{
  "schemaVersion": "1.0",
  "code": "7000112",
  "name": "UnauthorizedClientApplicationDisabled",
  "title": "AADSTS7000112: The application is disabled (fix)",
  "url": "https://brambrinkmeier.com/entra/aadsts/7000112/",
  "alternates": {
    "markdown": "https://brambrinkmeier.com/entra/aadsts/7000112.md",
    "json": "https://brambrinkmeier.com/api/aadsts/7000112.json",
    "html": "https://brambrinkmeier.com/entra/aadsts/7000112/"
  },
  "description": "AADSTS7000112: the app's service principal is disabled, so no tokens are issued. Find who disabled it in the audit log before re-enabling. KQL.",
  "summary": "AADSTS7000112 means the app's service principal is disabled in the tenant, so Microsoft Entra ID won't issue tokens for it. Often an admin did it on purpose, for example to cut off a suspicious app. If it hits a Microsoft app such as Exchange Online, sign-ins break tenant-wide. Find who disabled it in the audit log and re-enable it only if that was a mistake.",
  "inMicrosoftReference": true,
  "unlistedChecked": null,
  "meaningText": "Microsoft's description:\n\n> **UnauthorizedClientApplicationDisabled**: The application is disabled.\n\nThe app has a service principal (an enterprise application) in the tenant, and that service principal is switched off. In the Entra admin center this is the **Enabled for users to sign-in?** property. Microsoft describes what **No** does:\n\n> If this option is set to No, then no users are able to sign in to the application, even if they're assigned to it. Tokens aren't issued for the application. This setting not only prevents users from signing in but also restricts service principals from accessing the application using application permissions.\n\nIn Microsoft Graph the same switch is the service principal's `accountEnabled` property: *\"If set to `false`, then no users are able to sign in to this app, even if they're assigned to it.\"* Our reading is that 7000112 is what a client sees when it hits that switch. Microsoft's description doesn't say so in those words.\n\nThe error message usually names the app. Microsoft's Exchange Online troubleshooting article shows this example: *\"AADSTS7000112: Application '00000002-0000-0ff1-ce00-000000000000'(Office 365 Exchange Online) is disabled.\"*\n\n### Disabled by Microsoft\nAn app can also be disabled from Microsoft's side. Graph has a separate property, `disabledByMicrosoftStatus`, which *\"Specifies whether Microsoft has disabled the registered application\"*, with the value `DisabledDueToViolationOfServicesAgreement` for *\"suspicious, abusive, or malicious activity, or a violation of the Microsoft Services Agreement\"*. That property sits on the app registration, in the publisher's tenant. Whether a Microsoft-disabled app returns 7000112 or a different code in your tenant isn't documented.",
  "sections": [
    {
      "heading": "What does AADSTS7000112 mean?",
      "text": "Microsoft's description:\n\n> **UnauthorizedClientApplicationDisabled**: The application is disabled.\n\nThe app has a service principal (an enterprise application) in the tenant, and that service principal is switched off. In the Entra admin center this is the **Enabled for users to sign-in?** property. Microsoft describes what **No** does:\n\n> If this option is set to No, then no users are able to sign in to the application, even if they're assigned to it. Tokens aren't issued for the application. This setting not only prevents users from signing in but also restricts service principals from accessing the application using application permissions.\n\nIn Microsoft Graph the same switch is the service principal's `accountEnabled` property: *\"If set to `false`, then no users are able to sign in to this app, even if they're assigned to it.\"* Our reading is that 7000112 is what a client sees when it hits that switch. Microsoft's description doesn't say so in those words.\n\nThe error message usually names the app. Microsoft's Exchange Online troubleshooting article shows this example: *\"AADSTS7000112: Application '00000002-0000-0ff1-ce00-000000000000'(Office 365 Exchange Online) is disabled.\"*\n\n### Disabled by Microsoft\nAn app can also be disabled from Microsoft's side. Graph has a separate property, `disabledByMicrosoftStatus`, which *\"Specifies whether Microsoft has disabled the registered application\"*, with the value `DisabledDueToViolationOfServicesAgreement` for *\"suspicious, abusive, or malicious activity, or a violation of the Microsoft Services Agreement\"*. That property sits on the app registration, in the publisher's tenant. Whether a Microsoft-disabled app returns 7000112 or a different code in your tenant isn't documented."
    },
    {
      "heading": "Reproduced in the lab",
      "text": "On 30 October 2026 an automated lab run registered an app, created its service principal, set `accountEnabled` to `false` on that service principal, and then signed a test user in through it. Entra returned `AADSTS7000112`:\n\n> AADSTS7000112: Application '<app id>'(<app name>) is disabled.\n\nThat confirms the cause directly: the **service principal**, the enterprise application object in your tenant, is the thing that is disabled. The app registration itself was untouched and still existed. The message names the application ID and the display name, so you can go straight to Enterprise applications and look at that object's **Enabled for users to sign-in?** setting.\n\nThe sign-in log row isn't captured yet; see [how pages are checked](https://brambrinkmeier.com/methodology/).\n\nIn the lab tenant's sign-in logs the row appears under **User sign-ins (interactive)**, Status **Failure**, Conditional Access **Not Applied**. The **Application** column shows the disabled app's own display name, not the sign-in client, so the row points straight at the application you need to re-enable."
    },
    {
      "heading": "Is it an attack?",
      "text": "The error itself is not. It is a block working. What matters is who disabled the app and why.\n\n| Pattern | Likely meaning |\n|---|---|\n| 7000112 for an app an admin disabled during an incident | Working as intended. The app is cut off. |\n| 7000112 for a suspicious app after you disabled it, from IPs you don't own | Possibly the app's operator, or tooling using its tokens, is still trying (unconfirmed). Each row gives you an IP and a time. Worth recording, not worth re-enabling. |\n| 7000112 for a Microsoft first-party app (Exchange Online, Teams, SharePoint) | Someone disabled a Microsoft service principal in your tenant. Microsoft's Exchange Online article shows this breaks Microsoft 365 sign-in with *\"Sorry, but we're having trouble signing you in.\"* Check the audit log for who did it. |\n| 7000112 for a line-of-business app nobody remembers disabling | A clean-up job, a script, or an admin who thought the app was unused. Check the audit log before re-enabling. |\n\nA disabled Microsoft first-party service principal is worth a second look. Our reading, not a Microsoft statement: disabling Exchange Online or another core service principal is a quick way to cause a tenant-wide outage, so if nobody on your team did it on purpose, treat the account that did as suspect until you know.\n\nIf you disabled an app as part of a consent phishing response, see the [consent phishing investigation guide](https://brambrinkmeier.com/guides/investigate-consent-phishing-entra-id/), which treats 7000112 as one of the codes to watch afterwards."
    },
    {
      "heading": "How do I find it in my logs (KQL)?",
      "text": "Microsoft doesn't document which sign-in table 7000112 lands in. A disabled app blocks both users and app-only access, so it can appear in all three. Check where it lands in your workspace:\n\n```kusto\nunion withsource=SourceTable SigninLogs, AADNonInteractiveUserSignInLogs, AADServicePrincipalSignInLogs\n| where TimeGenerated > ago(7d)\n| where ResultType == \"7000112\"\n| summarize Rows = count(), Apps = dcount(AppId) by SourceTable\n```\n\nWhich disabled apps are still being used, by how many users, and from where:\n\n```kusto\nunion SigninLogs, AADNonInteractiveUserSignInLogs, AADServicePrincipalSignInLogs\n| where TimeGenerated > ago(7d)\n| where ResultType == \"7000112\"\n| summarize Rows = count(),\n            Users = dcount(UserPrincipalName),\n            IPs = dcount(IPAddress),\n            SampleIPs = make_set(IPAddress, 10),\n            Resources = make_set(ResourceDisplayName, 5),\n            FirstSeen = min(TimeGenerated)\n          by AppId, AppDisplayName = coalesce(AppDisplayName, ServicePrincipalName)\n| sort by Users desc\n```\n\nWho changed a service principal, and when. Microsoft's audit log reference lists **Update service principal** in the ApplicationManagement category. Disabling an enterprise app is likely logged as that activity; Microsoft doesn't say so:\n\n```kusto\nAuditLogs\n| where TimeGenerated > ago(30d)\n| where Category == \"ApplicationManagement\"\n| where OperationName == \"Update service principal\"\n| mv-expand Target = TargetResources\n| mv-expand Prop = Target.modifiedProperties\n| where tostring(Prop.displayName) == \"AccountEnabled\"\n| project TimeGenerated,\n          App = tostring(Target.displayName),\n          ServicePrincipalId = tostring(Target.id),\n          OldValue = tostring(Prop.oldValue),\n          NewValue = tostring(Prop.newValue),\n          ByUser = tostring(InitiatedBy.user.userPrincipalName),\n          ByApp = tostring(InitiatedBy.app.displayName)\n| sort by TimeGenerated desc\n```\n\nThe audit activity name comes from Microsoft's audit log reference. The modified property name `AccountEnabled` is our assumption based on the Graph property, not checked against Microsoft documentation. If the query returns nothing, drop the `AccountEnabled` line and read the `modifiedProperties` of the rows yourself. Non-interactive and service principal sign-in rows are aggregated, so row counts there are not request counts. `ResultType` is a **string** column, so compare it with `\"7000112\"`."
    },
    {
      "heading": "How does Conditional Access affect it?",
      "text": "- 7000112 is not a Conditional Access block. A disabled app gets no tokens at all, whatever your policies say.\n- Don't confuse it with [53003](https://brambrinkmeier.com/entra/aadsts/53003/), which is a Conditional Access block. The fix and the owner are different."
    },
    {
      "heading": "How do I fix AADSTS7000112?",
      "text": "**For the user:** you can't fix this yourself. The app is turned off in your organisation. Tell your IT team which app showed the error.\n\n**For developers:** if your app is multi-tenant and a customer gets 7000112, the customer's admin disabled your app's service principal in their tenant. You can't re-enable it from your side. Ask them to.\n\n**For admins:**\n1. Find out who disabled it and why with the audit log query, before changing anything. If it was disabled during an incident, leave it disabled.\n2. If it was a mistake: in **Enterprise applications** > the app > **Properties**, set **Enabled for users to sign-in?** to **Yes**. In Microsoft Graph, set `accountEnabled` to `true` on the service principal.\n3. For Exchange Online, Microsoft's article gives the steps with the old MSOnline module (`Set-MsolServicePrincipal -AccountEnabled $true` on app ID `00000002-0000-0ff1-ce00-000000000000`). That article notes the MSOnline and Azure AD modules are deprecated and points to Microsoft Graph PowerShell instead.\n4. If the account that disabled a Microsoft first-party app can't explain it, investigate that account like any other suspicious admin action.\n5. If you want to block an app permanently, disabling is fine. Remove it later once nothing legitimate depends on it. After removal the code a client gets will probably change, to [700016](https://brambrinkmeier.com/entra/aadsts/700016/) or 700011; which one isn't documented."
    }
  ],
  "microsoftWording": {
    "text": "**UnauthorizedClientApplicationDisabled**: The application is disabled.",
    "source": "Microsoft's error code reference, as quoted on the page",
    "sourceUrl": "https://learn.microsoft.com/en-us/entra/identity-platform/reference-error-codes"
  },
  "securityReading": {
    "category": {
      "id": "app-config",
      "label": "App configuration"
    },
    "kind": {
      "id": "config",
      "label": "Configuration error"
    },
    "attackSignal": {
      "level": "low",
      "label": "Low: usually configuration or user error"
    },
    "mitre": [],
    "tables": [],
    "isItAnAttack": "The error itself is not. It is a block working. What matters is who disabled the app and why.\n\n| Pattern | Likely meaning |\n|---|---|\n| 7000112 for an app an admin disabled during an incident | Working as intended. The app is cut off. |\n| 7000112 for a suspicious app after you disabled it, from IPs you don't own | Possibly the app's operator, or tooling using its tokens, is still trying (unconfirmed). Each row gives you an IP and a time. Worth recording, not worth re-enabling. |\n| 7000112 for a Microsoft first-party app (Exchange Online, Teams, SharePoint) | Someone disabled a Microsoft service principal in your tenant. Microsoft's Exchange Online article shows this breaks Microsoft 365 sign-in with *\"Sorry, but we're having trouble signing you in.\"* Check the audit log for who did it. |\n| 7000112 for a line-of-business app nobody remembers disabling | A clean-up job, a script, or an admin who thought the app was unused. Check the audit log before re-enabling. |\n\nA disabled Microsoft first-party service principal is worth a second look. Our reading, not a Microsoft statement: disabling Exchange Online or another core service principal is a quick way to cause a tenant-wide outage, so if nobody on your team did it on purpose, treat the account that did as suspect until you know.\n\nIf you disabled an app as part of a consent phishing response, see the [consent phishing investigation guide](https://brambrinkmeier.com/guides/investigate-consent-phishing-entra-id/), which treats 7000112 as one of the codes to watch afterwards.",
    "conditionalAccess": {
      "heading": "How does Conditional Access affect it?",
      "text": "- 7000112 is not a Conditional Access block. A disabled app gets no tokens at all, whatever your policies say.\n- Don't confuse it with [53003](https://brambrinkmeier.com/entra/aadsts/53003/), which is a Conditional Access block. The fix and the owner are different."
    }
  },
  "kql": [
    {
      "title": null,
      "leadIn": "Microsoft doesn't document which sign-in table 7000112 lands in. A disabled app blocks both users and app-only access, so it can appear in all three. Check where it lands in your workspace:",
      "query": "union withsource=SourceTable SigninLogs, AADNonInteractiveUserSignInLogs, AADServicePrincipalSignInLogs\n| where TimeGenerated > ago(7d)\n| where ResultType == \"7000112\"\n| summarize Rows = count(), Apps = dcount(AppId) by SourceTable"
    },
    {
      "title": null,
      "leadIn": "Which disabled apps are still being used, by how many users, and from where:",
      "query": "union SigninLogs, AADNonInteractiveUserSignInLogs, AADServicePrincipalSignInLogs\n| where TimeGenerated > ago(7d)\n| where ResultType == \"7000112\"\n| summarize Rows = count(),\n            Users = dcount(UserPrincipalName),\n            IPs = dcount(IPAddress),\n            SampleIPs = make_set(IPAddress, 10),\n            Resources = make_set(ResourceDisplayName, 5),\n            FirstSeen = min(TimeGenerated)\n          by AppId, AppDisplayName = coalesce(AppDisplayName, ServicePrincipalName)\n| sort by Users desc"
    },
    {
      "title": null,
      "leadIn": "Who changed a service principal, and when. Microsoft's audit log reference lists **Update service principal** in the ApplicationManagement category. Disabling an enterprise app is likely logged as that activity; Microsoft doesn't say so:",
      "query": "AuditLogs\n| where TimeGenerated > ago(30d)\n| where Category == \"ApplicationManagement\"\n| where OperationName == \"Update service principal\"\n| mv-expand Target = TargetResources\n| mv-expand Prop = Target.modifiedProperties\n| where tostring(Prop.displayName) == \"AccountEnabled\"\n| project TimeGenerated,\n          App = tostring(Target.displayName),\n          ServicePrincipalId = tostring(Target.id),\n          OldValue = tostring(Prop.oldValue),\n          NewValue = tostring(Prop.newValue),\n          ByUser = tostring(InitiatedBy.user.userPrincipalName),\n          ByApp = tostring(InitiatedBy.app.displayName)\n| sort by TimeGenerated desc"
    }
  ],
  "kqlSectionText": "Microsoft doesn't document which sign-in table 7000112 lands in. A disabled app blocks both users and app-only access, so it can appear in all three. Check where it lands in your workspace:\n\n```kusto\nunion withsource=SourceTable SigninLogs, AADNonInteractiveUserSignInLogs, AADServicePrincipalSignInLogs\n| where TimeGenerated > ago(7d)\n| where ResultType == \"7000112\"\n| summarize Rows = count(), Apps = dcount(AppId) by SourceTable\n```\n\nWhich disabled apps are still being used, by how many users, and from where:\n\n```kusto\nunion SigninLogs, AADNonInteractiveUserSignInLogs, AADServicePrincipalSignInLogs\n| where TimeGenerated > ago(7d)\n| where ResultType == \"7000112\"\n| summarize Rows = count(),\n            Users = dcount(UserPrincipalName),\n            IPs = dcount(IPAddress),\n            SampleIPs = make_set(IPAddress, 10),\n            Resources = make_set(ResourceDisplayName, 5),\n            FirstSeen = min(TimeGenerated)\n          by AppId, AppDisplayName = coalesce(AppDisplayName, ServicePrincipalName)\n| sort by Users desc\n```\n\nWho changed a service principal, and when. Microsoft's audit log reference lists **Update service principal** in the ApplicationManagement category. Disabling an enterprise app is likely logged as that activity; Microsoft doesn't say so:\n\n```kusto\nAuditLogs\n| where TimeGenerated > ago(30d)\n| where Category == \"ApplicationManagement\"\n| where OperationName == \"Update service principal\"\n| mv-expand Target = TargetResources\n| mv-expand Prop = Target.modifiedProperties\n| where tostring(Prop.displayName) == \"AccountEnabled\"\n| project TimeGenerated,\n          App = tostring(Target.displayName),\n          ServicePrincipalId = tostring(Target.id),\n          OldValue = tostring(Prop.oldValue),\n          NewValue = tostring(Prop.newValue),\n          ByUser = tostring(InitiatedBy.user.userPrincipalName),\n          ByApp = tostring(InitiatedBy.app.displayName)\n| sort by TimeGenerated desc\n```\n\nThe audit activity name comes from Microsoft's audit log reference. The modified property name `AccountEnabled` is our assumption based on the Graph property, not checked against Microsoft documentation. If the query returns nothing, drop the `AccountEnabled` line and read the `modifiedProperties` of the rows yourself. Non-interactive and service principal sign-in rows are aggregated, so row counts there are not request counts. `ResultType` is a **string** column, so compare it with `\"7000112\"`.",
  "fix": {
    "short": "Admin: first find who disabled the app and why in the audit log; leave it disabled if that was during an incident. If it was a mistake, set Enterprise applications > the app > Properties > Enabled for users to sign-in? to Yes. User: tell your IT team which app showed the error.",
    "steps": "**For the user:** you can't fix this yourself. The app is turned off in your organisation. Tell your IT team which app showed the error.\n\n**For developers:** if your app is multi-tenant and a customer gets 7000112, the customer's admin disabled your app's service principal in their tenant. You can't re-enable it from your side. Ask them to.\n\n**For admins:**\n1. Find out who disabled it and why with the audit log query, before changing anything. If it was disabled during an incident, leave it disabled.\n2. If it was a mistake: in **Enterprise applications** > the app > **Properties**, set **Enabled for users to sign-in?** to **Yes**. In Microsoft Graph, set `accountEnabled` to `true` on the service principal.\n3. For Exchange Online, Microsoft's article gives the steps with the old MSOnline module (`Set-MsolServicePrincipal -AccountEnabled $true` on app ID `00000002-0000-0ff1-ce00-000000000000`). That article notes the MSOnline and Azure AD modules are deprecated and points to Microsoft Graph PowerShell instead.\n4. If the account that disabled a Microsoft first-party app can't explain it, investigate that account like any other suspicious admin action.\n5. If you want to block an app permanently, disabling is fine. Remove it later once nothing legitimate depends on it. After removal the code a client gets will probably change, to [700016](https://brambrinkmeier.com/entra/aadsts/700016/) or 700011; which one isn't documented."
  },
  "labReproduced": {
    "date": "2026-10-30",
    "method": "Password-grant (ROPC) token request against a lab tenant",
    "scenario": "Application disabled for sign-in",
    "message": "AADSTS7000112: Application '<app id>'(<app name>) is disabled.",
    "logCaptured": "2026-10-31",
    "kqlTested": null
  },
  "labSectionText": "On 30 October 2026 an automated lab run registered an app, created its service principal, set `accountEnabled` to `false` on that service principal, and then signed a test user in through it. Entra returned `AADSTS7000112`:\n\n> AADSTS7000112: Application '<app id>'(<app name>) is disabled.\n\nThat confirms the cause directly: the **service principal**, the enterprise application object in your tenant, is the thing that is disabled. The app registration itself was untouched and still existed. The message names the application ID and the display name, so you can go straight to Enterprise applications and look at that object's **Enabled for users to sign-in?** setting.\n\nThe sign-in log row isn't captured yet; see [how pages are checked](https://brambrinkmeier.com/methodology/).\n\nIn the lab tenant's sign-in logs the row appears under **User sign-ins (interactive)**, Status **Failure**, Conditional Access **Not Applied**. The **Application** column shows the disabled app's own display name, not the sign-in client, so the row points straight at the application you need to re-enable.",
  "labRuns": [
    {
      "date": "2026-10-30",
      "run": "round 6",
      "method": "token-endpoint requests against a lab tenant, using lab-created test apps",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/70",
      "scenario": "Application disabled for sign-in",
      "expected": "7000112",
      "got": "7000112",
      "matchedExpectation": true,
      "message": "AADSTS7000112: Application '{app-id}'(lab-disabled-sp-41139925607) is disabled."
    },
    {
      "date": "2026-10-30",
      "run": "round 7",
      "method": "token-endpoint requests against a lab tenant",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/71",
      "scenario": "Application disabled for sign-in",
      "expected": "7000112",
      "got": "7000112",
      "matchedExpectation": true,
      "message": "AADSTS7000112: Application '{app-id}'(lab-disabled-sp-41143330001) is disabled."
    },
    {
      "date": "2026-10-31",
      "run": "round 8",
      "method": "token-endpoint and device-code requests against a lab tenant",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/72",
      "scenario": "Application disabled for sign-in",
      "expected": "7000112",
      "got": "7000112",
      "matchedExpectation": true,
      "message": "AADSTS7000112: Application '{app-id}'(lab-disabled-sp-41146039117) is disabled."
    },
    {
      "date": "2026-10-31",
      "run": "round 9",
      "method": "token-endpoint and device-code requests against a lab tenant",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/73",
      "scenario": "Application disabled for sign-in",
      "expected": "7000112",
      "got": "7000112",
      "matchedExpectation": true,
      "message": "AADSTS7000112: Application '{app-id}'(lab-disabled-sp-41150019626) is disabled."
    }
  ],
  "verification": "lab-reproduced",
  "related": [
    "700016",
    "500011",
    "65001",
    "7000215",
    "50001",
    "500014",
    "501051"
  ],
  "coveredBy": [],
  "sources": [
    {
      "title": "Microsoft Entra authentication and authorization error codes",
      "url": "https://learn.microsoft.com/en-us/entra/identity-platform/reference-error-codes"
    },
    {
      "title": "Properties of an enterprise application",
      "url": "https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/application-properties"
    },
    {
      "title": "servicePrincipal resource type (Microsoft Graph)",
      "url": "https://learn.microsoft.com/en-us/graph/api/resources/serviceprincipal"
    },
    {
      "title": "\"Sorry, but we're having trouble signing you in\" error when signing in to Microsoft 365",
      "url": "https://learn.microsoft.com/en-us/microsoft-365/troubleshoot/sign-in/exchange-online-application-service-principal-disabled"
    },
    {
      "title": "Microsoft Entra audit log categories and activities",
      "url": "https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities"
    }
  ],
  "published": "2026-10-30",
  "lastUpdated": "2026-10-30",
  "lastVerified": null,
  "license": "CC BY 4.0",
  "licenseUrl": "https://creativecommons.org/licenses/by/4.0/",
  "licenseNote": "CC BY 4.0 covers the author's own text and classification fields. Quoted Microsoft error wording belongs to Microsoft, is quoted with its source and can change.",
  "attribution": "Bram Brinkmeier, \"AADSTS7000112: The application is disabled (fix)\", https://brambrinkmeier.com/entra/aadsts/7000112/ (CC BY 4.0)",
  "microsoftErrorLookup": "https://login.microsoftonline.com/error?code=7000112"
}