{
  "schemaVersion": "1.0",
  "code": "9002331",
  "name": null,
  "title": "AADSTS9002331: App is for personal Microsoft accounts only (fix)",
  "url": "https://brambrinkmeier.com/entra/aadsts/9002331/",
  "alternates": {
    "markdown": "https://brambrinkmeier.com/entra/aadsts/9002331.md",
    "json": "https://brambrinkmeier.com/api/aadsts/9002331.json",
    "html": "https://brambrinkmeier.com/entra/aadsts/9002331/"
  },
  "description": "AADSTS9002331: the app is for personal Microsoft accounts only and the request didn't use /consumers. Not in Microsoft's error list. Fixes and KQL.",
  "summary": "AADSTS9002331 means the app is registered for personal Microsoft accounts only, but the sign-in didn't use the /consumers endpoint, or a work account tried to use it. Microsoft's error reference doesn't list it. Low attack value. Use the /consumers endpoint, or change the app's supported account types.",
  "inMicrosoftReference": false,
  "unlistedChecked": "2026-10-30",
  "meaningText": "Microsoft's [error code reference](https://learn.microsoft.com/entra/identity-platform/reference-error-codes) doesn't list AADSTS9002331 (checked 30 October 2026).\n\nThe wording below comes from a user report on Microsoft Q&A. The user posted a screenshot; a Microsoft moderator quoted the text as:\n\n> AADSTS9002331: Application '...73f'(...Demo) is configured for use by Microsoft Account users only. Please use the /consumers endpoint to serve this request.\n\nThe moderator's explanation: the app registration allows only personal Microsoft accounts (`PersonalMicrosoftAccount`), and the error happens when a user from a Microsoft Entra tenant or another identity provider tries to sign in. The fix given was to change the app's supported account types. The thread doesn't confirm the fix.\n\nThe app setting behind it is **Supported account types**. Microsoft's signInAudience page maps **Personal Microsoft accounts only** to `signInAudience` value `PersonalMicrosoftAccount`.\n\n**A lab test on 30 October 2026 returned a different code for this case.** I registered an app with Supported account types set to personal Microsoft accounts only, then sent a password-grant request to my tenant's own endpoint. Entra answered with `AADSTS9002346`, not 9002331:\n\n> AADSTS9002346: Application '<app id>'(<app name>) is configured for use by Microsoft Account users only. Please use the /consumers endpoint to serve this request.\n\nThe wording is the same apart from the number. So on a current tenant this condition produces 9002346, while the user report above shows 9002331 for the same situation. Match on both if you are writing a rule, and see [9002346](https://brambrinkmeier.com/entra/aadsts/9002346/) for the lab-reproduced page.\n\nThe endpoint matters too. Microsoft's OpenID Connect reference describes the `{tenant}` values in the sign-in URL:\n\n| Value | Microsoft's description |\n|---|---|\n| `common` | Users with both a personal Microsoft account and a work or school account from Microsoft Entra ID can sign in to the application. |\n| `organizations` | Only users with work or school accounts from Microsoft Entra ID can sign in to the application. |\n| `consumers` | Only users with a personal Microsoft account can sign in to the application. |\n| tenant ID or domain | Only users from a specific Microsoft Entra tenant [...] can sign in to the application. |\n\nMicrosoft's error reference does list the reverse case, AADSTS9002332: *\"Application '{principalId}'({principalName}) is configured for use by Microsoft Entra users only. Please do not use the /consumers endpoint to serve this request.\"* Our reading: 9002331 is its mirror. A personal-accounts-only app was called on an endpoint other than `/consumers`.",
  "sections": [
    {
      "heading": "What does AADSTS9002331 mean?",
      "text": "Microsoft's [error code reference](https://learn.microsoft.com/entra/identity-platform/reference-error-codes) doesn't list AADSTS9002331 (checked 30 October 2026).\n\nThe wording below comes from a user report on Microsoft Q&A. The user posted a screenshot; a Microsoft moderator quoted the text as:\n\n> AADSTS9002331: Application '...73f'(...Demo) is configured for use by Microsoft Account users only. Please use the /consumers endpoint to serve this request.\n\nThe moderator's explanation: the app registration allows only personal Microsoft accounts (`PersonalMicrosoftAccount`), and the error happens when a user from a Microsoft Entra tenant or another identity provider tries to sign in. The fix given was to change the app's supported account types. The thread doesn't confirm the fix.\n\nThe app setting behind it is **Supported account types**. Microsoft's signInAudience page maps **Personal Microsoft accounts only** to `signInAudience` value `PersonalMicrosoftAccount`.\n\n**A lab test on 30 October 2026 returned a different code for this case.** I registered an app with Supported account types set to personal Microsoft accounts only, then sent a password-grant request to my tenant's own endpoint. Entra answered with `AADSTS9002346`, not 9002331:\n\n> AADSTS9002346: Application '<app id>'(<app name>) is configured for use by Microsoft Account users only. Please use the /consumers endpoint to serve this request.\n\nThe wording is the same apart from the number. So on a current tenant this condition produces 9002346, while the user report above shows 9002331 for the same situation. Match on both if you are writing a rule, and see [9002346](https://brambrinkmeier.com/entra/aadsts/9002346/) for the lab-reproduced page.\n\nThe endpoint matters too. Microsoft's OpenID Connect reference describes the `{tenant}` values in the sign-in URL:\n\n| Value | Microsoft's description |\n|---|---|\n| `common` | Users with both a personal Microsoft account and a work or school account from Microsoft Entra ID can sign in to the application. |\n| `organizations` | Only users with work or school accounts from Microsoft Entra ID can sign in to the application. |\n| `consumers` | Only users with a personal Microsoft account can sign in to the application. |\n| tenant ID or domain | Only users from a specific Microsoft Entra tenant [...] can sign in to the application. |\n\nMicrosoft's error reference does list the reverse case, AADSTS9002332: *\"Application '{principalId}'({principalName}) is configured for use by Microsoft Entra users only. Please do not use the /consumers endpoint to serve this request.\"* Our reading: 9002331 is its mirror. A personal-accounts-only app was called on an endpoint other than `/consumers`."
    },
    {
      "heading": "Is it an attack?",
      "text": "No. It is a mismatch between the app's supported account types and the sign-in endpoint or the account used.\n\n| Pattern | Likely meaning |\n|---|---|\n| A sample or tutorial app fails on first run | The app was registered as **Personal Microsoft accounts only** but the code uses a tenant ID, `/organizations` or `/common`. Our interpretation. |\n| A work account user can't sign in to an app that works for a personal account | The app was never meant for work accounts, or was registered with the wrong account type. |\n| A third-party product fails for your staff | The vendor's app is registered for personal accounts only. Only the vendor can change that. |"
    },
    {
      "heading": "How do I find it in my logs (KQL)?",
      "text": "Microsoft doesn't document which table 9002331 is logged in. Our reading: an app registered for personal accounts only usually has no service principal in your tenant, and a request on `/consumers` or `/common` may never reach your tenant at all. Expect few or no rows. Check anyway:\n\n```kusto\nunion withsource=SourceTable SigninLogs, AADNonInteractiveUserSignInLogs, AADServicePrincipalSignInLogs\n| where TimeGenerated > ago(30d)\n| where ResultType == \"9002331\"\n| summarize Rows = count(), Apps = make_set(AppId, 10) by SourceTable\n```"
    },
    {
      "heading": "How do I fix AADSTS9002331?",
      "text": "**For the user:** if you have a personal Microsoft account (Outlook.com, Hotmail, Xbox), try that one. If the app should work with your work account, report it to the app's owner.\n\n**For developers:**\n1. Decide who the app is for. Personal accounts only: sign in through `https://login.microsoftonline.com/consumers/`. That is what the error message asks for.\n2. If work or school accounts must sign in too, change **Supported account types** on the app registration. The Microsoft moderator's fix was exactly this. Microsoft's signInAudience page lists the options and the validation rules that differ between them.\n3. For both personal and work accounts, use `AzureADandPersonalMicrosoftAccount` and the `/common` endpoint. Microsoft notes that with `common` or `consumers` *\"the consuming resource application must be configured to support such type of accounts\"*.\n\n**For admins:**\n1. If this is your own app registration, check **Supported account types** under the app's **Authentication** page, and agree the change with the developer.\n2. If it is a vendor's app, you can't change it. Ask the vendor for a version registered for work accounts."
    }
  ],
  "microsoftWording": {
    "text": "AADSTS9002331: Application '...73f'(...Demo) is configured for use by Microsoft Account users only. Please use the /consumers endpoint to serve this request.",
    "source": "Quoted on the page from the lab or from user reports; the code is not in Microsoft's error code reference",
    "sourceUrl": null
  },
  "securityReading": {
    "category": {
      "id": "app-config",
      "label": "App configuration"
    },
    "kind": {
      "id": "config",
      "label": "Configuration error"
    },
    "attackSignal": {
      "level": "low",
      "label": "Low: usually configuration or user error"
    },
    "mitre": [],
    "tables": [],
    "isItAnAttack": "No. It is a mismatch between the app's supported account types and the sign-in endpoint or the account used.\n\n| Pattern | Likely meaning |\n|---|---|\n| A sample or tutorial app fails on first run | The app was registered as **Personal Microsoft accounts only** but the code uses a tenant ID, `/organizations` or `/common`. Our interpretation. |\n| A work account user can't sign in to an app that works for a personal account | The app was never meant for work accounts, or was registered with the wrong account type. |\n| A third-party product fails for your staff | The vendor's app is registered for personal accounts only. Only the vendor can change that. |",
    "conditionalAccess": null
  },
  "kql": [
    {
      "title": null,
      "leadIn": "Microsoft doesn't document which table 9002331 is logged in. Our reading: an app registered for personal accounts only usually has no service principal in your tenant, and a request on `/consumers` or `/common` may never reach your tenant at all. Expect few or no rows. Check anyway:",
      "query": "union withsource=SourceTable SigninLogs, AADNonInteractiveUserSignInLogs, AADServicePrincipalSignInLogs\n| where TimeGenerated > ago(30d)\n| where ResultType == \"9002331\"\n| summarize Rows = count(), Apps = make_set(AppId, 10) by SourceTable"
    }
  ],
  "kqlSectionText": "Microsoft doesn't document which table 9002331 is logged in. Our reading: an app registered for personal accounts only usually has no service principal in your tenant, and a request on `/consumers` or `/common` may never reach your tenant at all. Expect few or no rows. Check anyway:\n\n```kusto\nunion withsource=SourceTable SigninLogs, AADNonInteractiveUserSignInLogs, AADServicePrincipalSignInLogs\n| where TimeGenerated > ago(30d)\n| where ResultType == \"9002331\"\n| summarize Rows = count(), Apps = make_set(AppId, 10) by SourceTable\n```",
  "fix": {
    "short": "Developer: for a personal-accounts-only app, sign in through `https://login.microsoftonline.com/consumers/`. If work or school accounts must sign in too, change Supported account types on the app registration. User: try your personal Microsoft account, or report it to the app's owner.",
    "steps": "**For the user:** if you have a personal Microsoft account (Outlook.com, Hotmail, Xbox), try that one. If the app should work with your work account, report it to the app's owner.\n\n**For developers:**\n1. Decide who the app is for. Personal accounts only: sign in through `https://login.microsoftonline.com/consumers/`. That is what the error message asks for.\n2. If work or school accounts must sign in too, change **Supported account types** on the app registration. The Microsoft moderator's fix was exactly this. Microsoft's signInAudience page lists the options and the validation rules that differ between them.\n3. For both personal and work accounts, use `AzureADandPersonalMicrosoftAccount` and the `/common` endpoint. Microsoft notes that with `common` or `consumers` *\"the consuming resource application must be configured to support such type of accounts\"*.\n\n**For admins:**\n1. If this is your own app registration, check **Supported account types** under the app's **Authentication** page, and agree the change with the developer.\n2. If it is a vendor's app, you can't change it. Ask the vendor for a version registered for work accounts."
  },
  "labReproduced": null,
  "labSectionText": null,
  "labRuns": [
    {
      "date": "2026-10-30",
      "run": "round 4",
      "method": "token-endpoint requests against a lab tenant",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/67",
      "scenario": "Device code requested on /consumers by a work-account app",
      "expected": "90133 / 9002331 / 700016",
      "got": "700016",
      "matchedExpectation": true,
      "message": "AADSTS700016: Application with identifier '{app-id}' was not found in the directory '{tenant-id}'. This can"
    },
    {
      "date": "2026-10-30",
      "run": "round 5",
      "method": "token-endpoint requests against a lab tenant, using lab-created test apps",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/69",
      "scenario": "Device code requested on /consumers by a work-account app",
      "expected": "90133 / 9002331 / 700016",
      "got": "700016",
      "matchedExpectation": true,
      "message": "AADSTS700016: Application with identifier '{app-id}' was not found in the directory '{tenant-id}'. This can"
    },
    {
      "date": "2026-10-30",
      "run": "round 5",
      "method": "token-endpoint requests against a lab tenant, using lab-created test apps",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/69",
      "scenario": "Personal-accounts-only app on a tenant endpoint",
      "expected": "9002331",
      "got": "9002346",
      "matchedExpectation": false,
      "message": "AADSTS9002346: Application '{app-id}'(lab-msa-only-41136574530) is configured for use by Microsoft Account users only. Please use th"
    },
    {
      "date": "2026-10-30",
      "run": "round 5 (first attempt)",
      "method": "token-endpoint requests against a lab tenant",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/68",
      "scenario": "Device code requested on /consumers by a work-account app",
      "expected": "90133 / 9002331 / 700016",
      "got": "700016",
      "matchedExpectation": true,
      "message": "AADSTS700016: Application with identifier '{app-id}' was not found in the directory '{tenant-id}'. This can"
    },
    {
      "date": "2026-10-30",
      "run": "round 6",
      "method": "token-endpoint requests against a lab tenant, using lab-created test apps",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/70",
      "scenario": "Device code requested on /consumers by a work-account app",
      "expected": "90133 / 9002331 / 700016",
      "got": "700016",
      "matchedExpectation": true,
      "message": "AADSTS700016: Application with identifier '{app-id}' was not found in the directory '{tenant-id}'. This can"
    },
    {
      "date": "2026-10-30",
      "run": "round 6",
      "method": "token-endpoint requests against a lab tenant, using lab-created test apps",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/70",
      "scenario": "Personal-accounts-only app on a tenant endpoint",
      "expected": "9002331",
      "got": "9002346",
      "matchedExpectation": false,
      "message": "AADSTS9002346: Application '{app-id}'(lab-msa-only-41139925607) is configured for use by Microsoft Account users only. Please use th"
    },
    {
      "date": "2026-10-30",
      "run": "round 7",
      "method": "token-endpoint requests against a lab tenant",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/71",
      "scenario": "Device code requested on /consumers by a work-account app",
      "expected": "90133 / 9002331 / 700016",
      "got": "700016",
      "matchedExpectation": true,
      "message": "AADSTS700016: Application with identifier '{app-id}' was not found in the directory '{tenant-id}'. This can"
    },
    {
      "date": "2026-10-30",
      "run": "round 7",
      "method": "token-endpoint requests against a lab tenant",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/71",
      "scenario": "Personal-accounts-only app on a tenant endpoint",
      "expected": "9002331",
      "got": "9002346",
      "matchedExpectation": false,
      "message": "AADSTS9002346: Application '{app-id}'(lab-msa-only-41143330001) is configured for use by Microsoft Account users only. Please use th"
    },
    {
      "date": "2026-10-30",
      "run": null,
      "method": "ROPC and other token-endpoint requests against a lab tenant",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/66",
      "scenario": "Device code requested on /consumers by a work-account app",
      "expected": "90133 / 9002331 / 700016",
      "got": "700016",
      "matchedExpectation": true,
      "message": "AADSTS700016: Application with identifier '{app-id}' was not found in the directory '{tenant-id}'. This can"
    },
    {
      "date": "2026-10-31",
      "run": "round 8",
      "method": "token-endpoint and device-code requests against a lab tenant",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/72",
      "scenario": "Device code requested on /consumers by a work-account app",
      "expected": "90133 / 9002331 / 700016",
      "got": "700016",
      "matchedExpectation": true,
      "message": "AADSTS700016: Application with identifier '{app-id}' was not found in the directory '{tenant-id}'. This can"
    },
    {
      "date": "2026-10-31",
      "run": "round 8",
      "method": "token-endpoint and device-code requests against a lab tenant",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/72",
      "scenario": "Personal-accounts-only app on a tenant endpoint",
      "expected": "9002331",
      "got": "9002346",
      "matchedExpectation": false,
      "message": "AADSTS9002346: Application '{app-id}'(lab-msa-only-41146039117) is configured for use by Microsoft Account users only. Please use th"
    },
    {
      "date": "2026-10-31",
      "run": "round 9",
      "method": "token-endpoint and device-code requests against a lab tenant",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/73",
      "scenario": "Device code requested on /consumers by a work-account app",
      "expected": "90133 / 9002331 / 700016",
      "got": "700016",
      "matchedExpectation": true,
      "message": "AADSTS700016: Application with identifier '{app-id}' was not found in the directory '{tenant-id}'. This can"
    },
    {
      "date": "2026-10-31",
      "run": "round 9",
      "method": "token-endpoint and device-code requests against a lab tenant",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/73",
      "scenario": "Personal-accounts-only app on a tenant endpoint",
      "expected": "9002331",
      "got": "9002346",
      "matchedExpectation": false,
      "message": "AADSTS9002346: Application '{app-id}'(lab-msa-only-41150019626) is configured for use by Microsoft Account users only. Please use th"
    }
  ],
  "verification": "documentation",
  "related": [
    "50020",
    "700016",
    "90002",
    "9002313",
    "50194",
    "9002346"
  ],
  "coveredBy": [],
  "sources": [
    {
      "title": "Microsoft Entra authentication and authorization error codes",
      "url": "https://learn.microsoft.com/entra/identity-platform/reference-error-codes"
    },
    {
      "title": "Microsoft Q&A: Access issue (1160493)",
      "url": "https://learn.microsoft.com/en-us/answers/questions/1160493/access-issue"
    },
    {
      "title": "OpenID Connect on the Microsoft identity platform",
      "url": "https://learn.microsoft.com/azure/active-directory/develop/v2-protocols-oidc"
    },
    {
      "title": "Validation differences by supported account types (signInAudience)",
      "url": "https://learn.microsoft.com/entra/identity-platform/supported-accounts-validation"
    },
    {
      "title": "SigninLogs table reference (Azure Monitor)",
      "url": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/signinlogs"
    }
  ],
  "published": "2026-10-30",
  "lastUpdated": "2026-10-30",
  "lastVerified": null,
  "license": "CC BY 4.0",
  "licenseUrl": "https://creativecommons.org/licenses/by/4.0/",
  "licenseNote": "CC BY 4.0 covers the author's own text and classification fields. Quoted Microsoft error wording belongs to Microsoft, is quoted with its source and can change.",
  "attribution": "Bram Brinkmeier, \"AADSTS9002331: App is for personal Microsoft accounts only (fix)\", https://brambrinkmeier.com/entra/aadsts/9002331/ (CC BY 4.0)",
  "microsoftErrorLookup": "https://login.microsoftonline.com/error?code=9002331"
}