{
  "schemaVersion": "1.0",
  "code": "9002346",
  "name": null,
  "title": "AADSTS9002346: App is for personal Microsoft accounts only (fix)",
  "url": "https://brambrinkmeier.com/entra/aadsts/9002346/",
  "alternates": {
    "markdown": "https://brambrinkmeier.com/entra/aadsts/9002346.md",
    "json": "https://brambrinkmeier.com/api/aadsts/9002346.json",
    "html": "https://brambrinkmeier.com/entra/aadsts/9002346/"
  },
  "description": "AADSTS9002346: the app is for personal Microsoft accounts only and the request used a tenant endpoint. Not in Microsoft's error list. Fix and KQL.",
  "summary": "AADSTS9002346 means the app registration is set to personal Microsoft accounts only, and the request went to a tenant endpoint instead of /consumers. Microsoft's error reference doesn't list it. It is a configuration error with low attack value. Either call /consumers, or change Supported account types on the app registration.",
  "inMicrosoftReference": false,
  "unlistedChecked": "2026-10-30",
  "meaningText": "Microsoft's [error code reference](https://learn.microsoft.com/entra/identity-platform/reference-error-codes) doesn't list AADSTS9002346 (checked 30 October 2026). We found no other Microsoft page that names it. The wording below is from a lab run:\n\n> AADSTS9002346: Application '\\<app id>'(\\<app name>) is configured for use by Microsoft Account users only. Please use th...\n\nThe lab records only the first line of `error_description`, cut at about 160 characters. The sentence completes as *\"Please use the /consumers endpoint to serve this request\"*, which is how the same message appears in a user report for the near-identical code [9002331](https://brambrinkmeier.com/entra/aadsts/9002331/).\n\nThe setting behind it is **Supported account types** on the app registration. Microsoft's signInAudience page maps the portal choices to manifest values:\n\n| Supported account types | `signInAudience` |\n|---|---|\n| Accounts in this organizational directory only (Single tenant) | `AzureADMyOrg` |\n| Accounts in any organizational directory (Any Microsoft Entra directory - Multitenant) | `AzureADMultipleOrgs` |\n| Accounts in any organizational directory ... and personal Microsoft accounts (such as Skype, Xbox) | `AzureADandPersonalMicrosoftAccount` |\n| Personal Microsoft accounts only | `PersonalMicrosoftAccount` |\n\nAn app at `PersonalMicrosoftAccount` exists only for consumer accounts, and consumer accounts sign in through `/consumers`. Microsoft's OpenID Connect reference describes the endpoint values:\n\n| Value | Microsoft's description |\n|---|---|\n| `common` | Users with both a personal Microsoft account and a work or school account from Microsoft Entra ID can sign in to the application. |\n| `organizations` | Only users with work or school accounts from Microsoft Entra ID can sign in to the application. |\n| `consumers` | Only users with a personal Microsoft account can sign in to the application. |\n| Directory (tenant) ID or domain | Only users from a specific Microsoft Entra tenant ... can sign in to the application. |\n\nSo the request named a tenant that the app does not serve. Microsoft's reference does list the mirror case, **AADSTS9002332**: *\"Application '{principalId}'({principalName}) is configured for use by Microsoft Entra users only. Please do not use the /consumers endpoint to serve this request.\"* 9002346 is the same check in the other direction.\n\n### 9002346 and 9002331\n[9002331](https://brambrinkmeier.com/entra/aadsts/9002331/) carries the same sentence with a different number. A Microsoft Q&A thread quotes it as *\"AADSTS9002331: Application '...73f'(...Demo) is configured for use by Microsoft Account users only. Please use the /consumers endpoint to serve this request.\"*, and a Microsoft moderator answers: *\"From your error message, it looks like your App Registration is set for users to sign-in using their `PersonalMicrosoftAccount` only.\"*\n\nOn a current tenant, the lab run below produced 9002346 for that condition, not 9002331. We can't tell from one tenant whether 9002331 is older, path-specific or flow-specific, so treat them as one condition and match on both in a detection rule.",
  "sections": [
    {
      "heading": "What does AADSTS9002346 mean?",
      "text": "Microsoft's [error code reference](https://learn.microsoft.com/entra/identity-platform/reference-error-codes) doesn't list AADSTS9002346 (checked 30 October 2026). We found no other Microsoft page that names it. The wording below is from a lab run:\n\n> AADSTS9002346: Application '\\<app id>'(\\<app name>) is configured for use by Microsoft Account users only. Please use th...\n\nThe lab records only the first line of `error_description`, cut at about 160 characters. The sentence completes as *\"Please use the /consumers endpoint to serve this request\"*, which is how the same message appears in a user report for the near-identical code [9002331](https://brambrinkmeier.com/entra/aadsts/9002331/).\n\nThe setting behind it is **Supported account types** on the app registration. Microsoft's signInAudience page maps the portal choices to manifest values:\n\n| Supported account types | `signInAudience` |\n|---|---|\n| Accounts in this organizational directory only (Single tenant) | `AzureADMyOrg` |\n| Accounts in any organizational directory (Any Microsoft Entra directory - Multitenant) | `AzureADMultipleOrgs` |\n| Accounts in any organizational directory ... and personal Microsoft accounts (such as Skype, Xbox) | `AzureADandPersonalMicrosoftAccount` |\n| Personal Microsoft accounts only | `PersonalMicrosoftAccount` |\n\nAn app at `PersonalMicrosoftAccount` exists only for consumer accounts, and consumer accounts sign in through `/consumers`. Microsoft's OpenID Connect reference describes the endpoint values:\n\n| Value | Microsoft's description |\n|---|---|\n| `common` | Users with both a personal Microsoft account and a work or school account from Microsoft Entra ID can sign in to the application. |\n| `organizations` | Only users with work or school accounts from Microsoft Entra ID can sign in to the application. |\n| `consumers` | Only users with a personal Microsoft account can sign in to the application. |\n| Directory (tenant) ID or domain | Only users from a specific Microsoft Entra tenant ... can sign in to the application. |\n\nSo the request named a tenant that the app does not serve. Microsoft's reference does list the mirror case, **AADSTS9002332**: *\"Application '{principalId}'({principalName}) is configured for use by Microsoft Entra users only. Please do not use the /consumers endpoint to serve this request.\"* 9002346 is the same check in the other direction.\n\n### 9002346 and 9002331\n[9002331](https://brambrinkmeier.com/entra/aadsts/9002331/) carries the same sentence with a different number. A Microsoft Q&A thread quotes it as *\"AADSTS9002331: Application '...73f'(...Demo) is configured for use by Microsoft Account users only. Please use the /consumers endpoint to serve this request.\"*, and a Microsoft moderator answers: *\"From your error message, it looks like your App Registration is set for users to sign-in using their `PersonalMicrosoftAccount` only.\"*\n\nOn a current tenant, the lab run below produced 9002346 for that condition, not 9002331. We can't tell from one tenant whether 9002331 is older, path-specific or flow-specific, so treat them as one condition and match on both in a detection rule."
    },
    {
      "heading": "Reproduced in the lab",
      "text": "On 30 October 2026 an automated lab run registered an app with **Supported account types** set to personal Microsoft accounts only, then sent a password-grant (ROPC) token request to the lab tenant's own endpoint, with a user from that tenant. Entra returned `AADSTS9002346`:\n\n> AADSTS9002346: Application '\\<app id>'(\\<app name>) is configured for use by Microsoft Account users only. Please use th...\n\nControl requests in the same run, using an ordinary single-tenant app on the same endpoint with the same user, reached the credential check and returned either a token or a credential error. So 9002346 is about the app's supported account types and the endpoint, not about the user or the password.\n\nNo sign-in log row was captured. See [how pages are checked](https://brambrinkmeier.com/methodology/).\n\nIn the lab tenant's sign-in logs the row appears under **User sign-ins (interactive)**, Status **Failure**, Conditional Access **Not Applied**, with the Application column naming the personal-accounts-only app."
    },
    {
      "heading": "Is it an attack?",
      "text": "No. The app's supported account types and the endpoint the code calls disagree.\n\n| Pattern | Likely meaning |\n|---|---|\n| A sample or tutorial app fails on the first run | Registered as **Personal Microsoft accounts only** while the code uses a tenant ID, `/organizations` or `/common`. |\n| Work account users can't sign in to an app that works with a personal account | The app was never meant for work accounts, or the account type was set wrongly at registration. |\n| A third-party product fails for all your staff | The vendor's app registration is consumer-only. Only the vendor can change that. |\n| It appears right after someone edited the app registration | **Supported account types** was narrowed to personal accounts only. Check the audit log. |"
    },
    {
      "heading": "How do I find it in my logs (KQL)?",
      "text": "Which sign-in table 9002346 lands in is undocumented, and our reading is that most of these never reach your tenant's logs at all: a consumer-only app usually has no service principal in your tenant, and the refusal happens at the endpoint. Expect few or no rows, and check with a union rather than guessing one table:\n\n```kusto\nunion withsource=SourceTable SigninLogs, AADNonInteractiveUserSignInLogs, AADServicePrincipalSignInLogs\n| where TimeGenerated > ago(30d)\n| where ResultType in (\"9002346\", \"9002331\") or ResultSignature in (\"9002346\", \"9002331\")\n| summarize Rows = count(), Apps = make_set(AppId, 10), LastSeen = max(TimeGenerated) by SourceTable, ResultType\n```\n\nIf you do get rows, the faster question is which account types your own app registrations use. That is a Graph or PowerShell query against the directory, not a log query:\n\n```powershell\nConnect-MgGraph -Scopes \"Application.Read.All\"\nGet-MgApplication -All |\n    Where-Object { $_.SignInAudience -eq \"PersonalMicrosoftAccount\" } |\n    Select-Object DisplayName, AppId, SignInAudience\n```"
    },
    {
      "heading": "How do I fix AADSTS9002346?",
      "text": "**For the user:** if you have a personal Microsoft account (Outlook.com, Hotmail, Xbox), try signing in with that one. If the app is meant for your work account, report it to whoever owns the app.\n\n**For developers:**\n1. Decide who the app is for. Personal accounts only: send the request to `https://login.microsoftonline.com/consumers/`, which is what the error message asks for.\n2. If work or school accounts must sign in too, change **Supported account types** on the app registration. For both kinds of account, use `AzureADandPersonalMicrosoftAccount` and the `/common` endpoint.\n3. Don't hardcode a tenant ID in an app registered for personal accounts only. The two settings contradict each other.\n\n**For admins:**\n1. For your own app registration, check **Supported account types** on the app's **Authentication** page, and agree any change with the developer. Microsoft's signInAudience page lists the validation rules that differ between the account types, so a change can also require edits elsewhere in the registration.\n2. For a vendor's app, you cannot change it. Ask the vendor for a registration that supports work accounts."
    }
  ],
  "microsoftWording": {
    "text": "AADSTS9002346: Application '\\<app id>'(\\<app name>) is configured for use by Microsoft Account users only. Please use th...",
    "source": "Quoted on the page from the lab or from user reports; the code is not in Microsoft's error code reference",
    "sourceUrl": null
  },
  "securityReading": {
    "category": {
      "id": "app-config",
      "label": "App configuration"
    },
    "kind": {
      "id": "config",
      "label": "Configuration error"
    },
    "attackSignal": {
      "level": "low",
      "label": "Low: usually configuration or user error"
    },
    "mitre": [],
    "tables": [],
    "isItAnAttack": "No. The app's supported account types and the endpoint the code calls disagree.\n\n| Pattern | Likely meaning |\n|---|---|\n| A sample or tutorial app fails on the first run | Registered as **Personal Microsoft accounts only** while the code uses a tenant ID, `/organizations` or `/common`. |\n| Work account users can't sign in to an app that works with a personal account | The app was never meant for work accounts, or the account type was set wrongly at registration. |\n| A third-party product fails for all your staff | The vendor's app registration is consumer-only. Only the vendor can change that. |\n| It appears right after someone edited the app registration | **Supported account types** was narrowed to personal accounts only. Check the audit log. |",
    "conditionalAccess": null
  },
  "kql": [
    {
      "title": null,
      "leadIn": "Which sign-in table 9002346 lands in is undocumented, and our reading is that most of these never reach your tenant's logs at all: a consumer-only app usually has no service principal in your tenant, and the refusal happens at the endpoint. Expect few or no rows, and check with a union rather than guessing one table:",
      "query": "union withsource=SourceTable SigninLogs, AADNonInteractiveUserSignInLogs, AADServicePrincipalSignInLogs\n| where TimeGenerated > ago(30d)\n| where ResultType in (\"9002346\", \"9002331\") or ResultSignature in (\"9002346\", \"9002331\")\n| summarize Rows = count(), Apps = make_set(AppId, 10), LastSeen = max(TimeGenerated) by SourceTable, ResultType"
    }
  ],
  "kqlSectionText": "Which sign-in table 9002346 lands in is undocumented, and our reading is that most of these never reach your tenant's logs at all: a consumer-only app usually has no service principal in your tenant, and the refusal happens at the endpoint. Expect few or no rows, and check with a union rather than guessing one table:\n\n```kusto\nunion withsource=SourceTable SigninLogs, AADNonInteractiveUserSignInLogs, AADServicePrincipalSignInLogs\n| where TimeGenerated > ago(30d)\n| where ResultType in (\"9002346\", \"9002331\") or ResultSignature in (\"9002346\", \"9002331\")\n| summarize Rows = count(), Apps = make_set(AppId, 10), LastSeen = max(TimeGenerated) by SourceTable, ResultType\n```\n\nIf you do get rows, the faster question is which account types your own app registrations use. That is a Graph or PowerShell query against the directory, not a log query:\n\n```powershell\nConnect-MgGraph -Scopes \"Application.Read.All\"\nGet-MgApplication -All |\n    Where-Object { $_.SignInAudience -eq \"PersonalMicrosoftAccount\" } |\n    Select-Object DisplayName, AppId, SignInAudience\n```",
  "fix": {
    "short": "Developer: for a personal-accounts-only app, send the request to `https://login.microsoftonline.com/consumers/`. If work or school accounts must sign in too, change Supported account types on the app registration. User: try your personal Microsoft account.",
    "steps": "**For the user:** if you have a personal Microsoft account (Outlook.com, Hotmail, Xbox), try signing in with that one. If the app is meant for your work account, report it to whoever owns the app.\n\n**For developers:**\n1. Decide who the app is for. Personal accounts only: send the request to `https://login.microsoftonline.com/consumers/`, which is what the error message asks for.\n2. If work or school accounts must sign in too, change **Supported account types** on the app registration. For both kinds of account, use `AzureADandPersonalMicrosoftAccount` and the `/common` endpoint.\n3. Don't hardcode a tenant ID in an app registered for personal accounts only. The two settings contradict each other.\n\n**For admins:**\n1. For your own app registration, check **Supported account types** on the app's **Authentication** page, and agree any change with the developer. Microsoft's signInAudience page lists the validation rules that differ between the account types, so a change can also require edits elsewhere in the registration.\n2. For a vendor's app, you cannot change it. Ask the vendor for a registration that supports work accounts."
  },
  "labReproduced": {
    "date": "2026-10-30",
    "method": "Password-grant (ROPC) token request against a lab tenant",
    "scenario": "Personal-accounts-only app on a tenant endpoint",
    "message": "AADSTS9002346: Application '{app-id}'(lab-msa-only-41136574530) is configured for use by Microsoft Account users only. Please use th",
    "logCaptured": "2026-10-31",
    "kqlTested": null
  },
  "labSectionText": "On 30 October 2026 an automated lab run registered an app with **Supported account types** set to personal Microsoft accounts only, then sent a password-grant (ROPC) token request to the lab tenant's own endpoint, with a user from that tenant. Entra returned `AADSTS9002346`:\n\n> AADSTS9002346: Application '\\<app id>'(\\<app name>) is configured for use by Microsoft Account users only. Please use th...\n\nControl requests in the same run, using an ordinary single-tenant app on the same endpoint with the same user, reached the credential check and returned either a token or a credential error. So 9002346 is about the app's supported account types and the endpoint, not about the user or the password.\n\nNo sign-in log row was captured. See [how pages are checked](https://brambrinkmeier.com/methodology/).\n\nIn the lab tenant's sign-in logs the row appears under **User sign-ins (interactive)**, Status **Failure**, Conditional Access **Not Applied**, with the Application column naming the personal-accounts-only app.",
  "labRuns": [
    {
      "date": "2026-10-30",
      "run": "round 5",
      "method": "token-endpoint requests against a lab tenant, using lab-created test apps",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/69",
      "scenario": "Personal-accounts-only app on a tenant endpoint",
      "expected": "9002331",
      "got": "9002346",
      "matchedExpectation": false,
      "message": "AADSTS9002346: Application '{app-id}'(lab-msa-only-41136574530) is configured for use by Microsoft Account users only. Please use th"
    },
    {
      "date": "2026-10-30",
      "run": "round 6",
      "method": "token-endpoint requests against a lab tenant, using lab-created test apps",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/70",
      "scenario": "Personal-accounts-only app on a tenant endpoint",
      "expected": "9002331",
      "got": "9002346",
      "matchedExpectation": false,
      "message": "AADSTS9002346: Application '{app-id}'(lab-msa-only-41139925607) is configured for use by Microsoft Account users only. Please use th"
    },
    {
      "date": "2026-10-30",
      "run": "round 7",
      "method": "token-endpoint requests against a lab tenant",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/71",
      "scenario": "Personal-accounts-only app on a tenant endpoint",
      "expected": "9002331",
      "got": "9002346",
      "matchedExpectation": false,
      "message": "AADSTS9002346: Application '{app-id}'(lab-msa-only-41143330001) is configured for use by Microsoft Account users only. Please use th"
    },
    {
      "date": "2026-10-31",
      "run": "round 8",
      "method": "token-endpoint and device-code requests against a lab tenant",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/72",
      "scenario": "Personal-accounts-only app on a tenant endpoint",
      "expected": "9002331",
      "got": "9002346",
      "matchedExpectation": false,
      "message": "AADSTS9002346: Application '{app-id}'(lab-msa-only-41146039117) is configured for use by Microsoft Account users only. Please use th"
    },
    {
      "date": "2026-10-31",
      "run": "round 9",
      "method": "token-endpoint and device-code requests against a lab tenant",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/73",
      "scenario": "Personal-accounts-only app on a tenant endpoint",
      "expected": "9002331",
      "got": "9002346",
      "matchedExpectation": false,
      "message": "AADSTS9002346: Application '{app-id}'(lab-msa-only-41150019626) is configured for use by Microsoft Account users only. Please use th"
    }
  ],
  "verification": "lab-reproduced",
  "related": [
    "9002331",
    "50020",
    "700016",
    "90002"
  ],
  "coveredBy": [],
  "sources": [
    {
      "title": "Microsoft Entra authentication and authorization error codes",
      "url": "https://learn.microsoft.com/en-us/entra/identity-platform/reference-error-codes"
    },
    {
      "title": "Validation differences by supported account types (signInAudience)",
      "url": "https://learn.microsoft.com/en-us/entra/identity-platform/supported-accounts-validation"
    },
    {
      "title": "OpenID Connect on the Microsoft identity platform",
      "url": "https://learn.microsoft.com/en-us/entra/identity-platform/v2-protocols-oidc"
    },
    {
      "title": "Microsoft Q&A: Access issue (1160493)",
      "url": "https://learn.microsoft.com/en-us/answers/questions/1160493/access-issue"
    },
    {
      "title": "SigninLogs table reference (Azure Monitor)",
      "url": "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/signinlogs"
    }
  ],
  "published": "2026-10-30",
  "lastUpdated": "2026-10-30",
  "lastVerified": null,
  "license": "CC BY 4.0",
  "licenseUrl": "https://creativecommons.org/licenses/by/4.0/",
  "licenseNote": "CC BY 4.0 covers the author's own text and classification fields. Quoted Microsoft error wording belongs to Microsoft, is quoted with its source and can change.",
  "attribution": "Bram Brinkmeier, \"AADSTS9002346: App is for personal Microsoft accounts only (fix)\", https://brambrinkmeier.com/entra/aadsts/9002346/ (CC BY 4.0)",
  "microsoftErrorLookup": "https://login.microsoftonline.com/error?code=9002346"
}