{
  "schemaVersion": "1.0",
  "code": "500011",
  "name": "InvalidResourceServicePrincipalNotFound",
  "title": "AADSTS500011: The resource principal was not found in the tenant",
  "url": "https://brambrinkmeier.com/entra/aadsts/500011/",
  "alternates": {
    "markdown": "https://brambrinkmeier.com/entra/aadsts/500011.md",
    "json": "https://brambrinkmeier.com/api/aadsts/500011.json",
    "html": "https://brambrinkmeier.com/entra/aadsts/500011/"
  },
  "description": "AADSTS500011: the API an app asked a token for has no service principal in the tenant. Wrong resource URL, tenant or consent. Low attack value. KQL.",
  "summary": "AADSTS500011 means an app asked for a token for an API (the resource) that has no service principal in the tenant the request went to. It is a configuration error: wrong resource URL or scope, wrong tenant, or an API nobody has provisioned or consented to. It has low attack value. Hunt it in SigninLogs and AADServicePrincipalSignInLogs.",
  "inMicrosoftReference": true,
  "unlistedChecked": null,
  "meaningText": "Microsoft's description:\n\n> **InvalidResourceServicePrincipalNotFound**: The resource principal named {name} wasn't found in the tenant named {tenant}. This can happen if the application hasn't been installed by the administrator of the tenant or consented to by any user in the tenant. You might have sent your authentication request to the wrong tenant. If you expect the app to be installed, you might need to provide administrator permissions to add it. Check with the developers of the resource and application to understand what the right setup for your tenant is.\n\nThe full message users see reads *\"AADSTS500011 - The resource principal named [resource URL] was not found in the tenant named [tenant ID]\"*.\n\nThe missing object is the **resource**: the API the app wants a token for. If the missing object is the client app itself, the error is [700016](https://brambrinkmeier.com/entra/aadsts/700016/) instead.\n\nMicrosoft explains why the object must exist: *\"A service principal must be created in each tenant where the application is used.\"* An API registered in another tenant has no service principal in yours until an admin provisions it or someone consents to it.",
  "sections": [
    {
      "heading": "What does AADSTS500011 mean?",
      "text": "Microsoft's description:\n\n> **InvalidResourceServicePrincipalNotFound**: The resource principal named {name} wasn't found in the tenant named {tenant}. This can happen if the application hasn't been installed by the administrator of the tenant or consented to by any user in the tenant. You might have sent your authentication request to the wrong tenant. If you expect the app to be installed, you might need to provide administrator permissions to add it. Check with the developers of the resource and application to understand what the right setup for your tenant is.\n\nThe full message users see reads *\"AADSTS500011 - The resource principal named [resource URL] was not found in the tenant named [tenant ID]\"*.\n\nThe missing object is the **resource**: the API the app wants a token for. If the missing object is the client app itself, the error is [700016](https://brambrinkmeier.com/entra/aadsts/700016/) instead.\n\nMicrosoft explains why the object must exist: *\"A service principal must be created in each tenant where the application is used.\"* An API registered in another tenant has no service principal in yours until an admin provisions it or someone consents to it."
    },
    {
      "heading": "Reproduced in the lab",
      "text": "On 25 October 2026 an automated lab run sent a token request for a scope on a resource that doesn't exist in my lab tenant. Entra returned `AADSTS500011` with this first line:\n\n> AADSTS500011: The resource principal named https://does-not-exist.brambrinkmeier.com was not found in the tenant named {tenant-id}.\n\nThat confirms the code and its wording at the token endpoint.\n\nThe same attempt in the lab tenant's sign-in log (Entra admin center, interactive user sign-ins), with identifiers left out:\n\n| Field | Value in the lab row |\n|---|---|\n| Status | Failure |\n| Sign-in error code | 500011 |\n| Failure reason | The resource principal named {name} was not found in the tenant named {tenant}. This can happen if the application has not been installed by the administrator of the tenant or consented to by any user in the tenant. |\n| Authentication requirement | Single-factor authentication |\n| Conditional Access | Not Applied |\n| User type | Member |\n\nThe log shows Microsoft's template text with placeholders; the actual resource name appears only in the error returned to the client, so keep the client's error message when you troubleshoot. The KQL below was run on the lab rows ([how](https://brambrinkmeier.com/methodology/)). The first query found both lab rows. The second query reads `AADServicePrincipalSignInLogs`, and the lab rows are user sign-ins, so it is not tested yet."
    },
    {
      "heading": "Is it an attack?",
      "text": "No. Microsoft's troubleshooting article lists four causes, all configuration:\n\n- *\"The resource application isn't provisioned by the administrator in the tenant.\"*\n- *\"The resource application isn't consented to by any user in the tenant.\"*\n- *\"The resource URL is not configured correctly.\"*\n- *\"The tenant ID is not correct.\"*\n\n| Pattern | Likely meaning |\n|---|---|\n| 500011 for one app, every user, starting at a deployment | A typo or wrong value in the resource URL or scope. Developer error. |\n| 500011 for a vendor's multitenant app after onboarding | The vendor's API was never provisioned or consented in your tenant. Setup step missing. |\n| 500011 naming a resource you don't recognise, from an app or IP you don't recognise | Someone asking your tenant for tokens to an API you never set up. Our interpretation, not a documented detection: the request failed, but the client and IP are worth a look. |"
    },
    {
      "heading": "How do I find it in my logs (KQL)?",
      "text": "User flows, grouped by client and the resource in the request:\n\n```kusto\nSigninLogs\n| where TimeGenerated > ago(7d)\n| where ResultType == \"500011\"\n| summarize Attempts = count(),\n            Users = dcount(UserPrincipalName),\n            Resources = make_set(ResourceIdentity, 10),\n            FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)\n          by AppDisplayName, AppId\n| sort by Attempts desc\n```\n\nApp-only flows (client credentials):\n\n```kusto\nAADServicePrincipalSignInLogs\n| where TimeGenerated > ago(7d)\n| where ResultType == \"500011\"\n| summarize Attempts = count(),\n            Resources = make_set(ResourceIdentity, 10),\n            IPs = make_set(IPAddress, 10)\n          by AppId, ServicePrincipalName\n| sort by Attempts desc\n```\n\nThe resource in the error doesn't exist in your tenant, so `ResourceIdentity` and `ResourceDisplayName` may be empty on these rows. That isn't documented either way. If they are, the resource URL is in the error text, so look at `ResultDescription` or open one event in the portal. Silent token requests for a missing resource can also land in `AADNonInteractiveUserSignInLogs`; swap the table name in the first query to check.\n\nFor app-only rows, confirm in your workspace that `ResultType` carries `\"500011\"` and not *\"Failure\"*. The Azure Monitor reference for `AADServicePrincipalSignInLogs` describes it as *\"Success or Failure\"*. If so, filter on `ResultSignature`."
    },
    {
      "heading": "How does Conditional Access affect it?",
      "text": "- 500011 happens before any Conditional Access decision on the resource. There is no resource in your tenant for a policy to target.\n- Once the resource is provisioned, it gets a service principal and appears as a target in Conditional Access like any other app. Check that your policies cover it before users start using it."
    },
    {
      "heading": "How do I fix AADSTS500011?",
      "text": "**For developers:**\n1. Compare the resource URL or scope in the error with the API's App ID URI or application ID. A wrong value here is the most common cause.\n2. Check that the request goes to the right tenant, not a tenant where the API was never set up.\n\n**For admins:**\n1. Look under **Enterprise applications** for the resource named in the error. If it isn't there, it was never provisioned in your tenant.\n2. If the API should be used, provision it and grant consent. For a vendor app, ask the vendor for their admin consent link. Microsoft documents an admin consent endpoint (`https://login.microsoftonline.com/{tenant}/v2.0/adminconsent`) that apps use to *\"grant permissions to an entire tenant\"*.\n3. Before consenting, check what the API's permissions allow. Provisioning a resource creates a service principal in your tenant that *\"defines what the app can actually do in the specific tenant\"*."
    }
  ],
  "microsoftWording": {
    "text": "**InvalidResourceServicePrincipalNotFound**: The resource principal named {name} wasn't found in the tenant named {tenant}. This can happen if the application hasn't been installed by the administrator of the tenant or consented to by any user in the tenant. You might have sent your authentication request to the wrong tenant. If you expect the app to be installed, you might need to provide administrator permissions to add it. Check with the developers of the resource and application to understand what the right setup for your tenant is.",
    "source": "Microsoft's error code reference, as quoted on the page",
    "sourceUrl": "https://learn.microsoft.com/en-us/entra/identity-platform/reference-error-codes"
  },
  "securityReading": {
    "category": {
      "id": "app-config",
      "label": "App configuration"
    },
    "kind": {
      "id": "failure",
      "label": "Failure"
    },
    "attackSignal": {
      "level": "low",
      "label": "Low: usually configuration or user error"
    },
    "mitre": [],
    "tables": [
      "SigninLogs",
      "AADServicePrincipalSignInLogs"
    ],
    "isItAnAttack": "No. Microsoft's troubleshooting article lists four causes, all configuration:\n\n- *\"The resource application isn't provisioned by the administrator in the tenant.\"*\n- *\"The resource application isn't consented to by any user in the tenant.\"*\n- *\"The resource URL is not configured correctly.\"*\n- *\"The tenant ID is not correct.\"*\n\n| Pattern | Likely meaning |\n|---|---|\n| 500011 for one app, every user, starting at a deployment | A typo or wrong value in the resource URL or scope. Developer error. |\n| 500011 for a vendor's multitenant app after onboarding | The vendor's API was never provisioned or consented in your tenant. Setup step missing. |\n| 500011 naming a resource you don't recognise, from an app or IP you don't recognise | Someone asking your tenant for tokens to an API you never set up. Our interpretation, not a documented detection: the request failed, but the client and IP are worth a look. |",
    "conditionalAccess": {
      "heading": "How does Conditional Access affect it?",
      "text": "- 500011 happens before any Conditional Access decision on the resource. There is no resource in your tenant for a policy to target.\n- Once the resource is provisioned, it gets a service principal and appears as a target in Conditional Access like any other app. Check that your policies cover it before users start using it."
    }
  },
  "kql": [
    {
      "title": null,
      "leadIn": "User flows, grouped by client and the resource in the request:",
      "query": "SigninLogs\n| where TimeGenerated > ago(7d)\n| where ResultType == \"500011\"\n| summarize Attempts = count(),\n            Users = dcount(UserPrincipalName),\n            Resources = make_set(ResourceIdentity, 10),\n            FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)\n          by AppDisplayName, AppId\n| sort by Attempts desc"
    },
    {
      "title": null,
      "leadIn": "App-only flows (client credentials):",
      "query": "AADServicePrincipalSignInLogs\n| where TimeGenerated > ago(7d)\n| where ResultType == \"500011\"\n| summarize Attempts = count(),\n            Resources = make_set(ResourceIdentity, 10),\n            IPs = make_set(IPAddress, 10)\n          by AppId, ServicePrincipalName\n| sort by Attempts desc"
    }
  ],
  "kqlSectionText": "User flows, grouped by client and the resource in the request:\n\n```kusto\nSigninLogs\n| where TimeGenerated > ago(7d)\n| where ResultType == \"500011\"\n| summarize Attempts = count(),\n            Users = dcount(UserPrincipalName),\n            Resources = make_set(ResourceIdentity, 10),\n            FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)\n          by AppDisplayName, AppId\n| sort by Attempts desc\n```\n\nApp-only flows (client credentials):\n\n```kusto\nAADServicePrincipalSignInLogs\n| where TimeGenerated > ago(7d)\n| where ResultType == \"500011\"\n| summarize Attempts = count(),\n            Resources = make_set(ResourceIdentity, 10),\n            IPs = make_set(IPAddress, 10)\n          by AppId, ServicePrincipalName\n| sort by Attempts desc\n```\n\nThe resource in the error doesn't exist in your tenant, so `ResourceIdentity` and `ResourceDisplayName` may be empty on these rows. That isn't documented either way. If they are, the resource URL is in the error text, so look at `ResultDescription` or open one event in the portal. Silent token requests for a missing resource can also land in `AADNonInteractiveUserSignInLogs`; swap the table name in the first query to check.\n\nFor app-only rows, confirm in your workspace that `ResultType` carries `\"500011\"` and not *\"Failure\"*. The Azure Monitor reference for `AADServicePrincipalSignInLogs` describes it as *\"Success or Failure\"*. If so, filter on `ResultSignature`.",
  "fix": {
    "short": "Developer: compare the resource URL or scope in the error with the API's App ID URI or application ID, and check the request goes to the right tenant. Admin: look for the resource under Enterprise applications; if it is missing and should be used, provision it and grant consent.",
    "steps": "**For developers:**\n1. Compare the resource URL or scope in the error with the API's App ID URI or application ID. A wrong value here is the most common cause.\n2. Check that the request goes to the right tenant, not a tenant where the API was never set up.\n\n**For admins:**\n1. Look under **Enterprise applications** for the resource named in the error. If it isn't there, it was never provisioned in your tenant.\n2. If the API should be used, provision it and grant consent. For a vendor app, ask the vendor for their admin consent link. Microsoft documents an admin consent endpoint (`https://login.microsoftonline.com/{tenant}/v2.0/adminconsent`) that apps use to *\"grant permissions to an entire tenant\"*.\n3. Before consenting, check what the API's permissions allow. Provisioning a resource creates a service principal in your tenant that *\"defines what the app can actually do in the specific tenant\"*."
  },
  "labReproduced": {
    "date": "2026-10-25",
    "method": "ROPC token request against a lab tenant",
    "scenario": "Resource does not exist in tenant",
    "message": "AADSTS500011: The resource principal named https://does-not-exist.brambrinkmeier.com was not found in the tenant named {tenant-id}.",
    "logCaptured": "2026-10-30",
    "kqlTested": "2026-10-30"
  },
  "labSectionText": "On 25 October 2026 an automated lab run sent a token request for a scope on a resource that doesn't exist in my lab tenant. Entra returned `AADSTS500011` with this first line:\n\n> AADSTS500011: The resource principal named https://does-not-exist.brambrinkmeier.com was not found in the tenant named {tenant-id}.\n\nThat confirms the code and its wording at the token endpoint.\n\nThe same attempt in the lab tenant's sign-in log (Entra admin center, interactive user sign-ins), with identifiers left out:\n\n| Field | Value in the lab row |\n|---|---|\n| Status | Failure |\n| Sign-in error code | 500011 |\n| Failure reason | The resource principal named {name} was not found in the tenant named {tenant}. This can happen if the application has not been installed by the administrator of the tenant or consented to by any user in the tenant. |\n| Authentication requirement | Single-factor authentication |\n| Conditional Access | Not Applied |\n| User type | Member |\n\nThe log shows Microsoft's template text with placeholders; the actual resource name appears only in the error returned to the client, so keep the client's error message when you troubleshoot. The KQL below was run on the lab rows ([how](https://brambrinkmeier.com/methodology/)). The first query found both lab rows. The second query reads `AADServicePrincipalSignInLogs`, and the lab rows are user sign-ins, so it is not tested yet.",
  "labRuns": [
    {
      "date": "2026-10-25",
      "run": null,
      "method": "ROPC token request against a lab tenant",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/38",
      "scenario": "Resource does not exist in tenant",
      "expected": "500011",
      "got": "500011",
      "matchedExpectation": true,
      "message": "AADSTS500011: The resource principal named https://does-not-exist.brambrinkmeier.com was not found in the tenant named {tenant-id}. Thi"
    },
    {
      "date": "2026-10-30",
      "run": "round 4",
      "method": "token-endpoint requests against a lab tenant",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/67",
      "scenario": "Resource does not exist in tenant",
      "expected": "500011",
      "got": "500011",
      "matchedExpectation": true,
      "message": "AADSTS500011: The resource principal named https://does-not-exist.brambrinkmeier.com was not found in the tenant named {tenant-id}. Thi"
    },
    {
      "date": "2026-10-30",
      "run": "round 5",
      "method": "token-endpoint requests against a lab tenant, using lab-created test apps",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/69",
      "scenario": "Resource does not exist in tenant",
      "expected": "500011",
      "got": "500011",
      "matchedExpectation": true,
      "message": "AADSTS500011: The resource principal named https://does-not-exist.brambrinkmeier.com was not found in the tenant named {tenant-id}. Thi"
    },
    {
      "date": "2026-10-30",
      "run": "round 5 (first attempt)",
      "method": "token-endpoint requests against a lab tenant",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/68",
      "scenario": "Resource does not exist in tenant",
      "expected": "500011",
      "got": "500011",
      "matchedExpectation": true,
      "message": "AADSTS500011: The resource principal named https://does-not-exist.brambrinkmeier.com was not found in the tenant named {tenant-id}. Thi"
    },
    {
      "date": "2026-10-30",
      "run": "round 6",
      "method": "token-endpoint requests against a lab tenant, using lab-created test apps",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/70",
      "scenario": "Resource does not exist in tenant",
      "expected": "500011",
      "got": "500011",
      "matchedExpectation": true,
      "message": "AADSTS500011: The resource principal named https://does-not-exist.brambrinkmeier.com was not found in the tenant named {tenant-id}. Thi"
    },
    {
      "date": "2026-10-30",
      "run": "round 7",
      "method": "token-endpoint requests against a lab tenant",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/71",
      "scenario": "Resource does not exist in tenant",
      "expected": "500011",
      "got": "500011",
      "matchedExpectation": true,
      "message": "AADSTS500011: The resource principal named https://does-not-exist.brambrinkmeier.com was not found in the tenant named {tenant-id}. Thi"
    },
    {
      "date": "2026-10-30",
      "run": null,
      "method": "ROPC and other token-endpoint requests against a lab tenant",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/66",
      "scenario": "Resource does not exist in tenant",
      "expected": "500011",
      "got": "500011",
      "matchedExpectation": true,
      "message": "AADSTS500011: The resource principal named https://does-not-exist.brambrinkmeier.com was not found in the tenant named {tenant-id}. Thi"
    },
    {
      "date": "2026-10-31",
      "run": "round 8",
      "method": "token-endpoint and device-code requests against a lab tenant",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/72",
      "scenario": "Resource does not exist in tenant",
      "expected": "500011",
      "got": "500011",
      "matchedExpectation": true,
      "message": "AADSTS500011: The resource principal named https://does-not-exist.brambrinkmeier.com was not found in the tenant named {tenant-id}. Thi"
    },
    {
      "date": "2026-10-31",
      "run": "round 9",
      "method": "token-endpoint and device-code requests against a lab tenant",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/73",
      "scenario": "Resource does not exist in tenant",
      "expected": "500011",
      "got": "500011",
      "matchedExpectation": true,
      "message": "AADSTS500011: The resource principal named https://does-not-exist.brambrinkmeier.com was not found in the tenant named {tenant-id}. Thi"
    }
  ],
  "verification": "lab-reproduced",
  "related": [
    "700016",
    "65001",
    "7000222",
    "50001",
    "50013",
    "65002",
    "65005",
    "90002",
    "90009",
    "90133",
    "500014",
    "501051",
    "650052",
    "650056",
    "901002",
    "7000112",
    "7000215",
    "7000218",
    "9002313",
    "9010010"
  ],
  "coveredBy": [],
  "sources": [
    {
      "title": "Microsoft Entra authentication and authorization error codes",
      "url": "https://learn.microsoft.com/en-us/entra/identity-platform/reference-error-codes"
    },
    {
      "title": "AADSTS500011 - Resource principal not found (Microsoft troubleshooting)",
      "url": "https://learn.microsoft.com/en-us/troubleshoot/entra/entra-id/app-integration/error-code-aadsts500011-resource-principal-not-found"
    },
    {
      "title": "Application and service principal objects in Microsoft Entra ID",
      "url": "https://learn.microsoft.com/en-us/entra/identity-platform/app-objects-and-service-principals"
    },
    {
      "title": "Admin consent on the Microsoft identity platform",
      "url": "https://learn.microsoft.com/en-us/entra/identity-platform/v2-admin-consent"
    },
    {
      "title": "SigninLogs table reference (Azure Monitor)",
      "url": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/signinlogs"
    },
    {
      "title": "AADServicePrincipalSignInLogs table reference (Azure Monitor)",
      "url": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/aadserviceprincipalsigninlogs"
    }
  ],
  "published": null,
  "lastUpdated": "2026-10-30",
  "lastVerified": null,
  "license": "CC BY 4.0",
  "licenseUrl": "https://creativecommons.org/licenses/by/4.0/",
  "licenseNote": "CC BY 4.0 covers the author's own text and classification fields. Quoted Microsoft error wording belongs to Microsoft, is quoted with its source and can change.",
  "attribution": "Bram Brinkmeier, \"AADSTS500011: The resource principal was not found in the tenant\", https://brambrinkmeier.com/entra/aadsts/500011/ (CC BY 4.0)",
  "microsoftErrorLookup": "https://login.microsoftonline.com/error?code=500011"
}