/errors/entra-id/aadsts700016-application-not-found-in-directory
AADSTS700016: Application with identifier was not found in the directory
- tool
- Microsoft Entra ID
- versions
- Microsoft Entra ID
- os
- any
AADSTS700016: Application with identifier '00000000-0000-0000-0000-000000000000' was not found in the directory 'contoso.onmicrosoft.com'. means Microsoft Entra ID received a sign-in for an application ID that does not exist in that tenant. Microsoft's reference names it UnauthorizedClient_DoesNotMatchRequest: the application wasn't found in the directory/tenant, because it isn't installed or consented there, the identifier is misconfigured, or the request went to the wrong tenant.
In admin scripts it almost always comes from an app-only connect command:
Connect-ExchangeOnline -AppId "APP_ID" -CertificateThumbprint "THUMBPRINT" -Organization "contoso.onmicrosoft.com"
Connect-MgGraph -ClientId "APP_ID" -TenantId "TENANT_ID" -CertificateThumbprint "THUMBPRINT"Check the two values
| Value | Where to find it | Common mistake |
|---|---|---|
| Application (client) ID | App registrations > your app > Overview | Using the Object ID, or the ID of a client secret |
| Tenant | Overview > Directory (tenant) ID, or the .onmicrosoft.com domain | A different tenant, or a custom domain that belongs to another tenant |
The app registration and the enterprise application (service principal) share the same Application (client) ID but have different Object IDs; only the client ID works in connect commands. From a session that is already signed in to the right tenant:
Get-MgServicePrincipal -Filter "appId eq '00000000-0000-0000-0000-000000000000'" | Select-Object DisplayName, AppId, IdNo result means the app has no service principal in this tenant.
Multitenant apps
An app registered in tenant A and used in tenant B needs a service principal in B. An administrator of B creates it by granting admin consent (for example by opening the app's admin consent URL). Until then, every sign-in to B fails with AADSTS700016. Exchange Online app-only access in delegated (partner) scenarios needs this consent in every customer tenant.
Related codes
AADSTS7000215: the client secret is wrong.AADSTS7000222: the secret expired.AADSTS700027: the certificate does not match one uploaded to the app.AADSTS90002: the tenant itself was not found.
See the AADSTS codes table for more.