Azure DevOps Wiki Connector - "Given email address is invalid" for Graph Connector Federated Credential App

Question

Azure DevOps Wiki Connector - "Given email address is invalid" for Graph Connector Federated Credential App

ＫＡＮＧＪＩＨＵＮ / KANG，JIHUN 20

I am configuring an Azure DevOps Wiki Connector using Federated Credentials by following the Microsoft Learn document "Deploy the Azure DevOps Wiki connector".

The Graph Connector Federated Credential App exists as an Enterprise Application in Microsoft Entra ID.
(Before reaching the step of adding the application to Azure DevOps Organization Settings > Users, I was able to complete all preceding steps described in the deployment guide without any issues. The connector deployment process, including the Microsoft Entra ID configuration and the creation of the Graph Connector Federated Credential App, completed successfully.)

However, when I try to add it in Azure DevOps Organization Settings > Users > Add users, I receive the following error:

Given email address '933838e2-bec1-440f-a634-9363c82e5b6d' is invalid

https://learn.microsoft.com/en-us/microsoft-365/copilot/connectors/azure-devops-wiki-deployment#grant-the-microsoft-entra-app-access-to-azure-devops-projects

I would like to know which value should be specified in the Users or Service Principals field for the Graph Connector Federated Credential App (Application Name, Application ID, Object ID, or another identifier).

Additionally, are there any prerequisites or permission settings required before this application can be added to Azure DevOps?

Any guidance would be greatly appreciated. Thank you.

Tejaswini Billakurthi 250 Reputation points Microsoft External Staff Moderator

2026-09-02T14:49:25.9766667+00:00
Hello @ＫＡＮＧＪＩＨＵＮ / KANG，JIHUN ,

Thank for reaching out to Microsoft Q&A!

please verify the following prerequisites and configuration settings:

Ensure Third-party application access via OAuth is enabled in Azure DevOps > Organization Settings > Policies, as this is a required prerequisite for the Azure DevOps Wiki Connector.

Confirm that the Graph Connector Federated Credential App exists in Microsoft Entra ID > Enterprise Applications. Search for the application name Graph Connector Federated Credential App or the Application ID 933838e2-bec1-440f-a634-9363c82e5b6d.

If the application was recently provisioned, please allow additional time for provisioning to complete. Microsoft documentation indicates that provisioning can take several hours, during which Azure DevOps may not recognize the service principal.

Verify that the Azure DevOps organization is connected to the same Microsoft Entra ID tenant, as service principals are supported only for organizations linked to Microsoft Entra ID. This can be confirmed under Azure DevOps > Organization Settings > Microsoft Entra.

Additionally, when adding the service principal in Azure DevOps > Organization Settings > Users > Add Users, the value that should be entered in the Users or Service Principals field is the Application (Client) ID: 933838e2-bec1-440f-a634-9363c82e5b6d. The Application Name, Object ID, and Enterprise Application Object ID should not be used for this step.

Please "Upvote the Answer" if this information helped you. This will help us and others in the community as well.
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Answer accepted by question author

0 additional answers

Your answer

Tejaswini Billakurthi 250 Reputation points Microsoft External Staff Moderator

2026-09-02T14:49:25.9766667+00:00

Hello @ＫＡＮＧＪＩＨＵＮ / KANG，JIHUN ,

Thank for reaching out to Microsoft Q&A!

please verify the following prerequisites and configuration settings:

Ensure Third-party application access via OAuth is enabled in Azure DevOps > Organization Settings > Policies, as this is a required prerequisite for the Azure DevOps Wiki Connector.

Confirm that the Graph Connector Federated Credential App exists in Microsoft Entra ID > Enterprise Applications. Search for the application name Graph Connector Federated Credential App or the Application ID 933838e2-bec1-440f-a634-9363c82e5b6d.

If the application was recently provisioned, please allow additional time for provisioning to complete. Microsoft documentation indicates that provisioning can take several hours, during which Azure DevOps may not recognize the service principal.

Verify that the Azure DevOps organization is connected to the same Microsoft Entra ID tenant, as service principals are supported only for organizations linked to Microsoft Entra ID. This can be confirmed under Azure DevOps > Organization Settings > Microsoft Entra.

Additionally, when adding the service principal in Azure DevOps > Organization Settings > Users > Add Users, the value that should be entered in the Users or Service Principals field is the Application (Client) ID: 933838e2-bec1-440f-a634-9363c82e5b6d. The Application Name, Object ID, and Enterprise Application Object ID should not be used for this step.

Please "Upvote the Answer" if this information helped you. This will help us and others in the community as well.
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Answer 1

The identifier you're using (933838e2-bec1-440f-a634-9363c82e5b6d) is the Application (client) ID documented for the Microsoft-published Graph Connector Federated Credential App used by the Azure DevOps Wiki Connector deployment process. According to the connector deployment guidance, this is the value that should be entered when granting the connector access to Azure DevOps projects. [learn.microsoft.com]

However, there is an important distinction between:

Application (client) ID -> 933838e2-bec1-440f-a634-9363c82e5b6d
Enterprise Application (Service Principal) Object ID -> tenant-specific GUID
App Registration Object ID -> different GUID again

The Azure DevOps Wiki Connector documentation refers to the Application ID, whereas general Azure DevOps service principal guidance commonly references the service principal identity (display name or service principal object). Because of this difference, the error message can be confusing.

What to Verify?

Confirm that the Graph Connector Federated Credential App exists under Microsoft Entra ID > Enterprise Applications.
Verify that its Application (client) ID is exactly : 933838e2-bec1-440f-a634-9363c82e5b6d
Ensure the Enterprise Application has been provisioned in the same Entra tenant associated with the Azure DevOps organisation.
In Azure DevOps Organisation Settings, confirm that Third-party application access via OAuth is enabled, as this is a documented prerequisite for the Wiki Connector deployment. [learn.microsoft.com]
If entering the Application ID results in the "Given email address is invalid" message, try locating the service principal by its display name (Graph Connector Federated Credential App) or by its Enterprise Application Object ID. This helps determine whether Azure DevOps is failing to resolve the application using the documented Application ID format.
Once added successfully, ensure the account has:
- Basic access level
- Access to the projects being indexed
- Membership in Project Readers (or an equivalent read-only group)
- Send email invitation unchecked [learn.microsoft.com]
- Additional Observation:

One detail not covered in the existing responses is that the error itself originates from Azure DevOps treating the supplied value as a user identifier during validation. If the Enterprise Application is present in Entra ID but cannot be resolved from Azure DevOps using the documented Application ID, that usually indicates an identity resolution issue between Azure DevOps and the connected Entra tenant rather than an incorrect connector App ID.

Since Microsoft's connector documentation explicitly references the Application ID above, I would first validate that the Enterprise Application exists and is visible in the same tenant connected to Azure DevOps, then test resolution using the service principal display name and Enterprise Application Object ID before assuming the identifier itself is incorrect.

Help make this community better for everyone: if this answer resolved your issue, please accept it or leave an upvote. If not, share more details in a comment so we can continue the discussion and find the right solution.

ＫＡＮＧＪＩＨＵＮ / KANG，JIHUN 20 Reputation points

2026-09-03T02:32:15.1366667+00:00

Hello,

Thank you for your detailed response and helpful suggestions.

I was able to resolve the issue. The account used to add the service principal to Azure DevOps was registered as a Guest user in the connected Microsoft Entra tenant.

Based on the behavior I observed, I believe the Guest account may not have had sufficient permissions to search for or resolve the existing service principal. This may have caused Azure DevOps to treat the application ID as an email address, resulting in the “Given email address is invalid” error.

After the account type was changed from Guest to Member in the Microsoft Entra admin center, I tried adding the service principal again. Searching by the display name “Graph Connector Federated Credential App” was still unsuccessful. However, searching by the documented Application (client) ID allowed Azure DevOps to resolve the service principal, and I was able to add it successfully.

I then created the Azure DevOps Wiki connector using Federated Credential authentication, and the crawl also completed successfully.

Thank you again for your guidance.