azure identity not found

Not specified by the original author.

Context: "Identity not found" is the Azure instance metadata service (IMDS) answering 400 when ManagedIdentityCredential, often inside DefaultAzureCredential, asks for a token for an identity the Azure fabric has not assigned to that resource. The fuller message usually reads "the requested identity isn't assigned to this resource". The fix is to assign the identity to the resource (or pass the correct TL;DR: "Identity not found" is the Azure instance metadata service answering 400 because the managed identity your code asked for is not assigned to this resource. Assign the identity (or fix the client id), wait a few minutes for propagation, then retry. This is almost never an RBAC or permissions problem.

1. Read the full error and note which identity was requested. If you constructed the credential with a client id, that is the one being looked up. If not, it is the resource's default identity.
2. Verify the identity is assigned to this resource. For a VM, run:

az vm identity show --resource-group YOUR_RG --name YOUR_VM

For App Service or Functions, check the Identity blade in the portal, or run:

az webapp identity show --resource-group [your resource group] --name [your app]

For Container Apps:

az containerapp identity show --resource-group [your resource group] --name [your app]

If the listing is empty, or your client id is missing from it, that is the cause. On AKS with workload identity, check the service account annotation instead:

kubectl describe sa [your service account] -n [your namespace]

The annotation value must match the client id your code requests character for character.

3. Fix the assignment: enable the system-assigned identity on the resource, or attach your user-assigned identity to it, then confirm the client id you use matches it exactly.
4. Wait a few minutes after assigning. Identity assignment takes time to propagate. Then retry the token call. Expected: a token is returned instead of the 400.

Reading the real IMDS error behind "azure identity not found"

The token call that fails is your code asking the Azure instance metadata service for a token. When the identity is not assigned, the service answers 400 with a body shaped like {"error":"invalid_request","error_description":"Identity not found"}. Two nearby errors mean different things and need different fixes:

• error_description "Identity not found" - the identity exists in Entra (or does not) but is not attached to this host. Fix the assignment, per the steps above.
• No response from the metadata endpoint at all (connection refused or timeout) - you are on a local dev machine or a non-Azure host, where there is no metadata service. Fix: az login and let AzureCliCredential handle it; do not chase identity assignment.
• 400 with a different error_description mentioning the client id format - the requested client id is malformed or mistyped. Compare it character for character against the assigned identity.

Variant phrasings: the requested identity isn't assigned to this resource; ManagedIdentityCredential authentication unavailable; error_description Identity not found; DefaultAzureCredential failed to retrieve a token from the included credentials.

Root cause: the managed identity credential asks IMDS for a token for a specific identity. IMDS answers 400 invalid_request when that identity has not been assigned to the host making the request. The identity may exist in Entra but is not attached to this VM, app service, container app, or AKS pod, or the requested client id is simply wrong.

Edge cases: on a local dev machine the same credential chain fails with "no response from the IMDS endpoint" because there is no metadata service locally, which is a different cause with a different fix (az login). On AKS with workload identity, a wrong client id in the service account annotation produces this same error. A placeholder or mistyped client id is a common cause, so compare it character by character. Recently assigned identities need propagation time before they work.

When not to use: if you are running locally, do not chase identity assignment. Use az login and AzureCliCredential instead. Do not disable managed identity in DefaultAzureCredential to silence this on an Azure host; fix the assignment.

Related skills

• Diagnose: DefaultAzureCredential failed to retrieve a token from the included credentials - the wider credential-chain failure this error often hides inside.
• azure.identity.CredentialUnavailableError: DefaultAzureCredential failed to retrieve a token - when the chain fails before IMDS is even reached.

"Identity not found" is the Azure instance metadata service (IMDS) answering 400 when ManagedIdentityCredential, often inside DefaultAzureCredential, asks for a token for an identity the Azure fabric has not assigned to that resource. The fuller message usually reads "the requested identity isn't assigned to this resource". The fix is to assign the identity to the resource (or pass the correct client id), then retry.

"error": "invalid_request", "error_description": "Identity not found"

Verified resolution: 1. Read the full error and note which identity was requested. If you constructed the credential with a client id, that is the one being looked up. If not, it is the resource's default identity.

2. Verify the identity is assigned to this resource. For a VM, run:

az vm identity show --resource-group YOUR_RG --name YOUR_VM

For App Service or Functions, check the Identity blade in the portal. If the listing is empty, or your client id is missing from it, that is the cause.

3. Fix the assignment: enable the system-assigned identity on the resource, or attach your user-assigned identity to it, then confirm the client id you use matches it exactly.
4. Wait a few minutes after assigning. Identity assignment takes time to propagate. Then retry the token call. Expected: a token is returned instead of the 400.

Variant phrasings: the requested identity isn't assigned to this resource; ManagedIdentityCredential authentication unavailable; error_description Identity not found; DefaultAzureCredential failed to retrieve a token from the included credentials.

Root cause: the managed identity credential asks IMDS for a token for a specific identity. IMDS answers 400 invalid_request when that identity has not been assigned to the host making the request. The identity may exist in Entra but is not attached to this VM, app service, container app, or AKS pod, or the requested client id is simply wrong.

Edge cases: on a local dev machine the same credential chain fails with "no resp

Source: https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/identity/azure-identity/TROUBLESHOOTING.md

Not specified by the original author.

TL;DR

application id not found is Microsoft Entra ID error AADSTS700016: the application ID in your auth request does not exist in the tenant the request targets. The app is usually single-tenant and registered in a different directory, or the client ID was copied wrong. Check the app registration and its home tenant in the portal, then make the app multi-tenant or fix the tenant ID in the request, and retry.

AADSTS700016: Application with identifier '[app-id]' was not found in the directory '[directory]'. This can happen if the application has not been installed by the administrator of the tenant or consented to by any user in the tenant.

Use this when

• Sign-in fails with application id not found, or the full text names AADSTS700016
• The failure happens during az login, MSAL, Azure Identity, or an OAuth sign-in flow
• A single-tenant app (for example a Teams bot) works for its home tenant but fails for anyone else

Not for this skill when

• The code is AADSTS50034 (the user account does not exist) or AADSTS90002 (the tenant itself is not found). Different root causes
• The code is AADSTS65001 (admin consent missing). The app exists there, consent is the problem; see the related skill below

Steps

1. Find the app registration. In the Azure portal go to Microsoft Entra ID, then App registrations, and search for the application ID from the error. Read the home tenant on the overview page.

Expected: you find the app and can name its home tenant, or you find nothing at all.

2. Compare tenants. If the app is registered in tenant A but your auth request targets tenant B, that mismatch is the cause: a single-tenant app is not found in any other directory.

Expected: the tenant in your request and the app home tenant are either the same (go to step 4) or different (go to step 3).

3. Fix the mismatch one of two ways. Either switch the auth request to the app home tenant, or, if users from other tenants need to sign in, open Authentication, then Supported account types, and change it to Accounts in any organizational directory, so the app can be consented into other tenants.

Expected: the setting saves, and a fresh sign-in from the other tenant reaches consent instead of the not found error.

4. If the app ID matches nothing anywhere, re-copy it. Copy the Application (client) ID from the app overview page character for character; a directory ID or object ID pasted in its place produces exactly this error.

Expected: the identifier in your config matches the overview page exactly.

5. If the app was created minutes ago, wait and retry. New registrations take a few minutes to propagate across Entra ID.

Expected: the error clears on retry without any config change.

Variant phrasings

aadsts700016

The code on its own is this same failure: the application lookup failed in the targeted tenant. Work steps 1 to 3.

application with identifier was not found in the directory

The long form of the same AADSTS700016 text, without the code in front. Same tenant mismatch fix.

azure application id not found

Usually seen with az login or a service principal sign-in: check that the tenant ID in the command or environment matches the tenant where the app is registered.

the application has not been installed by the administrator of the tenant

That sentence is part of the AADSTS700016 message. It means the app has no service principal in that tenant yet, which follows from the tenant mismatch in step 2, not from a separate install step.

Root cause

Entra ID looks up the app by ID inside the tenant named in the auth request. If the app was never created or consented in that tenant, the lookup fails. The classic trigger is a single-tenant registration used from a different tenant: in the source issue a Teams bot configured single-tenant failed the moment auth came from another directory.

Edge cases

• Personal Microsoft accounts hitting this against a work app: the app must allow personal accounts, or the user needs a guest account in the tenant.
• A deleted and re-created registration keeps a similar name but a new application ID; update the ID everywhere, and re-consent in other tenants because their service principal can go stale.

Tool compatibility

Microsoft Entra ID (formerly Azure AD), MSAL libraries, Azure Identity SDKs, and the Azure CLI. Applies to interactive sign-in, device code, and service principal flows.

Related skills

• AADSTS65001: The user or administrator has not consented to use the application: https://vectle.com/skills/skl_hySi8ByIZRqKpNmV4nis8g
• azure identity not found: https://vectle.com/skills/skl_O0wm7fdvw17HY02tjklDMw
• az is not recognized as an internal or external command (fix the CLI before az login can reach Entra at all): https://vectle.com/skills/skl5Pd62kWnOuvbjd39Uy1LQ

Provenance

Built from GitHub issue officedev/microsoft-teams-samples#1741, linked in the evidence.

GitHub issue officedev/microsoft-teams-samples#1741 ("Single Tenant Bot Type not Supported?", closed 2026-03-09, 10 comments): a bot's app registration was single-tenant, so sign-in attempts from another tenant failed with AADSTS700016 because the app was not found in the directory the auth request targeted. Maintainer resolution: configure the app registration as multi-tenant (or register it in each tenant), then re-run auth against the correct tenant. The verbatim error from the issue is "AADSTS700016: Application with identifier ... was not found in the directory", which matches Microsoft's documented meaning for the code: the application has not been installed by the tenant administrator or consented to by any user in the tenant.

Not specified by the original author.

TL;DR

This happens when the managed identity is not actually enabled on the host. Also confirm the identity has the Azure App Configuration Data Reader role on the store, without the data-plane role you will get 401/403 instead.

Steps

1. This happens when the managed identity is not actually enabled on the host. In the Azure portal, open the App Service, go to Identity under Settings, and make sure Status is On under the System assigned tab. Also confirm the identity has the Azure App Configuration Data Reader role on the store, without the data-plane role you will get 401/403 instead. Note that ManagedIdentityCredential has no endpoint when running locally, so use a connection string for local development.

When to use

You are seeing this: Connecting with x.Connect(new Uri("your service endpoint URL"), new ManagedIdentityCredential()) throws "No managed identity endpoint found". Use this skill when you run into "Azure App Configuration No managed identity endpoint found with ManagedIdentityCredential".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Edge cases

• Also confirm the identity has the Azure App Configuration Data Reader role on the store, without the data-plane role you will get 401/403 instead.
• Note that ManagedIdentityCredential has no endpoint when running locally, so use a connection string for local development.

A user asked: Connecting with x.Connect(new Uri("your service endpoint URL"), new ManagedIdentityCredential()) throws "No managed identity endpoint found". The code runs in Azure App Service and the app crashes with an unhandled Azure.Identity exception. The verified answer: This happens when the managed identity is not actually enabled on the host. In the Azure portal, open the App Service, go to Identity under Settings, and make sure Status is On under the System assigned tab. Also confirm the identity has the Azure App Configuration Data Reader role on the store, without the data-plane role you will get 401/403 instead. Note that ManagedIdentityCredential has no endpoint when running locally, so use a connection string for local development. Thread: https://vectle.com/threads/thr_Uh0WxMramAeQl3MM5NNCSw