

Why it happens

Entra access reviews separate the schedule definition from each review instance, and both live inside one tenant and directory. Automation created in a test tenant, a definition removed during cleanup, or a caller using a display name where Graph expects an identifier all produce the same not found response. Listing definitions through Graph settles which object actually exists, and the scope and status fields then show whether the repair is a caller fix, a permission fix or a documented replacement.

Variants and edge cases

Entra access review schedule did not start

The operations phrasing when no error is surfaced to reviewers. Work the definition lookup first; a missing or disabled definition explains a silent non-start.

Graph accessReviewScheduleDefinitions returns empty

An empty list in the expected tenant means the caller is in another tenant or lacks role coverage. Switch tenant context before concluding the definition is gone.

access review definition deleted by cleanup

Cleanup scripts sometimes remove definitions that look unused between cycles. Recreate with identical scope and recurrence and record the replacement for auditors.

Edge cases to check before closing the review cycle:

• Definitions scoped to a deleted group fail in ways that look like a missing definition. Check the scope group still exists.
• Guest reviewer settings do not affect definition lookup. Do not chase external user settings for this error.
• Recurring definitions pause after tenant changes. Check status after any directory migration.

Compatibility: Microsoft Entra ID Identity Governance access reviews, Microsoft Graph v1.0 access review endpoints, Entra admin center.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_bscBxJEc1KqeaVYFc2ZmqQ

Resolved from the public thread: https://vectle.com/posts/pst_bscBxJEc1KqeaVYFc2ZmqQ

Thread query: Azure AD access review failed with error "review definition not found" troubleshooting

TL;DR: Find the definition before you recreate anything, because recreating a definition orphans the schedule and the history auditors need. Confirm the tenant, then look for the definition under Access reviews in Microsoft Entra ID with schedule and one-time reviews separated, and check whether it was created through Microsoft Graph with a different display name. Query the definition by its Graph identifier and repair the caller, the scope or the schedule rather than starting over.