Consent and sign-in errors
The AADSTS errors OpenAdminOS recognises at sign-in, what causes them and how to fix them, plus services that stay not connected.
When Microsoft sign-in fails, OpenAdminOS replaces the raw error with a message that names the app used, either the OpenAdminOS app or your app registration with its client ID, and the fix. Try again retries with the same app. Change sign-in options returns to the choice with your entries kept, so you can correct a client ID or directory ID.
Microsoft's full list of codes is the Microsoft Entra authentication and authorization error codes reference.
AADSTS Codes#
| Code | Cause | Fix with your own registration | With the OpenAdminOS app |
|---|---|---|---|
| AADSTS50011 | The redirect URI in the request does not match the registration's reply addresses. | In the registration, under Authentication, add the platform Mobile and desktop applications with the redirect URI http://localhost, save, and try again. |
A problem with the published app, not your tenant. Report it, and connect with your own registration in the meantime. |
| AADSTS500113 | No reply address is registered for the application. Not listed on Microsoft's reference page; OpenAdminOS treats it like AADSTS50011. | Same as AADSTS50011. | Same as AADSTS50011. |
| AADSTS7000218 | Microsoft expected a client secret or client assertion, because the app is not set up as a public client. | Under Authentication, set Allow public client flows to Yes, save, and try again. OpenAdminOS never uses a client secret. | A problem with the published app. Report it. |
| AADSTS50194 | The app is single-tenant, so sign-in through the common endpoint is not allowed. | Enter the Directory (tenant) ID from the registration overview in the connect dialog. | A problem with the published app. Report it. |
| AADSTS900023 | The directory entered for sign-in was not recognised. Not listed on Microsoft's reference page. | Use the Directory (tenant) ID GUID or a verified domain from the registration overview. | Check the account you signed in with. |
| AADSTS700016 | The application was not found in the directory you signed in to: a wrong client ID, the wrong directory, or the app was never installed or consented there. | Check the Application (client) ID. For a single-tenant app, also enter its Directory (tenant) ID. | Your organization may block third-party multi-tenant apps. Ask an Entra administrator to allow it, or use your own registration. |
| AADSTS50105 | The signed-in user is not assigned to the app, and the enterprise application requires assignment. | Assign the user under Enterprise applications, or sign in with an assigned account. | Same. |
| AADSTS65001 | Consent for the requested permissions does not exist yet. | Under API permissions, select Grant admin consent, or create a registration with the setup script. Then try again. | An administrator who can grant tenant-wide consent signs in once and approves. See Roles. |
| AADSTS90094, AADSTS90095 | Administrator consent is required; the signed-in user cannot consent alone. 90095 is the admin consent workflow asking the user to request approval. | Same as AADSTS65001. | Same as AADSTS65001. |
| AADSTS50020 | The account does not exist in the tenant, for example a personal Microsoft account. | Sign in with an account from the tenant's directory. | Same. |
Other messages you may see:
- Sign-in was cancelled. Nothing was connected. Start again when ready.
- Microsoft sign-in timed out after five minutes. The browser sign-in was not completed. Start again.
- Couldn't reach Microsoft's sign-in endpoint. Check the network, proxy, VPN or DNS.
- The previous sign-in session expired. Reconnect from Connections and complete the consent prompt.
A Service Shows Not Connected#
Connections shows a service as Not connected when none of its parts is granted, and Partial when some are. A part counts as granted only when every one of its scopes is.
With the OpenAdminOS app:
- The service was not selected when the tenant was connected. Choose Add access on it and approve the consent screen.
- Consent was cancelled or not granted by an administrator. Choose Add access again, signed in with an account that can grant consent.
With your own app registration:
- The registration does not have the permissions. The row lists the exact missing permissions. Choose Add permissions, then run the script or merge the JSON snippet, as described in Own app registration.
- The permissions were added but admin consent was not granted. Grant it under API permissions.
- A part is missing one permission. Add the whole part: a part is on only when all of its permissions are granted.
After fixing it, choose Check again.
Check Again Found Nothing New#
Check again asks Microsoft for a new token and compares the permissions it carries with the ones recorded. If they are the same, OpenAdminOS shows "Microsoft returned no new permissions. Admin consent can take a minute to appear."
- Wait a minute and choose Check again once more. New consent can take a short time to appear in tokens.
- In the Entra admin center, open the registration, then API permissions, and confirm the permissions show as granted for the tenant. A permission that is listed but not granted is not in the token.
- Confirm the permissions are delegated Microsoft Graph permissions, not application permissions. OpenAdminOS uses delegated permissions only.
- Confirm you added them to the registration whose client ID the tenant was connected with. Connections shows it.