{ "schemaVersion": "1.0", "code": "650052", "name": null, "title": "AADSTS650052 fix: app needs a service your tenant lacks", "url": "https://brambrinkmeier.com/entra/aadsts/650052/", "alternates": { "markdown": "https://brambrinkmeier.com/entra/aadsts/650052.md", "json": "https://brambrinkmeier.com/api/aadsts/650052.json", "html": "https://brambrinkmeier.com/entra/aadsts/650052/" }, "description": "AADSTS650052: an API the app needs has no service principal in your tenant. Config gap, low attack value. An admin creates it or grants consent.", "summary": "AADSTS650052 means an app asked for access to an API (a service) that has no service principal in your tenant, so consent or sign-in can't go ahead. It is a configuration gap with low attack value. Users report it most with the Microsoft Advertising API. An admin fixes it by granting admin consent, which Microsoft says adds the missing app to the tenant.", "inMicrosoftReference": true, "unlistedChecked": null, "meaningText": "Microsoft's description:\n\n> The app needs access to a service `(\"{name}\")` that your organization `\"{organization}\"` hasn't subscribed to or enabled. Contact your IT Admin to review the configuration of your service subscriptions.\n\nMicrosoft gives this code no name. The \"service\" is an API the app wants permissions on: the **resource**. Microsoft's consent troubleshooting article says it plainly: *\"This error means the resource doesn't exist in your organization.\"*\n\n\"Doesn't exist\" means the resource has no **service principal** in your tenant. Microsoft explains that *\"A service principal must be created in each tenant where the application is used\"*. An API owned by Microsoft or by another company only becomes usable in your tenant once that object exists.\n\nUsers often see a different wording. In a Microsoft Q&A thread the message read *\"The app is trying to access a service '{guid}…'(Microsoft Advertising API Service) that your organization 'xxxxx' lacks a service principal for.\"* That version names the service's app ID, which is what an admin needs.\n\n**How it differs from [500011](https://brambrinkmeier.com/entra/aadsts/500011/):** both mean the resource has no service principal in the tenant, and Microsoft's consent article puts them under the same troubleshooting step. Our reading: 650052 tends to show up while the app asks for consent, and 500011 when it asks for a token. The root cause can be the same, but Microsoft's consent article gives different first steps: admin consent for 650052, and checking the resource identifier and tenant with the app owner for 500011. If the missing object is the **client** app rather than the API, see [700016](https://brambrinkmeier.com/entra/aadsts/700016/).", "sections": [ { "heading": "What does AADSTS650052 mean?", "text": "Microsoft's description:\n\n> The app needs access to a service `(\"{name}\")` that your organization `\"{organization}\"` hasn't subscribed to or enabled. Contact your IT Admin to review the configuration of your service subscriptions.\n\nMicrosoft gives this code no name. The \"service\" is an API the app wants permissions on: the **resource**. Microsoft's consent troubleshooting article says it plainly: *\"This error means the resource doesn't exist in your organization.\"*\n\n\"Doesn't exist\" means the resource has no **service principal** in your tenant. Microsoft explains that *\"A service principal must be created in each tenant where the application is used\"*. An API owned by Microsoft or by another company only becomes usable in your tenant once that object exists.\n\nUsers often see a different wording. In a Microsoft Q&A thread the message read *\"The app is trying to access a service '{guid}…'(Microsoft Advertising API Service) that your organization 'xxxxx' lacks a service principal for.\"* That version names the service's app ID, which is what an admin needs.\n\n**How it differs from [500011](https://brambrinkmeier.com/entra/aadsts/500011/):** both mean the resource has no service principal in the tenant, and Microsoft's consent article puts them under the same troubleshooting step. Our reading: 650052 tends to show up while the app asks for consent, and 500011 when it asks for a token. The root cause can be the same, but Microsoft's consent article gives different first steps: admin consent for 650052, and checking the resource identifier and tenant with the app owner for 500011. If the missing object is the **client** app rather than the API, see [700016](https://brambrinkmeier.com/entra/aadsts/700016/)." }, { "heading": "Is it an attack?", "text": "Not by itself. Nothing is granted. The request stops because the API has no object in your tenant to grant anything on.\n\n| Pattern | Likely meaning |\n|---|---|\n| 650052 when connecting a tool to Microsoft Advertising | The most common report. The Microsoft Advertising API Service has no service principal in the tenant. Users also report it in third-party connectors such as Fivetran. |\n| 650052 for an app built in-house or with Terraform | The app asks for a scope on a custom API that only exists in the developer's tenant. Users report this; the HashiCorp thread has no confirmed cause. |\n| 650052 for many users of one app, all at first sign-in | No admin has set the app up yet. Every user hits the same gap. |\n| 650052 for an unknown app asking for unusual APIs | Worth a look before you fix anything. Our interpretation: an admin who \"fixes\" the error by granting consent also grants whatever else the app asks for. |\n\nThe risk is in the fix, not in the error. Microsoft warns that granting admin consent *\"is a sensitive operation, potentially allowing the application's publisher access to significant portions of your organization's data\"*. Check what the app requests before you consent on everyone's behalf." }, { "heading": "How do I find it in my logs (KQL)?", "text": "Microsoft doesn't document which sign-in table 650052 lands in. Check where it lands in your workspace:\n\n```kusto\nunion withsource=SourceTable SigninLogs, AADNonInteractiveUserSignInLogs\n| where TimeGenerated > ago(30d)\n| where ResultType == \"650052\"\n| summarize Rows = count(), Users = dcount(UserPrincipalName) by SourceTable\n```\n\nWhich client apps hit it, for how many users, and the error text (which should name the missing service):\n\n```kusto\nSigninLogs\n| where TimeGenerated > ago(30d)\n| where ResultType == \"650052\"\n| summarize Rows = count(),\n Users = dcount(UserPrincipalName),\n Resources = make_set(ResourceDisplayName, 5),\n Messages = make_set(ResultDescription, 3),\n FirstSeen = min(TimeGenerated)\n by AppId, AppDisplayName\n| sort by Users desc\n```\n\nWhether `ResourceDisplayName` is filled for a resource that has no service principal isn't documented. If it is empty, read the service name and ID from `ResultDescription` or from the message the user saw. `ResultType` is a **string** column, so compare it with `\"650052\"`." }, { "heading": "How do I fix AADSTS650052?", "text": "**For the user:** you can't fix this yourself. Send your IT team the app name, and the service name and ID from the error message.\n\n**For developers:** check which APIs your app's registration requests. If you request a scope on your own API, that API needs a service principal in the customer's tenant too, created by consent or by their admin. Tell customers which app IDs they need. Ask only for the APIs you actually call.\n\n**For admins:**\n1. Read the service's app ID from the error. Check under **Enterprise applications** that it really is missing.\n2. Decide whether you want the app to have this access. Review the permissions the app requests.\n3. Create the missing service principal. Microsoft's steps (Cloud Application Administrator or Application Administrator):\n ```powershell\n Connect-MgGraph -Scopes \"Application.ReadWrite.All\"\n New-MgServicePrincipal -AppId \n ```\n The Azure CLI equivalent is `az ad sp create --id `.\n4. Or grant admin consent. Microsoft's consent article gives an admin consent URL for this error. Microsoft's article gives it as `https://login.microsoftonline.com//oauth2/authorize?response_type=code&client_id=&prompt=admin_consent`, where `client_id` is the resource the app is trying to reach, not your own app. Microsoft also says that *\"Granting tenant-wide admin consent to the application adds it to your tenant.\"*\n5. For Microsoft Advertising, an answer in the Microsoft Q&A thread suggests making sure at least one admin of your tenant is added to Microsoft Advertising and enabled for work accounts. One commenter suggests `New-MgServicePrincipal -AppId \"{app-id}\"`; nobody in the thread confirms either worked. Fivetran's knowledge base instead grants admin consent to the Microsoft Advertising app in the portal. Microsoft Learn doesn't document a fix for Microsoft Advertising specifically." } ], "microsoftWording": { "text": "The app needs access to a service `(\"{name}\")` that your organization `\"{organization}\"` hasn't subscribed to or enabled. Contact your IT Admin to review the configuration of your service subscriptions.", "source": "Microsoft's error code reference, as quoted on the page", "sourceUrl": "https://learn.microsoft.com/en-us/entra/identity-platform/reference-error-codes" }, "securityReading": { "category": { "id": "consent", "label": "Consent and app permissions" }, "kind": { "id": "config", "label": "Configuration error" }, "attackSignal": { "level": "low", "label": "Low: usually configuration or user error" }, "mitre": [], "tables": [], "isItAnAttack": "Not by itself. Nothing is granted. The request stops because the API has no object in your tenant to grant anything on.\n\n| Pattern | Likely meaning |\n|---|---|\n| 650052 when connecting a tool to Microsoft Advertising | The most common report. The Microsoft Advertising API Service has no service principal in the tenant. Users also report it in third-party connectors such as Fivetran. |\n| 650052 for an app built in-house or with Terraform | The app asks for a scope on a custom API that only exists in the developer's tenant. Users report this; the HashiCorp thread has no confirmed cause. |\n| 650052 for many users of one app, all at first sign-in | No admin has set the app up yet. Every user hits the same gap. |\n| 650052 for an unknown app asking for unusual APIs | Worth a look before you fix anything. Our interpretation: an admin who \"fixes\" the error by granting consent also grants whatever else the app asks for. |\n\nThe risk is in the fix, not in the error. Microsoft warns that granting admin consent *\"is a sensitive operation, potentially allowing the application's publisher access to significant portions of your organization's data\"*. Check what the app requests before you consent on everyone's behalf.", "conditionalAccess": null }, "kql": [ { "title": null, "leadIn": "Microsoft doesn't document which sign-in table 650052 lands in. Check where it lands in your workspace:", "query": "union withsource=SourceTable SigninLogs, AADNonInteractiveUserSignInLogs\n| where TimeGenerated > ago(30d)\n| where ResultType == \"650052\"\n| summarize Rows = count(), Users = dcount(UserPrincipalName) by SourceTable" }, { "title": null, "leadIn": "Which client apps hit it, for how many users, and the error text (which should name the missing service):", "query": "SigninLogs\n| where TimeGenerated > ago(30d)\n| where ResultType == \"650052\"\n| summarize Rows = count(),\n Users = dcount(UserPrincipalName),\n Resources = make_set(ResourceDisplayName, 5),\n Messages = make_set(ResultDescription, 3),\n FirstSeen = min(TimeGenerated)\n by AppId, AppDisplayName\n| sort by Users desc" } ], "kqlSectionText": "Microsoft doesn't document which sign-in table 650052 lands in. Check where it lands in your workspace:\n\n```kusto\nunion withsource=SourceTable SigninLogs, AADNonInteractiveUserSignInLogs\n| where TimeGenerated > ago(30d)\n| where ResultType == \"650052\"\n| summarize Rows = count(), Users = dcount(UserPrincipalName) by SourceTable\n```\n\nWhich client apps hit it, for how many users, and the error text (which should name the missing service):\n\n```kusto\nSigninLogs\n| where TimeGenerated > ago(30d)\n| where ResultType == \"650052\"\n| summarize Rows = count(),\n Users = dcount(UserPrincipalName),\n Resources = make_set(ResourceDisplayName, 5),\n Messages = make_set(ResultDescription, 3),\n FirstSeen = min(TimeGenerated)\n by AppId, AppDisplayName\n| sort by Users desc\n```\n\nWhether `ResourceDisplayName` is filled for a resource that has no service principal isn't documented. If it is empty, read the service name and ID from `ResultDescription` or from the message the user saw. `ResultType` is a **string** column, so compare it with `\"650052\"`.", "fix": { "short": "Admin: create the missing service principal from the app ID in the error (`New-MgServicePrincipal -AppId `) or grant admin consent, after checking what the app asks for. User: send IT the service name and ID from the error. Developer: check which APIs your app requests.", "steps": "**For the user:** you can't fix this yourself. Send your IT team the app name, and the service name and ID from the error message.\n\n**For developers:** check which APIs your app's registration requests. If you request a scope on your own API, that API needs a service principal in the customer's tenant too, created by consent or by their admin. Tell customers which app IDs they need. Ask only for the APIs you actually call.\n\n**For admins:**\n1. Read the service's app ID from the error. Check under **Enterprise applications** that it really is missing.\n2. Decide whether you want the app to have this access. Review the permissions the app requests.\n3. Create the missing service principal. Microsoft's steps (Cloud Application Administrator or Application Administrator):\n ```powershell\n Connect-MgGraph -Scopes \"Application.ReadWrite.All\"\n New-MgServicePrincipal -AppId \n ```\n The Azure CLI equivalent is `az ad sp create --id `.\n4. Or grant admin consent. Microsoft's consent article gives an admin consent URL for this error. Microsoft's article gives it as `https://login.microsoftonline.com//oauth2/authorize?response_type=code&client_id=&prompt=admin_consent`, where `client_id` is the resource the app is trying to reach, not your own app. Microsoft also says that *\"Granting tenant-wide admin consent to the application adds it to your tenant.\"*\n5. For Microsoft Advertising, an answer in the Microsoft Q&A thread suggests making sure at least one admin of your tenant is added to Microsoft Advertising and enabled for work accounts. One commenter suggests `New-MgServicePrincipal -AppId \"{app-id}\"`; nobody in the thread confirms either worked. Fivetran's knowledge base instead grants admin consent to the Microsoft Advertising app in the portal. Microsoft Learn doesn't document a fix for Microsoft Advertising specifically." }, "labReproduced": null, "labSectionText": null, "labRuns": [], "verification": "documentation", "related": [ "500011", "65001", "650056", "700016", "500014" ], "coveredBy": [], "sources": [ { "title": "Microsoft Entra authentication and authorization error codes", "url": "https://learn.microsoft.com/en-us/entra/identity-platform/reference-error-codes" }, { "title": "Troubleshoot consent issues in Microsoft Entra ID", "url": "https://learn.microsoft.com/en-us/troubleshoot/entra/entra-id/app-integration/troubleshoot-consent-issues" }, { "title": "Application and service principal objects in Microsoft Entra ID", "url": "https://learn.microsoft.com/entra/identity-platform/app-objects-and-service-principals" }, { "title": "Create an enterprise application from a multitenant application", "url": "https://learn.microsoft.com/en-gb/entra/identity/enterprise-apps/create-service-principal-cross-tenant" }, { "title": "Grant tenant-wide admin consent to an application", "url": "https://learn.microsoft.com/entra/identity/enterprise-apps/grant-admin-consent" }, { "title": "SigninLogs table reference (Azure Monitor)", "url": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/signinlogs" }, { "title": "Microsoft Q&A: Microsoft OAuth Error Code AADSTS650052 (user reports)", "url": "https://learn.microsoft.com/en-us/answers/questions/1145813/microsoft-oauth-error-code-aadsts650052" }, { "title": "Fivetran: AADSTS650052 Service Principal Missing (vendor KB)", "url": "https://fivetran.com/docs/connectors/applications/microsoft-advertising/troubleshooting/aadsts650052-service-principal-missing" }, { "title": "HashiCorp Discuss: AADSTS650052 when creating azuread_application (user report)", "url": "https://discuss.hashicorp.com/t/error-aadsts650052-when-creating-azuread-application/53485" } ], "published": "2026-11-01", "lastUpdated": "2026-11-01", "lastVerified": null, "license": "CC BY 4.0", "licenseUrl": "https://creativecommons.org/licenses/by/4.0/", "licenseNote": "CC BY 4.0 covers the author's own text and classification fields. Quoted Microsoft error wording belongs to Microsoft, is quoted with its source and can change.", "attribution": "Bram Brinkmeier, \"AADSTS650052 fix: app needs a service your tenant lacks\", https://brambrinkmeier.com/entra/aadsts/650052/ (CC BY 4.0)", "microsoftErrorLookup": "https://login.microsoftonline.com/error?code=650052" }