AADSTS70011
The requested scope is invalid
Answer: One or more scope values are malformed, unavailable for the resource, or incompatible with the token flow.
Resolution playbook
Fix it, then prove it
Use the error record as the starting point; use tenant evidence to confirm the actual cause.
Likely causes
- Scope syntax and allowed combinations differ between delegated and application flows.
- The request is using a tenant, identity, application, resource, or policy context that does not match the intended operation.
- The error response is the symptom; the correlation/request ID and matching service log identify the controlling decision.
Recommended fix
- Use fully qualified scopes for the intended API.
- Do not mix scopes from different resources in one v2 token request.
- For client credentials, request the resource's .default scope.
Verify
- Repeat the smallest operation that produced the failure.
- Confirm a fresh success in the authoritative service log or admin center, not only in the client UI.
- Record the new UTC timestamp and correlation/request ID so the retry can be distinguished from cached or older failures.
Escalate when
- The failure persists after the documented prerequisites and a new authentication/session attempt.
- Multiple users, apps, devices, or networks show the same error, suggesting tenant policy or service scope.
- You can provide the exact UTC time, tenant, application/resource, correlation or request ID, and sanitized logs.
Admin context
Scope syntax and allowed combinations differ between delegated and application flows.
Evidence to preserve
- UTC timestamp and correlation/request ID
- Tenant, application, resource, and authentication flow
- Sanitized service log details and exact operation
Advertisement