{
  "schemaVersion": "1.0",
  "code": "900023",
  "name": null,
  "title": "AADSTS900023: Tenant identifier is not a valid tenant ID or domain (fix)",
  "url": "https://brambrinkmeier.com/entra/aadsts/900023/",
  "alternates": {
    "markdown": "https://brambrinkmeier.com/entra/aadsts/900023.md",
    "json": "https://brambrinkmeier.com/api/aadsts/900023.json",
    "html": "https://brambrinkmeier.com/entra/aadsts/900023/"
  },
  "description": "AADSTS900023: the tenant in the sign-in URL is not a valid tenant ID or domain. Not in Microsoft's error list. Causes and fix.",
  "summary": "AADSTS900023 means the tenant part of the sign-in URL isn't a valid tenant ID or domain name at all, for example 'undefined', a stray character or an empty setting. Microsoft's error reference doesn't list it. It is a configuration error with no attack value. Put the real tenant ID (a GUID) or a verified domain in the app's settings.",
  "inMicrosoftReference": false,
  "unlistedChecked": "2026-10-30",
  "meaningText": "Microsoft's [error code reference](https://learn.microsoft.com/entra/identity-platform/reference-error-codes) doesn't list AADSTS900023 (checked 30 October 2026).\n\nThe lab reproduced it. A token request to the tenant segment `not_a_valid~tenant` returned:\n\n> AADSTS900023: Specified tenant identifier 'not_a_valid~tenant' is neither a valid DNS name, nor a valid external domain.\n\nEvery sign-in URL names a tenant: `https://login.microsoftonline.com/<tenant>/...`. Microsoft's MSAL configuration page says that part can be *\"A GUID (the ID of your Microsoft Entra instance)\"*, *\"A domain name associated with your Microsoft Entra instance\"*, or one of the placeholders `organizations`, `consumers` or `common`.\n\n900023 means the value matches none of those shapes. Our reading: Entra rejects it on its form, before it looks for a tenant. Compare [AADSTS90002](https://brambrinkmeier.com/entra/aadsts/90002/): in the same lab run, a well-formed GUID for a tenant that doesn't exist returned 90002 (\"Tenant ... not found\"), not 900023.",
  "sections": [
    {
      "heading": "What does AADSTS900023 mean?",
      "text": "Microsoft's [error code reference](https://learn.microsoft.com/entra/identity-platform/reference-error-codes) doesn't list AADSTS900023 (checked 30 October 2026).\n\nThe lab reproduced it. A token request to the tenant segment `not_a_valid~tenant` returned:\n\n> AADSTS900023: Specified tenant identifier 'not_a_valid~tenant' is neither a valid DNS name, nor a valid external domain.\n\nEvery sign-in URL names a tenant: `https://login.microsoftonline.com/<tenant>/...`. Microsoft's MSAL configuration page says that part can be *\"A GUID (the ID of your Microsoft Entra instance)\"*, *\"A domain name associated with your Microsoft Entra instance\"*, or one of the placeholders `organizations`, `consumers` or `common`.\n\n900023 means the value matches none of those shapes. Our reading: Entra rejects it on its form, before it looks for a tenant. Compare [AADSTS90002](https://brambrinkmeier.com/entra/aadsts/90002/): in the same lab run, a well-formed GUID for a tenant that doesn't exist returned 90002 (\"Tenant ... not found\"), not 900023."
    },
    {
      "heading": "Reproduced in the lab",
      "text": "On 30 October 2026 an automated lab run sent a token request to `https://login.microsoftonline.com/not_a_valid~tenant/...`. Entra returned `AADSTS900023` with the first line quoted above. The message echoes the bad value back, which is the fastest way to see what the app actually sent.\n\nThat confirms the code and its wording at the token endpoint. No row for it appeared in the lab tenant's exported sign-in logs (interactive, non-interactive and service principal, exported 30 October 2026). Our reading: there is no tenant to write it to, because the request named none; see [how pages are checked](https://brambrinkmeier.com/methodology/)."
    },
    {
      "heading": "Is it an attack?",
      "text": "No. It is a broken setting in the app, script or integration that sent the request. Users report these causes:\n\n| Value in the message | Likely meaning |\n|---|---|\n| `'undefined'` | The code built the URL from a variable that was never set. A post on the Auth0 Community forum reports it when the connection has no `domain` and `tenant_domain` set. |\n| A value with a stray or wrong character | A typo or copy-paste error. A user on [Microsoft Q&A](https://learn.microsoft.com/en-us/answers/a/1360543) found *\"an incorrect character in the Tenant ID for the integration\"*. |\n| The tenant field of a third-party integration | A misconfigured tenant value in the product's settings. Okta reports this for its Office 365 integration. |\n| Empty, a placeholder, or a whole URL | Probably a config template that was never filled in, or the wrong field pasted (unconfirmed). |\n\nOur reading: an attacker gains nothing from this error. The request never reaches a tenant, so it says nothing about yours."
    },
    {
      "heading": "How do I find it in my logs (KQL)?",
      "text": "Microsoft doesn't document which sign-in table 900023 is logged in. Likely no row is written in your tenant: the request named no valid tenant, so Entra can't tell whose logs it belongs in. You can check; expect nothing:\n\n```kusto\nunion withsource=SourceTable SigninLogs, AADNonInteractiveUserSignInLogs, AADServicePrincipalSignInLogs\n| where TimeGenerated > ago(30d)\n| where ResultType == \"900023\"\n| summarize Rows = count() by SourceTable\n```\n\nDebug from the app side instead: its logs, its config, and the error message, which shows the exact tenant value it sent."
    },
    {
      "heading": "How do I fix AADSTS900023?",
      "text": "**For the user:** you can't fix this yourself. Report the app name and the full error message to whoever set the app up.\n\n**For developers:**\n1. Read the tenant value in the message. That is what your code sent.\n2. If it says `undefined` or `null`, find the variable or setting that builds the authority URL and make sure it is set in every environment.\n3. Use a tenant GUID, a verified domain such as `contoso.onmicrosoft.com`, or `organizations` / `common` / `consumers`. Those are the values Microsoft documents for the authority.\n4. Remove spaces, quotes and other characters that came along in a copy-paste.\n\n**For admins:**\n1. Get your tenant ID. Microsoft's page on finding it says to use **Entra ID** > **Overview** > **Properties** in the Entra admin center, or `Get-AzTenant` in Azure PowerShell:\n\n```powershell\nConnect-AzAccount\nGet-AzTenant\n```\n\n2. Paste it into the integration's tenant field again. For Auth0, check the connection's `domain` and `tenant_domain` options; the Auth0 Community post warns that an update to `options` drops values you leave out.\n3. If the integration still fails with [AADSTS90002](https://brambrinkmeier.com/entra/aadsts/90002/), the value is now well-formed but names the wrong tenant or cloud."
    }
  ],
  "microsoftWording": {
    "text": "AADSTS900023: Specified tenant identifier 'not_a_valid~tenant' is neither a valid DNS name, nor a valid external domain.",
    "source": "Quoted on the page from the lab or from user reports; the code is not in Microsoft's error code reference",
    "sourceUrl": null
  },
  "securityReading": {
    "category": {
      "id": "app-config",
      "label": "App configuration"
    },
    "kind": {
      "id": "config",
      "label": "Configuration error"
    },
    "attackSignal": {
      "level": "low",
      "label": "Low: usually configuration or user error"
    },
    "mitre": [],
    "tables": [],
    "isItAnAttack": "No. It is a broken setting in the app, script or integration that sent the request. Users report these causes:\n\n| Value in the message | Likely meaning |\n|---|---|\n| `'undefined'` | The code built the URL from a variable that was never set. A post on the Auth0 Community forum reports it when the connection has no `domain` and `tenant_domain` set. |\n| A value with a stray or wrong character | A typo or copy-paste error. A user on [Microsoft Q&A](https://learn.microsoft.com/en-us/answers/a/1360543) found *\"an incorrect character in the Tenant ID for the integration\"*. |\n| The tenant field of a third-party integration | A misconfigured tenant value in the product's settings. Okta reports this for its Office 365 integration. |\n| Empty, a placeholder, or a whole URL | Probably a config template that was never filled in, or the wrong field pasted (unconfirmed). |\n\nOur reading: an attacker gains nothing from this error. The request never reaches a tenant, so it says nothing about yours.",
    "conditionalAccess": null
  },
  "kql": [
    {
      "title": null,
      "leadIn": "Microsoft doesn't document which sign-in table 900023 is logged in. Likely no row is written in your tenant: the request named no valid tenant, so Entra can't tell whose logs it belongs in. You can check; expect nothing:",
      "query": "union withsource=SourceTable SigninLogs, AADNonInteractiveUserSignInLogs, AADServicePrincipalSignInLogs\n| where TimeGenerated > ago(30d)\n| where ResultType == \"900023\"\n| summarize Rows = count() by SourceTable"
    }
  ],
  "kqlSectionText": "Microsoft doesn't document which sign-in table 900023 is logged in. Likely no row is written in your tenant: the request named no valid tenant, so Entra can't tell whose logs it belongs in. You can check; expect nothing:\n\n```kusto\nunion withsource=SourceTable SigninLogs, AADNonInteractiveUserSignInLogs, AADServicePrincipalSignInLogs\n| where TimeGenerated > ago(30d)\n| where ResultType == \"900023\"\n| summarize Rows = count() by SourceTable\n```\n\nDebug from the app side instead: its logs, its config, and the error message, which shows the exact tenant value it sent.",
  "fix": {
    "short": "Developer: read the tenant value in the message and set the authority to a tenant GUID, a verified domain, or `organizations`/`common`/`consumers`. Fix unset variables and stray copy-paste characters. Admin: copy the tenant ID from Entra ID > Overview into the integration again.",
    "steps": "**For the user:** you can't fix this yourself. Report the app name and the full error message to whoever set the app up.\n\n**For developers:**\n1. Read the tenant value in the message. That is what your code sent.\n2. If it says `undefined` or `null`, find the variable or setting that builds the authority URL and make sure it is set in every environment.\n3. Use a tenant GUID, a verified domain such as `contoso.onmicrosoft.com`, or `organizations` / `common` / `consumers`. Those are the values Microsoft documents for the authority.\n4. Remove spaces, quotes and other characters that came along in a copy-paste.\n\n**For admins:**\n1. Get your tenant ID. Microsoft's page on finding it says to use **Entra ID** > **Overview** > **Properties** in the Entra admin center, or `Get-AzTenant` in Azure PowerShell:\n\n```powershell\nConnect-AzAccount\nGet-AzTenant\n```\n\n2. Paste it into the integration's tenant field again. For Auth0, check the connection's `domain` and `tenant_domain` options; the Auth0 Community post warns that an update to `options` drops values you leave out.\n3. If the integration still fails with [AADSTS90002](https://brambrinkmeier.com/entra/aadsts/90002/), the value is now well-formed but names the wrong tenant or cloud."
  },
  "labReproduced": {
    "date": "2026-10-30",
    "method": "ROPC and other token-endpoint requests against a lab tenant",
    "scenario": "Malformed tenant identifier",
    "message": "AADSTS900023: Specified tenant identifier 'not_a_valid~tenant' is neither a valid DNS name, nor a valid external domain.",
    "logCaptured": null,
    "kqlTested": null
  },
  "labSectionText": "On 30 October 2026 an automated lab run sent a token request to `https://login.microsoftonline.com/not_a_valid~tenant/...`. Entra returned `AADSTS900023` with the first line quoted above. The message echoes the bad value back, which is the fastest way to see what the app actually sent.\n\nThat confirms the code and its wording at the token endpoint. No row for it appeared in the lab tenant's exported sign-in logs (interactive, non-interactive and service principal, exported 30 October 2026). Our reading: there is no tenant to write it to, because the request named none; see [how pages are checked](https://brambrinkmeier.com/methodology/).",
  "labRuns": [
    {
      "date": "2026-10-30",
      "run": "round 4",
      "method": "token-endpoint requests against a lab tenant",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/67",
      "scenario": "Malformed tenant identifier",
      "expected": "900023",
      "got": "900023",
      "matchedExpectation": true,
      "message": "AADSTS900023: Specified tenant identifier 'not_a_valid~tenant' is neither a valid DNS name, nor a valid external domain."
    },
    {
      "date": "2026-10-30",
      "run": "round 5",
      "method": "token-endpoint requests against a lab tenant, using lab-created test apps",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/69",
      "scenario": "Malformed tenant identifier",
      "expected": "900023",
      "got": "900023",
      "matchedExpectation": true,
      "message": "AADSTS900023: Specified tenant identifier 'not_a_valid~tenant' is neither a valid DNS name, nor a valid external domain."
    },
    {
      "date": "2026-10-30",
      "run": "round 5 (first attempt)",
      "method": "token-endpoint requests against a lab tenant",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/68",
      "scenario": "Malformed tenant identifier",
      "expected": "900023",
      "got": "900023",
      "matchedExpectation": true,
      "message": "AADSTS900023: Specified tenant identifier 'not_a_valid~tenant' is neither a valid DNS name, nor a valid external domain."
    },
    {
      "date": "2026-10-30",
      "run": "round 6",
      "method": "token-endpoint requests against a lab tenant, using lab-created test apps",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/70",
      "scenario": "Malformed tenant identifier",
      "expected": "900023",
      "got": "900023",
      "matchedExpectation": true,
      "message": "AADSTS900023: Specified tenant identifier 'not_a_valid~tenant' is neither a valid DNS name, nor a valid external domain."
    },
    {
      "date": "2026-10-30",
      "run": "round 7",
      "method": "token-endpoint requests against a lab tenant",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/71",
      "scenario": "Malformed tenant identifier",
      "expected": "900023",
      "got": "900023",
      "matchedExpectation": true,
      "message": "AADSTS900023: Specified tenant identifier 'not_a_valid~tenant' is neither a valid DNS name, nor a valid external domain."
    },
    {
      "date": "2026-10-30",
      "run": null,
      "method": "ROPC and other token-endpoint requests against a lab tenant",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/66",
      "scenario": "Malformed tenant identifier",
      "expected": "900023",
      "got": "900023",
      "matchedExpectation": true,
      "message": "AADSTS900023: Specified tenant identifier 'not_a_valid~tenant' is neither a valid DNS name, nor a valid external domain."
    },
    {
      "date": "2026-10-31",
      "run": "round 8",
      "method": "token-endpoint and device-code requests against a lab tenant",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/72",
      "scenario": "Malformed tenant identifier",
      "expected": "900023",
      "got": "900023",
      "matchedExpectation": true,
      "message": "AADSTS900023: Specified tenant identifier 'not_a_valid~tenant' is neither a valid DNS name, nor a valid external domain."
    },
    {
      "date": "2026-10-31",
      "run": "round 9",
      "method": "token-endpoint and device-code requests against a lab tenant",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/73",
      "scenario": "Malformed tenant identifier",
      "expected": "900023",
      "got": "900023",
      "matchedExpectation": true,
      "message": "AADSTS900023: Specified tenant identifier 'not_a_valid~tenant' is neither a valid DNS name, nor a valid external domain."
    }
  ],
  "verification": "lab-reproduced",
  "related": [
    "90002",
    "700016",
    "900144",
    "9002313",
    "50059",
    "90019"
  ],
  "coveredBy": [],
  "sources": [
    {
      "title": "Microsoft Entra authentication and authorization error codes",
      "url": "https://learn.microsoft.com/entra/identity-platform/reference-error-codes"
    },
    {
      "title": "Application configuration options (MSAL)",
      "url": "https://learn.microsoft.com/en-us/entra/identity-platform/msal-client-application-configuration"
    },
    {
      "title": "Auth0 Community: AADSTS900023 Specified tenant identifier 'undefined' is neither a valid DNS name",
      "url": "https://community.auth0.com/t/azure-entra-connection-error-aadsts900023-specified-tenant-identifier-undefined-is-neither-a-valid-dns-name/122970"
    },
    {
      "title": "Okta: Microsoft Office 365 error AADSTS900023 occurs when authenticating API credentials in Okta",
      "url": "https://support.okta.com/help/s/article/microsoft-office-365-error-aadsts900023-occurs-when-authenticating-api-credentials-in-okta"
    },
    {
      "title": "Microsoft Q&A: Microsoft Graph API - AADSTS900023",
      "url": "https://learn.microsoft.com/en-us/answers/a/1360543"
    },
    {
      "title": "How to find your Microsoft Entra tenant ID",
      "url": "https://learn.microsoft.com/en-us/entra/fundamentals/how-to-find-tenant"
    },
    {
      "title": "SigninLogs table reference (Azure Monitor)",
      "url": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/signinlogs"
    }
  ],
  "published": "2026-10-30",
  "lastUpdated": "2026-10-30",
  "lastVerified": null,
  "license": "CC BY 4.0",
  "licenseUrl": "https://creativecommons.org/licenses/by/4.0/",
  "licenseNote": "CC BY 4.0 covers the author's own text and classification fields. Quoted Microsoft error wording belongs to Microsoft, is quoted with its source and can change.",
  "attribution": "Bram Brinkmeier, \"AADSTS900023: Tenant identifier is not a valid tenant ID or domain (fix)\", https://brambrinkmeier.com/entra/aadsts/900023/ (CC BY 4.0)",
  "microsoftErrorLookup": "https://login.microsoftonline.com/error?code=900023"
}