{
  "schemaVersion": "1.0",
  "code": "90002",
  "name": "InvalidTenantName",
  "title": "AADSTS90002: Tenant not found (fix)",
  "url": "https://brambrinkmeier.com/entra/aadsts/90002/",
  "alternates": {
    "markdown": "https://brambrinkmeier.com/entra/aadsts/90002.md",
    "json": "https://brambrinkmeier.com/api/aadsts/90002.json",
    "html": "https://brambrinkmeier.com/entra/aadsts/90002/"
  },
  "description": "AADSTS90002: the tenant in the sign-in request doesn't exist. Wrong tenant ID, wrong cloud, or unregistered domain. How to fix it, with KQL.",
  "summary": "AADSTS90002 means the sign-in request named a tenant that Entra can't find. Usually the tenant ID or domain in the app's settings is wrong, the app talks to the wrong cloud, or the domain was derived from an email address and isn't registered. It is a configuration error with low attack value. Check the tenant ID and the cloud endpoint.",
  "inMicrosoftReference": true,
  "unlistedChecked": null,
  "meaningText": "Microsoft's description:\n\n> **InvalidTenantName**: The tenant name wasn't found in the data store. Check to make sure you have the correct tenant ID. The application developer will receive this error if their app attempts to sign into a tenant that we cannot find. Often, this is because a cross-cloud app was used against the wrong cloud, or the developer attempted to sign in to a tenant derived from an email address, but the domain isn't registered.\n\nEvery sign-in request names a tenant in its URL, as a tenant ID (a GUID) or a domain: `https://login.microsoftonline.com/<tenant>/...`. 90002 means Entra has no tenant by that name in the cloud the request went to.\n\nThe \"wrong cloud\" cause is real because the clouds are separate. Microsoft's national clouds page says *\"Each cloud instance is separate from the others and has its own environment and endpoints\"* and lists `https://login.microsoftonline.com` (global), `https://login.microsoftonline.us` (US Government) and `https://login.partner.microsoftonline.cn` (China, operated by 21Vianet). A US Government tenant ID sent to the global endpoint is not found, and the other way round.",
  "sections": [
    {
      "heading": "What does AADSTS90002 mean?",
      "text": "Microsoft's description:\n\n> **InvalidTenantName**: The tenant name wasn't found in the data store. Check to make sure you have the correct tenant ID. The application developer will receive this error if their app attempts to sign into a tenant that we cannot find. Often, this is because a cross-cloud app was used against the wrong cloud, or the developer attempted to sign in to a tenant derived from an email address, but the domain isn't registered.\n\nEvery sign-in request names a tenant in its URL, as a tenant ID (a GUID) or a domain: `https://login.microsoftonline.com/<tenant>/...`. 90002 means Entra has no tenant by that name in the cloud the request went to.\n\nThe \"wrong cloud\" cause is real because the clouds are separate. Microsoft's national clouds page says *\"Each cloud instance is separate from the others and has its own environment and endpoints\"* and lists `https://login.microsoftonline.com` (global), `https://login.microsoftonline.us` (US Government) and `https://login.partner.microsoftonline.cn` (China, operated by 21Vianet). A US Government tenant ID sent to the global endpoint is not found, and the other way round."
    },
    {
      "heading": "Reproduced in the lab",
      "text": "On 25 October 2026 an automated lab run sent a token request to a tenant ID that doesn't exist (a random GUID the script generated). Entra returned `AADSTS90002` with this first line:\n\n> AADSTS90002: Tenant '{tenant-id}' not found. Check to make sure you have the correct tenant ID and are signing into the correct cloud.\n\nThat confirms the code and its wording at the token endpoint. Note that the returned message mentions the cloud as well as the tenant ID. No sign-in log row was captured. Our reading: there is no tenant to log it in, because the tenant named in the request doesn't exist, and the request never reached the lab tenant either. See [how pages are checked](https://brambrinkmeier.com/methodology/)."
    },
    {
      "heading": "Is it an attack?",
      "text": "No. It is a configuration error in the app or script that sent the request.\n\n| Pattern | Likely meaning |\n|---|---|\n| A new app or script fails on its first run | Typo in the tenant ID, or a placeholder value left in the config. |\n| An app that works in one environment fails in another | The app points at the wrong cloud endpoint for that tenant. |\n| A multi-tenant app that builds the tenant from the user's email domain | The domain isn't a verified domain of any tenant, as Microsoft's description says. |\n| An app that worked before and now fails | The tenant was deleted, or the custom domain used as tenant name was removed from it. Our interpretation. |\n\nOur reading: tenant discovery by attackers doesn't need this error and doesn't show up in your logs through it. A request to a tenant that doesn't exist reaches no tenant."
    },
    {
      "heading": "How do I find it in my logs (KQL)?",
      "text": "Microsoft doesn't document which sign-in table 90002 is logged in. It probably lands in none of yours, for the reason in the lab note above. Check anyway; this query is expected to return nothing:\n\n```kusto\nunion withsource=SourceTable SigninLogs, AADNonInteractiveUserSignInLogs, AADServicePrincipalSignInLogs\n| where TimeGenerated > ago(30d)\n| where ResultType == \"90002\"\n| summarize Rows = count() by SourceTable\n```\n\nWhat the logs can do is tell you the right value to configure. For an app that fails with 90002, find where it signs in successfully and which tenant that is. `ResourceTenantId` is documented as *\"the tenant identifier of the resource referenced in the sign in\"*:\n\n```kusto\nunion withsource=SourceTable\n    SigninLogs,\n    (AADServicePrincipalSignInLogs | extend ResourceTenantId = AADTenantId, AppDisplayName = ServicePrincipalName)\n| where TimeGenerated > ago(30d)\n| where ResultType == \"0\"\n| where AppId == \"<app id of the failing app>\"\n| summarize Rows = count(), LastSeen = max(TimeGenerated) by SourceTable, ResourceTenantId, AppDisplayName\n```\n\n`AADServicePrincipalSignInLogs` has no `ResourceTenantId` or `AppDisplayName` column, so the query uses `AADTenantId` and `ServicePrincipalName` there (our choice; the table reference doesn't describe `AADTenantId`). If this returns your tenant ID and the app config holds a different one, you found the cause."
    },
    {
      "heading": "How do I fix AADSTS90002?",
      "text": "**For the user:** you can't fix this yourself. Report the app name to whoever set it up.\n\n**For developers:**\n1. Check the tenant ID or domain in the authority URL. Compare it with the real tenant ID; Microsoft's page on finding it says to use **Entra ID** > **Overview** > **Properties** in the Entra admin center, or `Get-AzTenant` in Azure PowerShell.\n2. Check the cloud. Microsoft's national clouds page: *\"use the endpoints for the cloud instance where you'll deploy the application.\"* A tenant in US Government or China needs that cloud's login endpoint, not `login.microsoftonline.com`.\n3. Don't derive the tenant from the user's email domain unless you handle the case where the domain isn't registered. For a multi-tenant app, sign in through `/organizations` or `/common` and read the tenant from the token instead.\n\n**For admins:**\n1. Get the correct tenant ID from the admin center or with PowerShell:\n\n```powershell\nConnect-AzAccount\nGet-AzTenant\n```\n\n2. If the app uses a domain name as tenant, check that the domain is still verified in your tenant.\n3. If the app is a third-party product, give the vendor your tenant ID and tell them which cloud your tenant is in."
    }
  ],
  "microsoftWording": {
    "text": "**InvalidTenantName**: The tenant name wasn't found in the data store. Check to make sure you have the correct tenant ID. The application developer will receive this error if their app attempts to sign into a tenant that we cannot find. Often, this is because a cross-cloud app was used against the wrong cloud, or the developer attempted to sign in to a tenant derived from an email address, but the domain isn't registered.",
    "source": "Microsoft's error code reference, as quoted on the page",
    "sourceUrl": "https://learn.microsoft.com/en-us/entra/identity-platform/reference-error-codes"
  },
  "securityReading": {
    "category": {
      "id": "app-config",
      "label": "App configuration"
    },
    "kind": {
      "id": "config",
      "label": "Configuration error"
    },
    "attackSignal": {
      "level": "low",
      "label": "Low: usually configuration or user error"
    },
    "mitre": [],
    "tables": [],
    "isItAnAttack": "No. It is a configuration error in the app or script that sent the request.\n\n| Pattern | Likely meaning |\n|---|---|\n| A new app or script fails on its first run | Typo in the tenant ID, or a placeholder value left in the config. |\n| An app that works in one environment fails in another | The app points at the wrong cloud endpoint for that tenant. |\n| A multi-tenant app that builds the tenant from the user's email domain | The domain isn't a verified domain of any tenant, as Microsoft's description says. |\n| An app that worked before and now fails | The tenant was deleted, or the custom domain used as tenant name was removed from it. Our interpretation. |\n\nOur reading: tenant discovery by attackers doesn't need this error and doesn't show up in your logs through it. A request to a tenant that doesn't exist reaches no tenant.",
    "conditionalAccess": null
  },
  "kql": [
    {
      "title": null,
      "leadIn": "Microsoft doesn't document which sign-in table 90002 is logged in. It probably lands in none of yours, for the reason in the lab note above. Check anyway; this query is expected to return nothing:",
      "query": "union withsource=SourceTable SigninLogs, AADNonInteractiveUserSignInLogs, AADServicePrincipalSignInLogs\n| where TimeGenerated > ago(30d)\n| where ResultType == \"90002\"\n| summarize Rows = count() by SourceTable"
    },
    {
      "title": null,
      "leadIn": "What the logs can do is tell you the right value to configure. For an app that fails with 90002, find where it signs in successfully and which tenant that is. `ResourceTenantId` is documented as *\"the tenant identifier of the resource referenced in the sign in\"*:",
      "query": "union withsource=SourceTable\n    SigninLogs,\n    (AADServicePrincipalSignInLogs | extend ResourceTenantId = AADTenantId, AppDisplayName = ServicePrincipalName)\n| where TimeGenerated > ago(30d)\n| where ResultType == \"0\"\n| where AppId == \"<app id of the failing app>\"\n| summarize Rows = count(), LastSeen = max(TimeGenerated) by SourceTable, ResourceTenantId, AppDisplayName"
    }
  ],
  "kqlSectionText": "Microsoft doesn't document which sign-in table 90002 is logged in. It probably lands in none of yours, for the reason in the lab note above. Check anyway; this query is expected to return nothing:\n\n```kusto\nunion withsource=SourceTable SigninLogs, AADNonInteractiveUserSignInLogs, AADServicePrincipalSignInLogs\n| where TimeGenerated > ago(30d)\n| where ResultType == \"90002\"\n| summarize Rows = count() by SourceTable\n```\n\nWhat the logs can do is tell you the right value to configure. For an app that fails with 90002, find where it signs in successfully and which tenant that is. `ResourceTenantId` is documented as *\"the tenant identifier of the resource referenced in the sign in\"*:\n\n```kusto\nunion withsource=SourceTable\n    SigninLogs,\n    (AADServicePrincipalSignInLogs | extend ResourceTenantId = AADTenantId, AppDisplayName = ServicePrincipalName)\n| where TimeGenerated > ago(30d)\n| where ResultType == \"0\"\n| where AppId == \"<app id of the failing app>\"\n| summarize Rows = count(), LastSeen = max(TimeGenerated) by SourceTable, ResourceTenantId, AppDisplayName\n```\n\n`AADServicePrincipalSignInLogs` has no `ResourceTenantId` or `AppDisplayName` column, so the query uses `AADTenantId` and `ServicePrincipalName` there (our choice; the table reference doesn't describe `AADTenantId`). If this returns your tenant ID and the app config holds a different one, you found the cause.",
  "fix": {
    "short": "Developer: check the tenant ID or domain in the authority URL against the real tenant ID (Entra ID > Overview > Properties, or Get-AzTenant), and use the login endpoint of the tenant's cloud. User: report the app name to whoever set it up; you can't fix this yourself.",
    "steps": "**For the user:** you can't fix this yourself. Report the app name to whoever set it up.\n\n**For developers:**\n1. Check the tenant ID or domain in the authority URL. Compare it with the real tenant ID; Microsoft's page on finding it says to use **Entra ID** > **Overview** > **Properties** in the Entra admin center, or `Get-AzTenant` in Azure PowerShell.\n2. Check the cloud. Microsoft's national clouds page: *\"use the endpoints for the cloud instance where you'll deploy the application.\"* A tenant in US Government or China needs that cloud's login endpoint, not `login.microsoftonline.com`.\n3. Don't derive the tenant from the user's email domain unless you handle the case where the domain isn't registered. For a multi-tenant app, sign in through `/organizations` or `/common` and read the tenant from the token instead.\n\n**For admins:**\n1. Get the correct tenant ID from the admin center or with PowerShell:\n\n```powershell\nConnect-AzAccount\nGet-AzTenant\n```\n\n2. If the app uses a domain name as tenant, check that the domain is still verified in your tenant.\n3. If the app is a third-party product, give the vendor your tenant ID and tell them which cloud your tenant is in."
  },
  "labReproduced": {
    "date": "2026-10-25",
    "method": "ROPC token request against a lab tenant",
    "scenario": "Tenant does not exist",
    "message": "AADSTS90002: Tenant '{tenant-id}' not found. Check to make sure you have the correct tenant ID and are signing into the correct cloud.",
    "logCaptured": null,
    "kqlTested": null
  },
  "labSectionText": "On 25 October 2026 an automated lab run sent a token request to a tenant ID that doesn't exist (a random GUID the script generated). Entra returned `AADSTS90002` with this first line:\n\n> AADSTS90002: Tenant '{tenant-id}' not found. Check to make sure you have the correct tenant ID and are signing into the correct cloud.\n\nThat confirms the code and its wording at the token endpoint. Note that the returned message mentions the cloud as well as the tenant ID. No sign-in log row was captured. Our reading: there is no tenant to log it in, because the tenant named in the request doesn't exist, and the request never reached the lab tenant either. See [how pages are checked](https://brambrinkmeier.com/methodology/).",
  "labRuns": [
    {
      "date": "2026-10-25",
      "run": null,
      "method": "ROPC token request against a lab tenant",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/38",
      "scenario": "Tenant does not exist",
      "expected": "90002",
      "got": "90002",
      "matchedExpectation": true,
      "message": "AADSTS90002: Tenant '{tenant-id}' not found. Check to make sure you have the correct tenant ID and are signing into the correct cloud."
    },
    {
      "date": "2026-10-30",
      "run": "round 4",
      "method": "token-endpoint requests against a lab tenant",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/67",
      "scenario": "Tenant does not exist",
      "expected": "90002",
      "got": "90002",
      "matchedExpectation": true,
      "message": "AADSTS90002: Tenant '{tenant-id}' not found. Check to make sure you have the correct tenant ID and are signing into the correct cloud. "
    },
    {
      "date": "2026-10-30",
      "run": "round 5",
      "method": "token-endpoint requests against a lab tenant, using lab-created test apps",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/69",
      "scenario": "Tenant does not exist",
      "expected": "90002",
      "got": "90002",
      "matchedExpectation": true,
      "message": "AADSTS90002: Tenant '{tenant-id}' not found. Check to make sure you have the correct tenant ID and are signing into the correct cloud. "
    },
    {
      "date": "2026-10-30",
      "run": "round 5 (first attempt)",
      "method": "token-endpoint requests against a lab tenant",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/68",
      "scenario": "Tenant does not exist",
      "expected": "90002",
      "got": "90002",
      "matchedExpectation": true,
      "message": "AADSTS90002: Tenant '{tenant-id}' not found. Check to make sure you have the correct tenant ID and are signing into the correct cloud. "
    },
    {
      "date": "2026-10-30",
      "run": "round 6",
      "method": "token-endpoint requests against a lab tenant, using lab-created test apps",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/70",
      "scenario": "Tenant does not exist",
      "expected": "90002",
      "got": "90002",
      "matchedExpectation": true,
      "message": "AADSTS90002: Tenant '{tenant-id}' not found. Check to make sure you have the correct tenant ID and are signing into the correct cloud. "
    },
    {
      "date": "2026-10-30",
      "run": "round 7",
      "method": "token-endpoint requests against a lab tenant",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/71",
      "scenario": "Tenant does not exist",
      "expected": "90002",
      "got": "90002",
      "matchedExpectation": true,
      "message": "AADSTS90002: Tenant '{tenant-id}' not found. Check to make sure you have the correct tenant ID and are signing into the correct cloud. "
    },
    {
      "date": "2026-10-30",
      "run": null,
      "method": "ROPC and other token-endpoint requests against a lab tenant",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/66",
      "scenario": "Tenant does not exist",
      "expected": "90002",
      "got": "90002",
      "matchedExpectation": true,
      "message": "AADSTS90002: Tenant '{tenant-id}' not found. Check to make sure you have the correct tenant ID and are signing into the correct cloud. "
    },
    {
      "date": "2026-10-31",
      "run": "round 8",
      "method": "token-endpoint and device-code requests against a lab tenant",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/72",
      "scenario": "Tenant does not exist",
      "expected": "90002",
      "got": "90002",
      "matchedExpectation": true,
      "message": "AADSTS90002: Tenant '{tenant-id}' not found. Check to make sure you have the correct tenant ID and are signing into the correct cloud. "
    },
    {
      "date": "2026-10-31",
      "run": "round 9",
      "method": "token-endpoint and device-code requests against a lab tenant",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/73",
      "scenario": "Tenant does not exist",
      "expected": "90002",
      "got": "90002",
      "matchedExpectation": true,
      "message": "AADSTS90002: Tenant '{tenant-id}' not found. Check to make sure you have the correct tenant ID and are signing into the correct cloud. "
    }
  ],
  "verification": "lab-reproduced",
  "related": [
    "700016",
    "500011",
    "16000",
    "50034",
    "50059",
    "50194",
    "90019",
    "90133",
    "900023",
    "900439",
    "1002016",
    "5000224",
    "5000225",
    "9002331",
    "9002346"
  ],
  "coveredBy": [],
  "sources": [
    {
      "title": "Microsoft Entra authentication and authorization error codes",
      "url": "https://learn.microsoft.com/en-us/entra/identity-platform/reference-error-codes"
    },
    {
      "title": "National clouds (Microsoft identity platform)",
      "url": "https://learn.microsoft.com/en-us/entra/identity-platform/authentication-national-cloud"
    },
    {
      "title": "How to find your Microsoft Entra tenant ID",
      "url": "https://learn.microsoft.com/en-us/entra/fundamentals/how-to-find-tenant"
    },
    {
      "title": "SigninLogs table reference (Azure Monitor)",
      "url": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/signinlogs"
    }
  ],
  "published": "2026-10-30",
  "lastUpdated": "2026-10-30",
  "lastVerified": null,
  "license": "CC BY 4.0",
  "licenseUrl": "https://creativecommons.org/licenses/by/4.0/",
  "licenseNote": "CC BY 4.0 covers the author's own text and classification fields. Quoted Microsoft error wording belongs to Microsoft, is quoted with its source and can change.",
  "attribution": "Bram Brinkmeier, \"AADSTS90002: Tenant not found (fix)\", https://brambrinkmeier.com/entra/aadsts/90002/ (CC BY 4.0)",
  "microsoftErrorLookup": "https://login.microsoftonline.com/error?code=90002"
}