AADSTS650056
The application requested an invalid or unconfigured resource
Answer: The application registration or token request does not correctly identify or expose the requested API resource.
Resolution playbook
Fix it, then prove it
Use the error record as the starting point; use tenant evidence to confirm the actual cause.
Likely causes
- The sign-in error details usually name the resource Entra could not resolve.
- The request is using a tenant, identity, application, resource, or policy context that does not match the intended operation.
- The error response is the symptom; the correlation/request ID and matching service log identify the controlling decision.
Recommended fix
- Verify the resource or scope identifier in the request.
- Confirm the API is added under configured permissions and exposes the expected scope.
- Check client ID, application ID URI, tenant, and consent state together.
Verify
- Repeat the smallest operation that produced the failure.
- Confirm a fresh success in the authoritative service log or admin center, not only in the client UI.
- Record the new UTC timestamp and correlation/request ID so the retry can be distinguished from cached or older failures.
Escalate when
- The failure persists after the documented prerequisites and a new authentication/session attempt.
- Multiple users, apps, devices, or networks show the same error, suggesting tenant policy or service scope.
- You can provide the exact UTC time, tenant, application/resource, correlation or request ID, and sanitized logs.
Admin context
The sign-in error details usually name the resource Entra could not resolve.
Evidence to preserve
- UTC timestamp and correlation/request ID
- Tenant, application, resource, and authentication flow
- Sanitized service log details and exact operation
Advertisement