{ "schemaVersion": "1.0", "code": "50001", "name": "InvalidResource", "title": "AADSTS50001 fix: resource disabled or doesn't exist", "url": "https://brambrinkmeier.com/entra/aadsts/50001/", "alternates": { "markdown": "https://brambrinkmeier.com/entra/aadsts/50001.md", "json": "https://brambrinkmeier.com/api/aadsts/50001.json", "html": "https://brambrinkmeier.com/entra/aadsts/50001/" }, "description": "AADSTS50001: the token was for a resource that is disabled or doesn't exist. Usually a wrong resource URL. How it differs from 500011, plus KQL.", "summary": "AADSTS50001 means an app asked Microsoft Entra ID for a token to a resource (an API) that is disabled or doesn't exist. Usually the resource URL in the app's code or settings is wrong. Users report it in Nintex, Power BI and custom web APIs. It is a configuration error with low attack value. 500011 is the related code for a resource with no service principal in the tenant.", "inMicrosoftReference": true, "unlistedChecked": null, "meaningText": "Microsoft's description:\n\n> **InvalidResource**: The resource is disabled or doesn't exist. Check your app's code to ensure that you have specified the exact resource URL for the resource you're trying to access.\n\nThe **resource** is the API the app wants a token for: Microsoft Graph, SharePoint, or your own web API. Entra ID couldn't use it, because the identifier in the request matches nothing usable, or the resource is switched off.\n\nUsers post a message that names the resource and the tenant: *\"AADSTS50001: The application named was not found in the tenant named .\"*\n\n**50001 or 500011?** [500011](https://brambrinkmeier.com/entra/aadsts/500011/) is Microsoft's code for a resource with no service principal in the tenant: *\"The resource principal named {name} wasn't found in the tenant named {tenant}.\"* The messages users post for the two look alike. Microsoft's 50001 description adds one cause that 500011 doesn't have: a resource that exists but is **disabled**. Our reading: check the resource URL first for either code. If the resource's service principal exists but is switched off (**Enabled for users to sign-in?** set to No), Microsoft documents that as [500014](https://brambrinkmeier.com/entra/aadsts/500014/), so look there first. If the missing object is the client app, not the resource, the code is [700016](https://brambrinkmeier.com/entra/aadsts/700016/). Our reading is that a disabled client app returns [7000112](https://brambrinkmeier.com/entra/aadsts/7000112/).", "sections": [ { "heading": "What does AADSTS50001 mean?", "text": "Microsoft's description:\n\n> **InvalidResource**: The resource is disabled or doesn't exist. Check your app's code to ensure that you have specified the exact resource URL for the resource you're trying to access.\n\nThe **resource** is the API the app wants a token for: Microsoft Graph, SharePoint, or your own web API. Entra ID couldn't use it, because the identifier in the request matches nothing usable, or the resource is switched off.\n\nUsers post a message that names the resource and the tenant: *\"AADSTS50001: The application named was not found in the tenant named .\"*\n\n**50001 or 500011?** [500011](https://brambrinkmeier.com/entra/aadsts/500011/) is Microsoft's code for a resource with no service principal in the tenant: *\"The resource principal named {name} wasn't found in the tenant named {tenant}.\"* The messages users post for the two look alike. Microsoft's 50001 description adds one cause that 500011 doesn't have: a resource that exists but is **disabled**. Our reading: check the resource URL first for either code. If the resource's service principal exists but is switched off (**Enabled for users to sign-in?** set to No), Microsoft documents that as [500014](https://brambrinkmeier.com/entra/aadsts/500014/), so look there first. If the missing object is the client app, not the resource, the code is [700016](https://brambrinkmeier.com/entra/aadsts/700016/). Our reading is that a disabled client app returns [7000112](https://brambrinkmeier.com/entra/aadsts/7000112/)." }, { "heading": "Is it an attack?", "text": "No. A request for a resource that doesn't exist gets nothing back. Users report it in integrations with a wrong or unexpected resource:\n\n- **Nintex for Office 365**: the error appeared when documents were stored on a SharePoint subsite. The reported fix was to store them at the site collection level.\n- **A custom web API used from Power BI / Azure**: the resource named in the error was the web service's own domain, which wasn't registered in the tenant. One reply suggested the custom domain setup; a later commenter said that didn't help.\n\n| Pattern | Likely meaning |\n|---|---|\n| One app, every user, starting at a deployment or settings change | A wrong resource URL or App ID URI in the app's settings. Developer error. |\n| An app that worked starts failing for everyone, with no code change | Something changed on the resource side. Check the resource's enterprise app and app registration; if it was switched off, Microsoft documents that case as [500014](https://brambrinkmeier.com/entra/aadsts/500014/). |\n| 50001 naming a resource you don't recognise, from an app or IP you don't recognise | Someone asking your tenant for tokens to an API you never set up. Not a documented detection, but worth a look. |" }, { "heading": "How do I find it in my logs (KQL)?", "text": "Microsoft doesn't document which sign-in table 50001 lands in. Check your workspace:\n\n```kusto\nunion withsource=SourceTable SigninLogs, AADNonInteractiveUserSignInLogs, AADServicePrincipalSignInLogs\n| where TimeGenerated > ago(30d)\n| where ResultType == \"50001\"\n| summarize Rows = count(), Apps = dcount(AppId) by SourceTable\n```\n\nWhich client apps fail, and the resource they asked for:\n\n```kusto\nunion SigninLogs, AADNonInteractiveUserSignInLogs, AADServicePrincipalSignInLogs\n| where TimeGenerated > ago(30d)\n| where ResultType == \"50001\"\n| summarize Rows = count(),\n Resources = make_set(ResourceIdentity, 10),\n ResourceNames = make_set(ResourceDisplayName, 10),\n IPs = make_set(IPAddress, 10),\n FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)\n by AppName = coalesce(AppDisplayName, ServicePrincipalName), AppId\n| sort by Rows desc\n```\n\nWhen the resource doesn't exist, `ResourceIdentity` and `ResourceDisplayName` may be empty. Microsoft doesn't document this. If so, take the resource name from the error text the user or app received.\n\nRecent changes to apps, to find a resource that was disabled. Microsoft lists **Update service principal** and **Update application** as audit activities. Our assumption: switching off **Enabled for users to sign-in?** or deactivating an app registration is recorded under one of them.\n\n```kusto\nAuditLogs\n| where TimeGenerated > ago(30d)\n| where Category == \"ApplicationManagement\"\n| where OperationName in (\"Update service principal\", \"Update application\")\n| extend Target = tostring(TargetResources[0].displayName),\n ByUser = tostring(InitiatedBy.user.userPrincipalName)\n| project TimeGenerated, OperationName, Target, ByUser, Result\n| sort by TimeGenerated desc\n```\n\nFor app-only rows, check in your workspace that `ResultType` carries `\"50001\"` and not *\"Failure\"*. `ResultType` is a **string** column, so compare it with `\"50001\"`." }, { "heading": "How do I fix AADSTS50001?", "text": "**For the user:** you can't fix this. Send IT the app name and the full error, including the resource name.\n\n**For developers:**\n1. Compare the resource URL or scope in your code or settings with the API's identifier. Microsoft's description says to *\"ensure that you have specified the exact resource URL for the resource you're trying to access.\"*\n2. For your own API, check that its App ID URI is registered and that the client asks for exactly that value.\n\n**For admins:**\n1. Find the resource under **Enterprise applications**. If it isn't there, treat it like [500011](https://brambrinkmeier.com/entra/aadsts/500011/): the resource was never set up in your tenant.\n2. Open its **Properties** and check **Enabled for users to sign-in?**. Microsoft: when it is **No**, *\"Tokens aren't issued for the application.\"* Microsoft documents a disabled resource service principal as [500014](https://brambrinkmeier.com/entra/aadsts/500014/), so if you find it switched off, read that page.\n3. Check **App registrations** > **Deactivated applications**. Microsoft says a deactivated app *\"immediately stops receiving new access tokens\"*, but doesn't say what other apps get when they ask for a token to its API. To undo it, select the app and **Reactivate**.\n4. Only re-enable a resource if disabling it was a mistake. Someone may have switched it off on purpose; the third query shows who changed it." } ], "microsoftWording": { "text": "**InvalidResource**: The resource is disabled or doesn't exist. Check your app's code to ensure that you have specified the exact resource URL for the resource you're trying to access.", "source": "Microsoft's error code reference, as quoted on the page", "sourceUrl": "https://learn.microsoft.com/en-us/entra/identity-platform/reference-error-codes" }, "securityReading": { "category": { "id": "app-config", "label": "App configuration" }, "kind": { "id": "failure", "label": "Failure" }, "attackSignal": { "level": "low", "label": "Low: usually configuration or user error" }, "mitre": [], "tables": [], "isItAnAttack": "No. A request for a resource that doesn't exist gets nothing back. Users report it in integrations with a wrong or unexpected resource:\n\n- **Nintex for Office 365**: the error appeared when documents were stored on a SharePoint subsite. The reported fix was to store them at the site collection level.\n- **A custom web API used from Power BI / Azure**: the resource named in the error was the web service's own domain, which wasn't registered in the tenant. One reply suggested the custom domain setup; a later commenter said that didn't help.\n\n| Pattern | Likely meaning |\n|---|---|\n| One app, every user, starting at a deployment or settings change | A wrong resource URL or App ID URI in the app's settings. Developer error. |\n| An app that worked starts failing for everyone, with no code change | Something changed on the resource side. Check the resource's enterprise app and app registration; if it was switched off, Microsoft documents that case as [500014](https://brambrinkmeier.com/entra/aadsts/500014/). |\n| 50001 naming a resource you don't recognise, from an app or IP you don't recognise | Someone asking your tenant for tokens to an API you never set up. Not a documented detection, but worth a look. |", "conditionalAccess": null }, "kql": [ { "title": null, "leadIn": "Microsoft doesn't document which sign-in table 50001 lands in. Check your workspace:", "query": "union withsource=SourceTable SigninLogs, AADNonInteractiveUserSignInLogs, AADServicePrincipalSignInLogs\n| where TimeGenerated > ago(30d)\n| where ResultType == \"50001\"\n| summarize Rows = count(), Apps = dcount(AppId) by SourceTable" }, { "title": null, "leadIn": "Which client apps fail, and the resource they asked for:", "query": "union SigninLogs, AADNonInteractiveUserSignInLogs, AADServicePrincipalSignInLogs\n| where TimeGenerated > ago(30d)\n| where ResultType == \"50001\"\n| summarize Rows = count(),\n Resources = make_set(ResourceIdentity, 10),\n ResourceNames = make_set(ResourceDisplayName, 10),\n IPs = make_set(IPAddress, 10),\n FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)\n by AppName = coalesce(AppDisplayName, ServicePrincipalName), AppId\n| sort by Rows desc" }, { "title": null, "leadIn": "Recent changes to apps, to find a resource that was disabled. Microsoft lists **Update service principal** and **Update application** as audit activities. Our assumption: switching off **Enabled for users to sign-in?** or deactivating an app registration is recorded under one of them.", "query": "AuditLogs\n| where TimeGenerated > ago(30d)\n| where Category == \"ApplicationManagement\"\n| where OperationName in (\"Update service principal\", \"Update application\")\n| extend Target = tostring(TargetResources[0].displayName),\n ByUser = tostring(InitiatedBy.user.userPrincipalName)\n| project TimeGenerated, OperationName, Target, ByUser, Result\n| sort by TimeGenerated desc" } ], "kqlSectionText": "Microsoft doesn't document which sign-in table 50001 lands in. Check your workspace:\n\n```kusto\nunion withsource=SourceTable SigninLogs, AADNonInteractiveUserSignInLogs, AADServicePrincipalSignInLogs\n| where TimeGenerated > ago(30d)\n| where ResultType == \"50001\"\n| summarize Rows = count(), Apps = dcount(AppId) by SourceTable\n```\n\nWhich client apps fail, and the resource they asked for:\n\n```kusto\nunion SigninLogs, AADNonInteractiveUserSignInLogs, AADServicePrincipalSignInLogs\n| where TimeGenerated > ago(30d)\n| where ResultType == \"50001\"\n| summarize Rows = count(),\n Resources = make_set(ResourceIdentity, 10),\n ResourceNames = make_set(ResourceDisplayName, 10),\n IPs = make_set(IPAddress, 10),\n FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)\n by AppName = coalesce(AppDisplayName, ServicePrincipalName), AppId\n| sort by Rows desc\n```\n\nWhen the resource doesn't exist, `ResourceIdentity` and `ResourceDisplayName` may be empty. Microsoft doesn't document this. If so, take the resource name from the error text the user or app received.\n\nRecent changes to apps, to find a resource that was disabled. Microsoft lists **Update service principal** and **Update application** as audit activities. Our assumption: switching off **Enabled for users to sign-in?** or deactivating an app registration is recorded under one of them.\n\n```kusto\nAuditLogs\n| where TimeGenerated > ago(30d)\n| where Category == \"ApplicationManagement\"\n| where OperationName in (\"Update service principal\", \"Update application\")\n| extend Target = tostring(TargetResources[0].displayName),\n ByUser = tostring(InitiatedBy.user.userPrincipalName)\n| project TimeGenerated, OperationName, Target, ByUser, Result\n| sort by TimeGenerated desc\n```\n\nFor app-only rows, check in your workspace that `ResultType` carries `\"50001\"` and not *\"Failure\"*. `ResultType` is a **string** column, so compare it with `\"50001\"`.", "fix": { "short": "Developer: check that the resource URL in your code or app settings exactly matches the API's identifier. Admin: find the resource under Enterprise applications and check it exists in the tenant. If it is switched off, that case is documented as AADSTS500014.", "steps": "**For the user:** you can't fix this. Send IT the app name and the full error, including the resource name.\n\n**For developers:**\n1. Compare the resource URL or scope in your code or settings with the API's identifier. Microsoft's description says to *\"ensure that you have specified the exact resource URL for the resource you're trying to access.\"*\n2. For your own API, check that its App ID URI is registered and that the client asks for exactly that value.\n\n**For admins:**\n1. Find the resource under **Enterprise applications**. If it isn't there, treat it like [500011](https://brambrinkmeier.com/entra/aadsts/500011/): the resource was never set up in your tenant.\n2. Open its **Properties** and check **Enabled for users to sign-in?**. Microsoft: when it is **No**, *\"Tokens aren't issued for the application.\"* Microsoft documents a disabled resource service principal as [500014](https://brambrinkmeier.com/entra/aadsts/500014/), so if you find it switched off, read that page.\n3. Check **App registrations** > **Deactivated applications**. Microsoft says a deactivated app *\"immediately stops receiving new access tokens\"*, but doesn't say what other apps get when they ask for a token to its API. To undo it, select the app and **Reactivate**.\n4. Only re-enable a resource if disabling it was a mistake. Someone may have switched it off on purpose; the third query shows who changed it." }, "labReproduced": null, "labSectionText": null, "labRuns": [], "verification": "documentation", "related": [ "500011", "500014", "700016", "7000112", "65005" ], "coveredBy": [], "sources": [ { "title": "Microsoft Entra authentication and authorization error codes", "url": "https://learn.microsoft.com/entra/identity-platform/reference-error-codes" }, { "title": "Properties of an enterprise application", "url": "https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/application-properties" }, { "title": "Deactivate an app registration", "url": "https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/deactivate-app-registration" }, { "title": "Microsoft Entra audit log categories and activities", "url": "https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities" }, { "title": "Error AADSTS50001: the application named was not found in the tenant (Nintex community, user report)", "url": "https://community.nintex.com/nintex-for-office-365-68/error-aadsts50001-the-application-named-was-not-found-in-the-tenant-named-16156" }, { "title": "AADSTS50001 error on Web API with Azure AD (Fabric community, user report)", "url": "https://community.fabric.microsoft.com/t5/Desktop/AADSTS50001-error-on-Web-API-with-Azure-AD/m-p/83032" } ], "published": "2026-11-01", "lastUpdated": "2026-11-01", "lastVerified": null, "license": "CC BY 4.0", "licenseUrl": "https://creativecommons.org/licenses/by/4.0/", "licenseNote": "CC BY 4.0 covers the author's own text and classification fields. Quoted Microsoft error wording belongs to Microsoft, is quoted with its source and can change.", "attribution": "Bram Brinkmeier, \"AADSTS50001 fix: resource disabled or doesn't exist\", https://brambrinkmeier.com/entra/aadsts/50001/ (CC BY 4.0)", "microsoftErrorLookup": "https://login.microsoftonline.com/error?code=50001" }