{
  "schemaVersion": "1.0",
  "code": "7000218",
  "name": null,
  "title": "AADSTS7000218: Client secret or assertion missing from the request (fix)",
  "url": "https://brambrinkmeier.com/entra/aadsts/7000218/",
  "alternates": {
    "markdown": "https://brambrinkmeier.com/entra/aadsts/7000218.md",
    "json": "https://brambrinkmeier.com/api/aadsts/7000218.json",
    "html": "https://brambrinkmeier.com/entra/aadsts/7000218/"
  },
  "description": "AADSTS7000218: a confidential client sent no client secret or assertion. Usually a missing credential or a public-client flow setting. KQL.",
  "summary": "AADSTS7000218 means a token request reached Microsoft Entra ID as a confidential client but carried no client secret and no client assertion. Usually the app forgot the credential, or it uses ROPC, device code or IWA while the app registration is still set to confidential. Low attack value. The fix is to send the credential or, only when it fits, allow public client flows.",
  "inMicrosoftReference": true,
  "unlistedChecked": null,
  "meaningText": "Microsoft's description:\n\n> The request body must contain the following parameter: 'client_assertion' or 'client_secret'.\n\nThe reference table gives this code no PascalCase name.\n\nA token request arrived for an app that Microsoft Entra ID treats as a **confidential client**, and it carried no proof of the app's identity. Microsoft's troubleshooting article says the request fails with `invalid_client` and that confidential clients must supply a client secret or a client assertion.\n\nTwo siblings help you tell the cases apart:\n\n- **[7000215](https://brambrinkmeier.com/entra/aadsts/7000215/)**: *\"Invalid client secret is provided.\"* A secret was sent and it was wrong.\n- **[7000222](https://brambrinkmeier.com/entra/aadsts/7000222/)**: *\"The provided client secret keys are expired.\"* The secret was right but expired.\n\nSo 7000218 means nothing was sent at all.\n\n### How Entra decides the client is confidential\nThis is the part that catches most people. According to Microsoft's troubleshooting article:\n\n1. If the request has a redirect URI, the **platform type** of that redirect URI decides. A **Web** redirect URI makes the app a confidential client. A **Mobile and desktop applications** redirect URI makes it a public client.\n2. If the request has no redirect URI (ROPC, device code, Integrated Windows Authentication), Entra uses the **Allow public client flows** setting on the app registration. Yes means public, No means confidential.\n\nSo a desktop tool that uses device code flow, registered with the default setting, gets 7000218 even though it was never meant to have a secret.",
  "sections": [
    {
      "heading": "What does AADSTS7000218 mean?",
      "text": "Microsoft's description:\n\n> The request body must contain the following parameter: 'client_assertion' or 'client_secret'.\n\nThe reference table gives this code no PascalCase name.\n\nA token request arrived for an app that Microsoft Entra ID treats as a **confidential client**, and it carried no proof of the app's identity. Microsoft's troubleshooting article says the request fails with `invalid_client` and that confidential clients must supply a client secret or a client assertion.\n\nTwo siblings help you tell the cases apart:\n\n- **[7000215](https://brambrinkmeier.com/entra/aadsts/7000215/)**: *\"Invalid client secret is provided.\"* A secret was sent and it was wrong.\n- **[7000222](https://brambrinkmeier.com/entra/aadsts/7000222/)**: *\"The provided client secret keys are expired.\"* The secret was right but expired.\n\nSo 7000218 means nothing was sent at all.\n\n### How Entra decides the client is confidential\nThis is the part that catches most people. According to Microsoft's troubleshooting article:\n\n1. If the request has a redirect URI, the **platform type** of that redirect URI decides. A **Web** redirect URI makes the app a confidential client. A **Mobile and desktop applications** redirect URI makes it a public client.\n2. If the request has no redirect URI (ROPC, device code, Integrated Windows Authentication), Entra uses the **Allow public client flows** setting on the app registration. Yes means public, No means confidential.\n\nSo a desktop tool that uses device code flow, registered with the default setting, gets 7000218 even though it was never meant to have a secret."
    },
    {
      "heading": "Reproduced in the lab",
      "text": "On 30 October 2026 an automated lab run created an app registration **without** public client flows enabled, then sent a password-grant (ROPC) request with no credential. Entra returned `AADSTS7000218`:\n\n> AADSTS7000218: The request body must contain the following parameter: 'client_assertion' or 'client_secret'.\n\nThe same run also sent a client-credentials request with no credential, and that returned a different code, `AADSTS7000216` (\"'client_assertion', 'client_secret' or 'request' is required for the 'client_credentials' grant type\"). So the code depends on the grant type: 7000218 comes from a user-credential flow, 7000216 from client credentials.\n\nThe sign-in log row isn't captured yet; see [how pages are checked](https://brambrinkmeier.com/methodology/).\n\nIn the lab tenant's sign-in logs the row appears under **User sign-ins (interactive)**, Status **Failure**, Conditional Access **Not Applied**, with the Application column naming the confidential app that sent the request without a credential."
    },
    {
      "heading": "Is it an attack?",
      "text": "Almost never. 7000218 is a configuration mismatch between the app and its registration. The request carried no credential, so it can't have succeeded.\n\n| Pattern | Likely meaning |\n|---|---|\n| 7000218 for a new app during testing | The developer hasn't added the secret or certificate yet, or registered the wrong platform type. |\n| 7000218 for a desktop script or CLI tool using device code or ROPC | The registration is confidential (public client flows set to No). Fix the registration or the flow. |\n| 7000218 for an app that worked yesterday | Someone changed the redirect URI platform or the public client setting, or a deployment dropped the secret from its configuration. Check the audit log for **Update application**. |\n| 7000218 from an IP you don't own, for your app ID | Someone outside is trying your app ID without a credential. Our interpretation: they have the client ID, which is public by design, but not the secret. Low risk on its own. |\n\nMicrosoft notes that *\"The client ID is a public value that identifies the application, while the client secret is a confidential value.\"* Knowing a client ID is not a compromise.\n\nThe real security question is the fix, not the error. See the admin steps below before switching an app to a public client."
    },
    {
      "heading": "How do I find it in my logs (KQL)?",
      "text": "Microsoft doesn't document which sign-in table 7000218 lands in. Our reading: an app-only request (client credentials) would be a service principal sign-in, and a delegated request (device code, ROPC, authorization code) would be a user sign-in. Check where it lands in your workspace:\n\n```kusto\nunion withsource=SourceTable SigninLogs, AADNonInteractiveUserSignInLogs, AADServicePrincipalSignInLogs\n| where TimeGenerated > ago(7d)\n| where ResultType == \"7000218\"\n| summarize Rows = count(), Apps = dcount(AppId) by SourceTable\n```\n\nWhich apps hit it, from where, and since when:\n\n```kusto\nunion SigninLogs, AADNonInteractiveUserSignInLogs, AADServicePrincipalSignInLogs\n| where TimeGenerated > ago(30d)\n| where ResultType == \"7000218\"\n| summarize Rows = count(),\n            FirstSeen = min(TimeGenerated),\n            LastSeen = max(TimeGenerated),\n            IPs = make_set(IPAddress, 10),\n            Users = dcount(UserPrincipalName)\n          by AppId, AppDisplayName = coalesce(AppDisplayName, ServicePrincipalName)\n| sort by Rows desc\n```\n\nIf an app moved from 7000218 to success, check whether it got there by adding a secret or by being switched to a public client. The audit log shows the change to the app registration:\n\n```kusto\nAuditLogs\n| where TimeGenerated > ago(30d)\n| where Category == \"ApplicationManagement\"\n| where OperationName startswith \"Update application\"\n| project TimeGenerated, OperationName, InitiatedBy, TargetResources\n| sort by TimeGenerated desc\n```\n\nMicrosoft's audit activity reference lists both **Update application** and **Update application - Certificates and secrets management** in the ApplicationManagement category. The query uses `startswith` so it catches both; the exact punctuation in the stored `OperationName` may differ from the reference. `TargetResources` holds the changed properties, but which property names a public client switch writes isn't documented, so read the rows rather than filter on them. Service principal rows are aggregated when the service principal, status, IP address and resource match, so row counts there are not request counts. `ResultType` is a **string** column, so compare it with `\"7000218\"`."
    },
    {
      "heading": "How do I fix AADSTS7000218?",
      "text": "**For developers:**\n1. If your app is a confidential client (web app, web API, daemon), send the credential. Add `client_secret`, or a `client_assertion` signed with a certificate, to the token request. Microsoft's authorization code reference says the client secret *\"is required for web apps and web APIs, which can store the `client_secret` securely on the server side.\"*\n2. If your app runs on a user's device (desktop, mobile, CLI, script), it is a public client and must not carry a secret. Microsoft: public clients *\"can't be trusted to safely keep application secrets\"*. Register a **Mobile and desktop applications** redirect URI, or for flows without a redirect URI, ask an admin to turn on public client flows.\n3. To find out which flow your code uses, look at `grant_type` in the token request (in code or a Fiddler trace). Microsoft's article lists `password` for ROPC, `urn:ietf:params:oauth:grant-type:device_code` for device code, `authorization_code`, `client_credentials`, and `urn:ietf:params:oauth:grant-type:jwt-bearer` for on-behalf-of.\n\n**For admins:**\n1. For a confidential app, the fix is a credential, not a setting. Prefer a certificate or managed identity over a secret.\n2. Only for a real public client flow: in **App registrations** > the app > **Authentication** > **Advanced settings**, set **Allow public client flows** to **Yes**. Microsoft warns that this changes the client type from confidential to public, with security implications.\n3. Our reading of those implications, not Microsoft's wording: once public client flows are on, anyone who knows the client ID can start ROPC or device code flows for that app without a secret. The client ID is public, so the secret no longer stands between an attacker and those flows. Don't flip the setting just to make the error go away, and don't flip it on an app that also uses a secret for server-side work.\n4. If you do allow public client flows, make sure MFA and Conditional Access cover the users who sign in through that app."
    }
  ],
  "microsoftWording": {
    "text": "The request body must contain the following parameter: 'client_assertion' or 'client_secret'.",
    "source": "Microsoft's error code reference, as quoted on the page",
    "sourceUrl": "https://learn.microsoft.com/en-us/entra/identity-platform/reference-error-codes"
  },
  "securityReading": {
    "category": {
      "id": "app-config",
      "label": "App configuration"
    },
    "kind": {
      "id": "failure",
      "label": "Failure"
    },
    "attackSignal": {
      "level": "low",
      "label": "Low: usually configuration or user error"
    },
    "mitre": [],
    "tables": [],
    "isItAnAttack": "Almost never. 7000218 is a configuration mismatch between the app and its registration. The request carried no credential, so it can't have succeeded.\n\n| Pattern | Likely meaning |\n|---|---|\n| 7000218 for a new app during testing | The developer hasn't added the secret or certificate yet, or registered the wrong platform type. |\n| 7000218 for a desktop script or CLI tool using device code or ROPC | The registration is confidential (public client flows set to No). Fix the registration or the flow. |\n| 7000218 for an app that worked yesterday | Someone changed the redirect URI platform or the public client setting, or a deployment dropped the secret from its configuration. Check the audit log for **Update application**. |\n| 7000218 from an IP you don't own, for your app ID | Someone outside is trying your app ID without a credential. Our interpretation: they have the client ID, which is public by design, but not the secret. Low risk on its own. |\n\nMicrosoft notes that *\"The client ID is a public value that identifies the application, while the client secret is a confidential value.\"* Knowing a client ID is not a compromise.\n\nThe real security question is the fix, not the error. See the admin steps below before switching an app to a public client.",
    "conditionalAccess": null
  },
  "kql": [
    {
      "title": null,
      "leadIn": "Microsoft doesn't document which sign-in table 7000218 lands in. Our reading: an app-only request (client credentials) would be a service principal sign-in, and a delegated request (device code, ROPC, authorization code) would be a user sign-in. Check where it lands in your workspace:",
      "query": "union withsource=SourceTable SigninLogs, AADNonInteractiveUserSignInLogs, AADServicePrincipalSignInLogs\n| where TimeGenerated > ago(7d)\n| where ResultType == \"7000218\"\n| summarize Rows = count(), Apps = dcount(AppId) by SourceTable"
    },
    {
      "title": null,
      "leadIn": "Which apps hit it, from where, and since when:",
      "query": "union SigninLogs, AADNonInteractiveUserSignInLogs, AADServicePrincipalSignInLogs\n| where TimeGenerated > ago(30d)\n| where ResultType == \"7000218\"\n| summarize Rows = count(),\n            FirstSeen = min(TimeGenerated),\n            LastSeen = max(TimeGenerated),\n            IPs = make_set(IPAddress, 10),\n            Users = dcount(UserPrincipalName)\n          by AppId, AppDisplayName = coalesce(AppDisplayName, ServicePrincipalName)\n| sort by Rows desc"
    },
    {
      "title": null,
      "leadIn": "If an app moved from 7000218 to success, check whether it got there by adding a secret or by being switched to a public client. The audit log shows the change to the app registration:",
      "query": "AuditLogs\n| where TimeGenerated > ago(30d)\n| where Category == \"ApplicationManagement\"\n| where OperationName startswith \"Update application\"\n| project TimeGenerated, OperationName, InitiatedBy, TargetResources\n| sort by TimeGenerated desc"
    }
  ],
  "kqlSectionText": "Microsoft doesn't document which sign-in table 7000218 lands in. Our reading: an app-only request (client credentials) would be a service principal sign-in, and a delegated request (device code, ROPC, authorization code) would be a user sign-in. Check where it lands in your workspace:\n\n```kusto\nunion withsource=SourceTable SigninLogs, AADNonInteractiveUserSignInLogs, AADServicePrincipalSignInLogs\n| where TimeGenerated > ago(7d)\n| where ResultType == \"7000218\"\n| summarize Rows = count(), Apps = dcount(AppId) by SourceTable\n```\n\nWhich apps hit it, from where, and since when:\n\n```kusto\nunion SigninLogs, AADNonInteractiveUserSignInLogs, AADServicePrincipalSignInLogs\n| where TimeGenerated > ago(30d)\n| where ResultType == \"7000218\"\n| summarize Rows = count(),\n            FirstSeen = min(TimeGenerated),\n            LastSeen = max(TimeGenerated),\n            IPs = make_set(IPAddress, 10),\n            Users = dcount(UserPrincipalName)\n          by AppId, AppDisplayName = coalesce(AppDisplayName, ServicePrincipalName)\n| sort by Rows desc\n```\n\nIf an app moved from 7000218 to success, check whether it got there by adding a secret or by being switched to a public client. The audit log shows the change to the app registration:\n\n```kusto\nAuditLogs\n| where TimeGenerated > ago(30d)\n| where Category == \"ApplicationManagement\"\n| where OperationName startswith \"Update application\"\n| project TimeGenerated, OperationName, InitiatedBy, TargetResources\n| sort by TimeGenerated desc\n```\n\nMicrosoft's audit activity reference lists both **Update application** and **Update application - Certificates and secrets management** in the ApplicationManagement category. The query uses `startswith` so it catches both; the exact punctuation in the stored `OperationName` may differ from the reference. `TargetResources` holds the changed properties, but which property names a public client switch writes isn't documented, so read the rows rather than filter on them. Service principal rows are aggregated when the service principal, status, IP address and resource match, so row counts there are not request counts. `ResultType` is a **string** column, so compare it with `\"7000218\"`.",
  "fix": {
    "short": "Developer of a web app, API or daemon: send `client_secret` or a certificate-signed `client_assertion` in the token request. App on a user's device: register a Mobile and desktop redirect URI, or have an admin set Allow public client flows to Yes, only for a real public client.",
    "steps": "**For developers:**\n1. If your app is a confidential client (web app, web API, daemon), send the credential. Add `client_secret`, or a `client_assertion` signed with a certificate, to the token request. Microsoft's authorization code reference says the client secret *\"is required for web apps and web APIs, which can store the `client_secret` securely on the server side.\"*\n2. If your app runs on a user's device (desktop, mobile, CLI, script), it is a public client and must not carry a secret. Microsoft: public clients *\"can't be trusted to safely keep application secrets\"*. Register a **Mobile and desktop applications** redirect URI, or for flows without a redirect URI, ask an admin to turn on public client flows.\n3. To find out which flow your code uses, look at `grant_type` in the token request (in code or a Fiddler trace). Microsoft's article lists `password` for ROPC, `urn:ietf:params:oauth:grant-type:device_code` for device code, `authorization_code`, `client_credentials`, and `urn:ietf:params:oauth:grant-type:jwt-bearer` for on-behalf-of.\n\n**For admins:**\n1. For a confidential app, the fix is a credential, not a setting. Prefer a certificate or managed identity over a secret.\n2. Only for a real public client flow: in **App registrations** > the app > **Authentication** > **Advanced settings**, set **Allow public client flows** to **Yes**. Microsoft warns that this changes the client type from confidential to public, with security implications.\n3. Our reading of those implications, not Microsoft's wording: once public client flows are on, anyone who knows the client ID can start ROPC or device code flows for that app without a secret. The client ID is public, so the secret no longer stands between an attacker and those flows. Don't flip the setting just to make the error go away, and don't flip it on an app that also uses a secret for server-side work.\n4. If you do allow public client flows, make sure MFA and Conditional Access cover the users who sign in through that app."
  },
  "labReproduced": {
    "date": "2026-10-30",
    "method": "Password-grant (ROPC) token request against a lab tenant",
    "scenario": "Confidential client does ROPC without a secret",
    "message": "AADSTS7000218: The request body must contain the following parameter: 'client_assertion' or 'client_secret'.",
    "logCaptured": "2026-10-31",
    "kqlTested": null
  },
  "labSectionText": "On 30 October 2026 an automated lab run created an app registration **without** public client flows enabled, then sent a password-grant (ROPC) request with no credential. Entra returned `AADSTS7000218`:\n\n> AADSTS7000218: The request body must contain the following parameter: 'client_assertion' or 'client_secret'.\n\nThe same run also sent a client-credentials request with no credential, and that returned a different code, `AADSTS7000216` (\"'client_assertion', 'client_secret' or 'request' is required for the 'client_credentials' grant type\"). So the code depends on the grant type: 7000218 comes from a user-credential flow, 7000216 from client credentials.\n\nThe sign-in log row isn't captured yet; see [how pages are checked](https://brambrinkmeier.com/methodology/).\n\nIn the lab tenant's sign-in logs the row appears under **User sign-ins (interactive)**, Status **Failure**, Conditional Access **Not Applied**, with the Application column naming the confidential app that sent the request without a credential.",
  "labRuns": [
    {
      "date": "2026-10-30",
      "run": "round 4",
      "method": "token-endpoint requests against a lab tenant",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/67",
      "scenario": "Confidential client sends no credential",
      "expected": "7000218",
      "got": "7000216",
      "matchedExpectation": false,
      "message": "AADSTS7000216: 'client_assertion', 'client_secret' or 'request' is required for the 'client_credentials' grant type."
    },
    {
      "date": "2026-10-30",
      "run": "round 5",
      "method": "token-endpoint requests against a lab tenant, using lab-created test apps",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/69",
      "scenario": "Confidential client sends no credential",
      "expected": "7000218",
      "got": "7000216",
      "matchedExpectation": false,
      "message": "AADSTS7000216: 'client_assertion', 'client_secret' or 'request' is required for the 'client_credentials' grant type."
    },
    {
      "date": "2026-10-30",
      "run": "round 5",
      "method": "token-endpoint requests against a lab tenant, using lab-created test apps",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/69",
      "scenario": "Confidential client does ROPC without a secret",
      "expected": "7000218",
      "got": "7000218",
      "matchedExpectation": true,
      "message": "AADSTS7000218: The request body must contain the following parameter: 'client_assertion' or 'client_secret'."
    },
    {
      "date": "2026-10-30",
      "run": "round 5 (first attempt)",
      "method": "token-endpoint requests against a lab tenant",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/68",
      "scenario": "Confidential client sends no credential",
      "expected": "7000218",
      "got": "7000216",
      "matchedExpectation": false,
      "message": "AADSTS7000216: 'client_assertion', 'client_secret' or 'request' is required for the 'client_credentials' grant type."
    },
    {
      "date": "2026-10-30",
      "run": "round 6",
      "method": "token-endpoint requests against a lab tenant, using lab-created test apps",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/70",
      "scenario": "Confidential client sends no credential",
      "expected": "7000218",
      "got": "7000216",
      "matchedExpectation": false,
      "message": "AADSTS7000216: 'client_assertion', 'client_secret' or 'request' is required for the 'client_credentials' grant type."
    },
    {
      "date": "2026-10-30",
      "run": "round 6",
      "method": "token-endpoint requests against a lab tenant, using lab-created test apps",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/70",
      "scenario": "Confidential client does ROPC without a secret",
      "expected": "7000218",
      "got": "7000218",
      "matchedExpectation": true,
      "message": "AADSTS7000218: The request body must contain the following parameter: 'client_assertion' or 'client_secret'."
    },
    {
      "date": "2026-10-30",
      "run": "round 7",
      "method": "token-endpoint requests against a lab tenant",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/71",
      "scenario": "Confidential client sends no credential",
      "expected": "7000218",
      "got": "7000216",
      "matchedExpectation": false,
      "message": "AADSTS7000216: 'client_assertion', 'client_secret' or 'request' is required for the 'client_credentials' grant type."
    },
    {
      "date": "2026-10-30",
      "run": "round 7",
      "method": "token-endpoint requests against a lab tenant",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/71",
      "scenario": "Confidential client does ROPC without a secret",
      "expected": "7000218",
      "got": "7000218",
      "matchedExpectation": true,
      "message": "AADSTS7000218: The request body must contain the following parameter: 'client_assertion' or 'client_secret'."
    },
    {
      "date": "2026-10-31",
      "run": "round 8",
      "method": "token-endpoint and device-code requests against a lab tenant",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/72",
      "scenario": "Confidential client sends no credential",
      "expected": "7000218",
      "got": "7000216",
      "matchedExpectation": false,
      "message": "AADSTS7000216: 'client_assertion', 'client_secret' or 'request' is required for the 'client_credentials' grant type."
    },
    {
      "date": "2026-10-31",
      "run": "round 8",
      "method": "token-endpoint and device-code requests against a lab tenant",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/72",
      "scenario": "Confidential client does ROPC without a secret",
      "expected": "7000218",
      "got": "7000218",
      "matchedExpectation": true,
      "message": "AADSTS7000218: The request body must contain the following parameter: 'client_assertion' or 'client_secret'."
    },
    {
      "date": "2026-10-31",
      "run": "round 9",
      "method": "token-endpoint and device-code requests against a lab tenant",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/73",
      "scenario": "Confidential client sends no credential",
      "expected": "7000218",
      "got": "7000216",
      "matchedExpectation": false,
      "message": "AADSTS7000216: 'client_assertion', 'client_secret' or 'request' is required for the 'client_credentials' grant type."
    },
    {
      "date": "2026-10-31",
      "run": "round 9",
      "method": "token-endpoint and device-code requests against a lab tenant",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/73",
      "scenario": "Confidential client does ROPC without a secret",
      "expected": "7000218",
      "got": "7000218",
      "matchedExpectation": true,
      "message": "AADSTS7000218: The request body must contain the following parameter: 'client_assertion' or 'client_secret'."
    }
  ],
  "verification": "lab-reproduced",
  "related": [
    "7000215",
    "7000222",
    "700016",
    "500011",
    "50027",
    "70002",
    "90023",
    "90133",
    "700024",
    "1002016",
    "5002730",
    "7000216",
    "9002326",
    "9002327"
  ],
  "coveredBy": [],
  "sources": [
    {
      "title": "Microsoft Entra authentication and authorization error codes",
      "url": "https://learn.microsoft.com/en-us/entra/identity-platform/reference-error-codes"
    },
    {
      "title": "Error AADSTS7000218 when a confidential client application authenticates to Microsoft Entra ID",
      "url": "https://learn.microsoft.com/en-us/troubleshoot/entra/entra-id/app-integration/confidential-client-application-authentication-error-aadsts7000218"
    },
    {
      "title": "Public client and confidential client applications",
      "url": "https://learn.microsoft.com/en-us/entra/identity-platform/msal-client-applications"
    },
    {
      "title": "Microsoft identity platform and OAuth 2.0 authorization code flow",
      "url": "https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth2-auth-code-flow"
    },
    {
      "title": "Microsoft Entra audit log categories and activities",
      "url": "https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities"
    },
    {
      "title": "Service principal sign-ins",
      "url": "https://learn.microsoft.com/en-us/entra/identity/monitoring-health/concept-service-principal-sign-ins"
    }
  ],
  "published": "2026-10-30",
  "lastUpdated": "2026-10-30",
  "lastVerified": null,
  "license": "CC BY 4.0",
  "licenseUrl": "https://creativecommons.org/licenses/by/4.0/",
  "licenseNote": "CC BY 4.0 covers the author's own text and classification fields. Quoted Microsoft error wording belongs to Microsoft, is quoted with its source and can change.",
  "attribution": "Bram Brinkmeier, \"AADSTS7000218: Client secret or assertion missing from the request (fix)\", https://brambrinkmeier.com/entra/aadsts/7000218/ (CC BY 4.0)",
  "microsoftErrorLookup": "https://login.microsoftonline.com/error?code=7000218"
}