Azure AD App Registration Returns 'Not Found' Error Despite Admin Consent - OAuth Token Exchange Failing

The error indicates that the token endpoint cannot find a service principal for the app in the target tenant, or the request is being sent to the wrong tenant context or with the wrong app identifier, even though admin consent is already granted.

Focus on these areas:

1. Verify the app identifier used in all OAuth requests

• Ensure the client_id in all authorize and token requests is exactly the Application (client) ID (a GUID like 00001111-aaaa-2222-bbbb-3333cccc4444).
• If using client_secret, confirm it belongs to the same app registration.
• Avoid using legacy short hex IDs (e.g., 0000000012345A67), which are not valid for the Microsoft identity platform and can cause “Application not found” errors.

2. Confirm the correct tenant is being targeted

• The error includes a [TENANT] value. Confirm that:
  • This tenant is the one where the app has been consented.
  • The app is configured as multitenant (accounts in any organizational directory and personal Microsoft accounts) in the app registration.
• When using /common or /organizations, Azure AD resolves to a specific tenant during sign-in. If the app is not configured as multitenant or was registered only for a different tenant, the resolved tenant may not contain a service principal for the app, causing the error.

3. Ensure a service principal exists in the target tenant

• The error often means the service principal for the app does not exist in that tenant.
• For multitenant apps, the service principal is created when a user or admin first consents.
• If consent was done in one tenant but the sign-in is happening in another, the second tenant will not have the app and will return this error.
• Confirm that the tenant where users are signing in is the same tenant where admin consent was granted.

4. Re-run admin consent in the correct tenant

• If there is any doubt about which tenant has consented, re-run admin consent explicitly against the intended tenant.
• Use an admin consent URL that targets that tenant and includes the correct client_id and scopes. For example, using the admin consent endpoint:

    https://login.microsoftonline.com/{tenant}/v2.0/adminconsent
        ?client_id={App-Id}
        &scope=openid profile offline_access https://graph.microsoft.com/User.Read
        &redirect_uri={Redirect-Uri}
  

• After consent, verify in Enterprise applications of that tenant that the app appears and that permissions show as granted.

5. Check that basic sign-in permissions are configured and consented

• Ensure the app has at least one sign-in related delegated permission such as Microsoft Graph User.Read or Openid, and that it is consented.
• Lack of a basic sign-in permission can cause consent/sign-in issues.

6. Confirm the app is not misconfigured as single-tenant

• If the app is effectively single-tenant (or the account type was changed after initial configuration), sign-ins from other tenants using /common or /organizations will fail with “Application not found or unauthorized client.”
• Ensure the Supported account types setting is still set to allow multiple tenants and personal accounts.

7. Validate the environment and registration type

• If the app was originally registered for a different environment (for example, using an ID from a legacy Live SDK or a different cloud/region), calling the Microsoft identity platform endpoint with that ID can produce “Application not found” errors.
• Confirm the app was registered in the same cloud/region as the endpoint being used and that the ID format is a GUID with dashes.

If, after these checks, the error persists, the most common root causes are:

• Using the wrong client_id or a legacy/non–Microsoft identity platform ID.
• Targeting a tenant where the app has not actually been consented (or where the service principal was deleted).
• Misalignment between the app’s multitenant configuration and the tenant used in the OAuth endpoints.

References:

• Handling Service Errors and Exceptions
• Troubleshoot consent issues in Microsoft Entra ID
• Error AADSTS650056: Misconfigured application
• Admin consent on the Microsoft identity platform
• Publish an add-in that requires admin consent for Microsoft Graph scopes