{
  "schemaVersion": "1.0",
  "code": "90019",
  "name": "MissingTenantRealm",
  "title": "AADSTS90019 fix: no tenant found in the sign-in request",
  "url": "https://brambrinkmeier.com/entra/aadsts/90019/",
  "alternates": {
    "markdown": "https://brambrinkmeier.com/entra/aadsts/90019.md",
    "json": "https://brambrinkmeier.com/api/aadsts/90019.json",
    "html": "https://brambrinkmeier.com/entra/aadsts/90019/"
  },
  "description": "AADSTS90019: Entra couldn't tell which tenant the sign-in was for. Use the full email address or a tenant-specific authority. Low attack value.",
  "summary": "AADSTS90019 means Microsoft Entra ID couldn't work out which tenant a sign-in was for: the request didn't name one and the credentials didn't imply one. Users often see it in Outlook or the browser after typing a short username. Our reading: developers can hit it when an app uses the `common` endpoint with no user or tenant hint. It is a configuration or input error with low attack value.",
  "inMicrosoftReference": true,
  "unlistedChecked": null,
  "meaningText": "Microsoft's description:\n\n> **MissingTenantRealm**: Microsoft Entra ID was unable to determine the tenant identifier from the request.\n\nThe message users post is longer: *\"No tenant-identifying information found in either the request or implied by any provided credentials.\"* Entra ID didn't know which organisation's directory to use, so, our reading, it stopped before checking anything else.\n\nEntra ID gets the tenant from one of two places:\n\n- **The URL.** In the authority `https://login.microsoftonline.com/<tenant>/`, Microsoft says *\"the `<tenant>` in the URL is the tenant ID of the Microsoft Entra tenant (a GUID), or its tenant domain.\"*\n- **The user.** On the common sign-in page users *\"enter a user principal name (UPN). Microsoft Entra ID uses this information to determine the correct sign-in location.\"* Microsoft calls this Home Realm Discovery.\n\nOur reading: 90019 is what you get when neither source gives an answer. The request went to `common` or `organizations`, and there was no username with a known domain, no hint, and no credential that points at a tenant.\n\nDon't confuse it with two codes that already have pages. [90002](https://brambrinkmeier.com/entra/aadsts/90002/) means a tenant value was sent but no such tenant exists. [900023](https://brambrinkmeier.com/entra/aadsts/900023/) means the tenant value isn't a valid tenant ID or domain at all. With 90019 there was no tenant value to check.",
  "sections": [
    {
      "heading": "What does AADSTS90019 mean?",
      "text": "Microsoft's description:\n\n> **MissingTenantRealm**: Microsoft Entra ID was unable to determine the tenant identifier from the request.\n\nThe message users post is longer: *\"No tenant-identifying information found in either the request or implied by any provided credentials.\"* Entra ID didn't know which organisation's directory to use, so, our reading, it stopped before checking anything else.\n\nEntra ID gets the tenant from one of two places:\n\n- **The URL.** In the authority `https://login.microsoftonline.com/<tenant>/`, Microsoft says *\"the `<tenant>` in the URL is the tenant ID of the Microsoft Entra tenant (a GUID), or its tenant domain.\"*\n- **The user.** On the common sign-in page users *\"enter a user principal name (UPN). Microsoft Entra ID uses this information to determine the correct sign-in location.\"* Microsoft calls this Home Realm Discovery.\n\nOur reading: 90019 is what you get when neither source gives an answer. The request went to `common` or `organizations`, and there was no username with a known domain, no hint, and no credential that points at a tenant.\n\nDon't confuse it with two codes that already have pages. [90002](https://brambrinkmeier.com/entra/aadsts/90002/) means a tenant value was sent but no such tenant exists. [900023](https://brambrinkmeier.com/entra/aadsts/900023/) means the tenant value isn't a valid tenant ID or domain at all. With 90019 there was no tenant value to check."
    },
    {
      "heading": "Is it an attack?",
      "text": "Rarely. Our reading: the request fails before any user, password or app in your tenant is looked at. Users report it in ordinary situations:\n\n- A university helpdesk sees it when students sign in to **Outlook**. Their advice is to enter the full email address, retype saved credentials, and try another browser or a private window.\n- TheWindowsClub reports it for Office 365 and Skype for Business sign-ins.\n- Quest has a knowledge base entry for it in Essentials for Office 365, a migration tool, which suggests admin tools and integrations hit it too.\n\n| Pattern | Likely meaning |\n|---|---|\n| One user, one app, then a success | The user typed a short username or a saved credential was wrong. Benign. |\n| Every run of a script or service fails | The script sends an app-only request to `common` or `organizations`. A developer error. |\n| A third-party federation or migration tool fails for everyone | The tool's tenant or domain setting is empty or wrong. Configuration. |\n\nOur reading: since Entra ID didn't find a tenant, it may not write the failure to your tenant's sign-in log at all. Microsoft doesn't document this. An empty result from the queries below doesn't prove users aren't hitting it; ask them for the error page details."
    },
    {
      "heading": "How do I find it in my logs (KQL)?",
      "text": "Microsoft doesn't document which sign-in table 90019 lands in, or whether it reaches a tenant's log at all. Check your workspace:\n\n```kusto\nunion withsource=SourceTable SigninLogs, AADNonInteractiveUserSignInLogs, AADServicePrincipalSignInLogs\n| where TimeGenerated > ago(30d)\n| where ResultType == \"90019\"\n| summarize Rows = count(), Apps = dcount(AppId) by SourceTable\n```\n\nIf rows exist, see which app, client and user agent produce them:\n\n```kusto\nunion SigninLogs, AADNonInteractiveUserSignInLogs\n| where TimeGenerated > ago(30d)\n| where ResultType == \"90019\"\n| summarize Rows = count(),\n            Users = dcount(UserPrincipalName),\n            Clients = make_set(ClientAppUsed, 5),\n            Agents = make_set(UserAgent, 5),\n            FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)\n          by AppDisplayName, AppId\n| sort by Rows desc\n```\n\n`ResultType` is a **string** column, so compare it with `\"90019\"`, not `90019`."
    },
    {
      "heading": "How do I fix AADSTS90019?",
      "text": "**For the user:**\n1. Sign in with your **full work email address** (for example `{user-principal-name}`), not just your username. Entra ID uses the domain part to find your organisation.\n2. If a password manager or the app filled in the name, retype it yourself.\n3. Users report that a private browser window, clearing the browser cache, or another browser also helps. If none of that works, send your IT helpdesk the error details.\n\n**For developers:**\n1. If your app serves one organisation, put the tenant ID (GUID) or a verified domain in the authority: `https://login.microsoftonline.com/<tenant>/`.\n2. For app-only requests (client credentials), the token request needs a tenant. Microsoft's reference marks `tenant` as **Required**: *\"The directory tenant the application plans to operate against, in GUID or domain-name format.\"*\n3. For a multitenant app on `common` or `organizations`, give Entra ID a way to find the tenant: a `login_hint` with the user's address, or a domain hint. Microsoft lists the domain hint per protocol: `domain_hint` for OpenID Connect, `whr` for WS-Federation, and a domain hint or `whr` for SAML.\n\n**For admins:**\n1. For a third-party tool or federation service (a migration tool, a WS-Federation identity provider), check that its tenant or domain setting is filled in with your tenant ID or a verified domain.\n2. Check that users' sign-in names use a domain verified in your tenant. Microsoft notes that sign-in uses *\"organization and user settings for the username entered on the sign-in page.\"*"
    }
  ],
  "microsoftWording": {
    "text": "**MissingTenantRealm**: Microsoft Entra ID was unable to determine the tenant identifier from the request.",
    "source": "Microsoft's error code reference, as quoted on the page",
    "sourceUrl": "https://learn.microsoft.com/en-us/entra/identity-platform/reference-error-codes"
  },
  "securityReading": {
    "category": {
      "id": "request",
      "label": "Graph request shape"
    },
    "kind": {
      "id": "failure",
      "label": "Failure"
    },
    "attackSignal": {
      "level": "low",
      "label": "Low: usually configuration or user error"
    },
    "mitre": [],
    "tables": [],
    "isItAnAttack": "Rarely. Our reading: the request fails before any user, password or app in your tenant is looked at. Users report it in ordinary situations:\n\n- A university helpdesk sees it when students sign in to **Outlook**. Their advice is to enter the full email address, retype saved credentials, and try another browser or a private window.\n- TheWindowsClub reports it for Office 365 and Skype for Business sign-ins.\n- Quest has a knowledge base entry for it in Essentials for Office 365, a migration tool, which suggests admin tools and integrations hit it too.\n\n| Pattern | Likely meaning |\n|---|---|\n| One user, one app, then a success | The user typed a short username or a saved credential was wrong. Benign. |\n| Every run of a script or service fails | The script sends an app-only request to `common` or `organizations`. A developer error. |\n| A third-party federation or migration tool fails for everyone | The tool's tenant or domain setting is empty or wrong. Configuration. |\n\nOur reading: since Entra ID didn't find a tenant, it may not write the failure to your tenant's sign-in log at all. Microsoft doesn't document this. An empty result from the queries below doesn't prove users aren't hitting it; ask them for the error page details.",
    "conditionalAccess": null
  },
  "kql": [
    {
      "title": null,
      "leadIn": "Microsoft doesn't document which sign-in table 90019 lands in, or whether it reaches a tenant's log at all. Check your workspace:",
      "query": "union withsource=SourceTable SigninLogs, AADNonInteractiveUserSignInLogs, AADServicePrincipalSignInLogs\n| where TimeGenerated > ago(30d)\n| where ResultType == \"90019\"\n| summarize Rows = count(), Apps = dcount(AppId) by SourceTable"
    },
    {
      "title": null,
      "leadIn": "If rows exist, see which app, client and user agent produce them:",
      "query": "union SigninLogs, AADNonInteractiveUserSignInLogs\n| where TimeGenerated > ago(30d)\n| where ResultType == \"90019\"\n| summarize Rows = count(),\n            Users = dcount(UserPrincipalName),\n            Clients = make_set(ClientAppUsed, 5),\n            Agents = make_set(UserAgent, 5),\n            FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)\n          by AppDisplayName, AppId\n| sort by Rows desc"
    }
  ],
  "kqlSectionText": "Microsoft doesn't document which sign-in table 90019 lands in, or whether it reaches a tenant's log at all. Check your workspace:\n\n```kusto\nunion withsource=SourceTable SigninLogs, AADNonInteractiveUserSignInLogs, AADServicePrincipalSignInLogs\n| where TimeGenerated > ago(30d)\n| where ResultType == \"90019\"\n| summarize Rows = count(), Apps = dcount(AppId) by SourceTable\n```\n\nIf rows exist, see which app, client and user agent produce them:\n\n```kusto\nunion SigninLogs, AADNonInteractiveUserSignInLogs\n| where TimeGenerated > ago(30d)\n| where ResultType == \"90019\"\n| summarize Rows = count(),\n            Users = dcount(UserPrincipalName),\n            Clients = make_set(ClientAppUsed, 5),\n            Agents = make_set(UserAgent, 5),\n            FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)\n          by AppDisplayName, AppId\n| sort by Rows desc\n```\n\n`ResultType` is a **string** column, so compare it with `\"90019\"`, not `90019`.",
  "fix": {
    "short": "User: sign in with your full work email address ({user-principal-name}), not a short username, and retype saved credentials. Developer: put your tenant ID or verified domain in the authority URL, or send a `login_hint` or `domain_hint` when you use `common` or `organizations`.",
    "steps": "**For the user:**\n1. Sign in with your **full work email address** (for example `{user-principal-name}`), not just your username. Entra ID uses the domain part to find your organisation.\n2. If a password manager or the app filled in the name, retype it yourself.\n3. Users report that a private browser window, clearing the browser cache, or another browser also helps. If none of that works, send your IT helpdesk the error details.\n\n**For developers:**\n1. If your app serves one organisation, put the tenant ID (GUID) or a verified domain in the authority: `https://login.microsoftonline.com/<tenant>/`.\n2. For app-only requests (client credentials), the token request needs a tenant. Microsoft's reference marks `tenant` as **Required**: *\"The directory tenant the application plans to operate against, in GUID or domain-name format.\"*\n3. For a multitenant app on `common` or `organizations`, give Entra ID a way to find the tenant: a `login_hint` with the user's address, or a domain hint. Microsoft lists the domain hint per protocol: `domain_hint` for OpenID Connect, `whr` for WS-Federation, and a domain hint or `whr` for SAML.\n\n**For admins:**\n1. For a third-party tool or federation service (a migration tool, a WS-Federation identity provider), check that its tenant or domain setting is filled in with your tenant ID or a verified domain.\n2. Check that users' sign-in names use a domain verified in your tenant. Microsoft notes that sign-in uses *\"organization and user settings for the username entered on the sign-in page.\"*"
  },
  "labReproduced": null,
  "labSectionText": null,
  "labRuns": [],
  "verification": "documentation",
  "related": [
    "90002",
    "900023",
    "50034",
    "700016"
  ],
  "coveredBy": [],
  "sources": [
    {
      "title": "Microsoft Entra authentication and authorization error codes",
      "url": "https://learn.microsoft.com/entra/identity-platform/reference-error-codes"
    },
    {
      "title": "Application configuration options (MSAL): Authority",
      "url": "https://learn.microsoft.com/en-us/entra/identity-platform/msal-client-application-configuration"
    },
    {
      "title": "Microsoft identity platform and the OAuth 2.0 client credentials flow",
      "url": "https://learn.microsoft.com/entra/identity-platform/v2-oauth2-client-creds-grant-flow"
    },
    {
      "title": "Home Realm Discovery for an application",
      "url": "https://learn.microsoft.com/entra/identity/enterprise-apps/home-realm-discovery-policy"
    },
    {
      "title": "Username lookup during sign-in (sign-in realm discovery)",
      "url": "https://learn.microsoft.com/en-us/entra/identity/users/signin-realm-discovery"
    },
    {
      "title": "Receiving error code AADSTS90019 in Outlook (CCAC help center, user report)",
      "url": "https://helpcenter.ccac.edu/137393-outlook/receiving-error-code-aadsts90019-in-outlook"
    },
    {
      "title": "AADSTS90019: No tenant-identifying information found (TheWindowsClub, user report)",
      "url": "https://www.thewindowsclub.com/aadsts90019-no-tenant-identifying-information-found"
    },
    {
      "title": "AADSTS90019 (Quest Essentials for Office 365 KB 4230157, user report)",
      "url": "https://support.quest.com/ja-jp/kb/4230157/aadsts90019-no-tenant-identifying-information-found-in-either-the-request-or-implied-by-any-provided-credentials"
    }
  ],
  "published": "2026-11-01",
  "lastUpdated": "2026-11-01",
  "lastVerified": null,
  "license": "CC BY 4.0",
  "licenseUrl": "https://creativecommons.org/licenses/by/4.0/",
  "licenseNote": "CC BY 4.0 covers the author's own text and classification fields. Quoted Microsoft error wording belongs to Microsoft, is quoted with its source and can change.",
  "attribution": "Bram Brinkmeier, \"AADSTS90019 fix: no tenant found in the sign-in request\", https://brambrinkmeier.com/entra/aadsts/90019/ (CC BY 4.0)",
  "microsoftErrorLookup": "https://login.microsoftonline.com/error?code=90019"
}