{
  "schemaVersion": "1.0",
  "code": "90133",
  "name": null,
  "title": "AADSTS90133: Device code flow not supported on /common or /consumers (fix)",
  "url": "https://brambrinkmeier.com/entra/aadsts/90133/",
  "alternates": {
    "markdown": "https://brambrinkmeier.com/entra/aadsts/90133.md",
    "json": "https://brambrinkmeier.com/api/aadsts/90133.json",
    "html": "https://brambrinkmeier.com/entra/aadsts/90133/"
  },
  "description": "AADSTS90133: device code flow sent to /common or /consumers. Unlisted by Microsoft; its docs say use a tenant-specific authority. Fix and KQL.",
  "summary": "AADSTS90133 means a device code request went to the /common or /consumers endpoint, where Entra didn't support it for that app. Microsoft doesn't list the code, but a code comment in its device code docs gives the message and the fix: use a tenant-specific authority. It is a configuration error with low attack value.",
  "inMicrosoftReference": false,
  "unlistedChecked": "2026-10-30",
  "meaningText": "Microsoft's [error code reference](https://learn.microsoft.com/entra/identity-platform/reference-error-codes) doesn't list AADSTS90133 (checked 30 October 2026). The nearest listed code is AADSTS90130: *\"The application isn't supported over the /common or /consumers endpoints.\"*\n\nMicrosoft does mention 90133 elsewhere. The .NET sample in its [device code flow article for desktop apps](https://learn.microsoft.com/entra/identity-platform/scenario-desktop-acquire-token-device-code-flow) lists it in a code comment, with the fix:\n\n```csharp\n// AADSTS90133: Device Code flow is not supported under /common or /consumers endpoint.\n// Mitigation: as explained in the message from Azure AD, the authority needs to be tenanted\n```\n\n\"Tenanted\" means the sign-in URL names your tenant, by ID or domain, instead of `common` or `consumers`. The same sample uses `https://login.microsoftonline.com/contoso.com` as its authority.\n\nThis is a code comment, not a reference entry. Microsoft's device code protocol page says something broader. It says the `{tenant}` value *\"Can be `/common`, `/consumers`, or `/organizations`\"*, or a tenant ID or domain. Our reading: the two pages don't contradict each other if 90133 applies only to some apps, but Microsoft doesn't say which ones. Treat the code comment as the documented trigger and the exact conditions as unknown.\n\nWe tried to reproduce it on 30 October 2026. A lab run requested a device code on `/consumers` with an app registered for work accounts only. Entra didn't return 90133. It returned [AADSTS700016](https://brambrinkmeier.com/entra/aadsts/700016/) instead:\n\n> AADSTS700016: Application with identifier '{app-id}' was not found in the directory '{tenant-id}'.\n\nOur reading: on `/consumers` Entra looked for the app in a directory that isn't our lab tenant and didn't find it. In that one run, 700016 came back before any 90133 check. We haven't found the setup that returns 90133. See [how pages are checked](https://brambrinkmeier.com/methodology/).",
  "sections": [
    {
      "heading": "What does AADSTS90133 mean?",
      "text": "Microsoft's [error code reference](https://learn.microsoft.com/entra/identity-platform/reference-error-codes) doesn't list AADSTS90133 (checked 30 October 2026). The nearest listed code is AADSTS90130: *\"The application isn't supported over the /common or /consumers endpoints.\"*\n\nMicrosoft does mention 90133 elsewhere. The .NET sample in its [device code flow article for desktop apps](https://learn.microsoft.com/entra/identity-platform/scenario-desktop-acquire-token-device-code-flow) lists it in a code comment, with the fix:\n\n```csharp\n// AADSTS90133: Device Code flow is not supported under /common or /consumers endpoint.\n// Mitigation: as explained in the message from Azure AD, the authority needs to be tenanted\n```\n\n\"Tenanted\" means the sign-in URL names your tenant, by ID or domain, instead of `common` or `consumers`. The same sample uses `https://login.microsoftonline.com/contoso.com` as its authority.\n\nThis is a code comment, not a reference entry. Microsoft's device code protocol page says something broader. It says the `{tenant}` value *\"Can be `/common`, `/consumers`, or `/organizations`\"*, or a tenant ID or domain. Our reading: the two pages don't contradict each other if 90133 applies only to some apps, but Microsoft doesn't say which ones. Treat the code comment as the documented trigger and the exact conditions as unknown.\n\nWe tried to reproduce it on 30 October 2026. A lab run requested a device code on `/consumers` with an app registered for work accounts only. Entra didn't return 90133. It returned [AADSTS700016](https://brambrinkmeier.com/entra/aadsts/700016/) instead:\n\n> AADSTS700016: Application with identifier '{app-id}' was not found in the directory '{tenant-id}'.\n\nOur reading: on `/consumers` Entra looked for the app in a directory that isn't our lab tenant and didn't find it. In that one run, 700016 came back before any 90133 check. We haven't found the setup that returns 90133. See [how pages are checked](https://brambrinkmeier.com/methodology/)."
    },
    {
      "heading": "Is it an attack?",
      "text": "No. Microsoft's comment points to a configuration error in the app or script that starts the device code flow. The device code request is the first step of the flow, before any user signs in.\n\n| Pattern | Likely meaning |\n|---|---|\n| A new CLI tool or script fails on its first run | The authority is `/common` or `/consumers`. Use your tenant ID or domain. |\n| A tool works for one tenant and fails after a config change | Someone replaced the tenant ID with a generic endpoint. Likely, but unconfirmed. |\n| A vendor tool fails for every customer | The vendor's default authority is generic. Ask for a tenant setting. |"
    },
    {
      "heading": "How do I find it in my logs (KQL)?",
      "text": "Microsoft doesn't document which sign-in table 90133 is logged in. Probably no row is written in your tenant: the request fails before a user signs in, and `/common` and `/consumers` don't name your tenant. Check anyway; this query is expected to return nothing:\n\n```kusto\nunion withsource=SourceTable SigninLogs, AADNonInteractiveUserSignInLogs, AADServicePrincipalSignInLogs\n| where TimeGenerated > ago(30d)\n| where ResultType == \"90133\"\n| summarize Rows = count() by SourceTable\n```"
    },
    {
      "heading": "How do I fix AADSTS90133?",
      "text": "**For the user:** you can't fix this. Tell whoever runs the tool that its sign-in setting needs your tenant ID.\n\n**For developers:**\n1. Use a tenant-specific authority for device code flow, as Microsoft's comment says: `https://login.microsoftonline.com/<tenant id or domain>`.\n2. Use the same value for the device code request (`/oauth2/v2.0/devicecode`) and the token polling request (`/oauth2/v2.0/token`). Microsoft's protocol page says the polling request must use *\"the same tenant or tenant alias used in the initial request.\"*\n3. If the tool serves many tenants, make the tenant a setting instead of hard-coding `common`.\n\n**For admins:** give the tool your tenant ID. Our [AADSTS90002 page](https://brambrinkmeier.com/entra/aadsts/90002/) shows how to find it."
    }
  ],
  "microsoftWording": {
    "text": "AADSTS700016: Application with identifier '{app-id}' was not found in the directory '{tenant-id}'.",
    "source": "Quoted on the page from the lab or from user reports; the code is not in Microsoft's error code reference",
    "sourceUrl": null
  },
  "securityReading": {
    "category": {
      "id": "app-config",
      "label": "App configuration"
    },
    "kind": {
      "id": "config",
      "label": "Configuration error"
    },
    "attackSignal": {
      "level": "low",
      "label": "Low: usually configuration or user error"
    },
    "mitre": [],
    "tables": [],
    "isItAnAttack": "No. Microsoft's comment points to a configuration error in the app or script that starts the device code flow. The device code request is the first step of the flow, before any user signs in.\n\n| Pattern | Likely meaning |\n|---|---|\n| A new CLI tool or script fails on its first run | The authority is `/common` or `/consumers`. Use your tenant ID or domain. |\n| A tool works for one tenant and fails after a config change | Someone replaced the tenant ID with a generic endpoint. Likely, but unconfirmed. |\n| A vendor tool fails for every customer | The vendor's default authority is generic. Ask for a tenant setting. |",
    "conditionalAccess": null
  },
  "kql": [
    {
      "title": null,
      "leadIn": "Microsoft doesn't document which sign-in table 90133 is logged in. Probably no row is written in your tenant: the request fails before a user signs in, and `/common` and `/consumers` don't name your tenant. Check anyway; this query is expected to return nothing:",
      "query": "union withsource=SourceTable SigninLogs, AADNonInteractiveUserSignInLogs, AADServicePrincipalSignInLogs\n| where TimeGenerated > ago(30d)\n| where ResultType == \"90133\"\n| summarize Rows = count() by SourceTable"
    }
  ],
  "kqlSectionText": "Microsoft doesn't document which sign-in table 90133 is logged in. Probably no row is written in your tenant: the request fails before a user signs in, and `/common` and `/consumers` don't name your tenant. Check anyway; this query is expected to return nothing:\n\n```kusto\nunion withsource=SourceTable SigninLogs, AADNonInteractiveUserSignInLogs, AADServicePrincipalSignInLogs\n| where TimeGenerated > ago(30d)\n| where ResultType == \"90133\"\n| summarize Rows = count() by SourceTable\n```",
  "fix": {
    "short": "Developer: use a tenant-specific authority for device code flow (https://login.microsoftonline.com/<tenant id or domain>), not /common or /consumers, and use the same value for the devicecode and token requests. User: ask whoever runs the tool to set your tenant ID.",
    "steps": "**For the user:** you can't fix this. Tell whoever runs the tool that its sign-in setting needs your tenant ID.\n\n**For developers:**\n1. Use a tenant-specific authority for device code flow, as Microsoft's comment says: `https://login.microsoftonline.com/<tenant id or domain>`.\n2. Use the same value for the device code request (`/oauth2/v2.0/devicecode`) and the token polling request (`/oauth2/v2.0/token`). Microsoft's protocol page says the polling request must use *\"the same tenant or tenant alias used in the initial request.\"*\n3. If the tool serves many tenants, make the tenant a setting instead of hard-coding `common`.\n\n**For admins:** give the tool your tenant ID. Our [AADSTS90002 page](https://brambrinkmeier.com/entra/aadsts/90002/) shows how to find it."
  },
  "labReproduced": null,
  "labSectionText": null,
  "labRuns": [
    {
      "date": "2026-10-30",
      "run": "round 4",
      "method": "token-endpoint requests against a lab tenant",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/67",
      "scenario": "Device code requested on /consumers by a work-account app",
      "expected": "90133 / 9002331 / 700016",
      "got": "700016",
      "matchedExpectation": true,
      "message": "AADSTS700016: Application with identifier '{app-id}' was not found in the directory '{tenant-id}'. This can"
    },
    {
      "date": "2026-10-30",
      "run": "round 4",
      "method": "token-endpoint requests against a lab tenant",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/67",
      "scenario": "Device code on /common by a single-tenant app",
      "expected": "90133 / 700016 / 50194",
      "got": "50059",
      "matchedExpectation": false,
      "message": "AADSTS50059: No tenant-identifying information found in either the request or implied by any provided credentials."
    },
    {
      "date": "2026-10-30",
      "run": "round 4",
      "method": "token-endpoint requests against a lab tenant",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/67",
      "scenario": "Device code on /organizations by a single-tenant app",
      "expected": "90133 / 700016 / 50194",
      "got": "50059",
      "matchedExpectation": false,
      "message": "AADSTS50059: No tenant-identifying information found in either the request or implied by any provided credentials."
    },
    {
      "date": "2026-10-30",
      "run": "round 5",
      "method": "token-endpoint requests against a lab tenant, using lab-created test apps",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/69",
      "scenario": "Device code requested on /consumers by a work-account app",
      "expected": "90133 / 9002331 / 700016",
      "got": "700016",
      "matchedExpectation": true,
      "message": "AADSTS700016: Application with identifier '{app-id}' was not found in the directory '{tenant-id}'. This can"
    },
    {
      "date": "2026-10-30",
      "run": "round 5",
      "method": "token-endpoint requests against a lab tenant, using lab-created test apps",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/69",
      "scenario": "Device code on /common by a single-tenant app",
      "expected": "90133 / 700016 / 50194",
      "got": "50059",
      "matchedExpectation": false,
      "message": "AADSTS50059: No tenant-identifying information found in either the request or implied by any provided credentials."
    },
    {
      "date": "2026-10-30",
      "run": "round 5",
      "method": "token-endpoint requests against a lab tenant, using lab-created test apps",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/69",
      "scenario": "Device code on /organizations by a single-tenant app",
      "expected": "90133 / 700016 / 50194",
      "got": "50059",
      "matchedExpectation": false,
      "message": "AADSTS50059: No tenant-identifying information found in either the request or implied by any provided credentials."
    },
    {
      "date": "2026-10-30",
      "run": "round 5 (first attempt)",
      "method": "token-endpoint requests against a lab tenant",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/68",
      "scenario": "Device code requested on /consumers by a work-account app",
      "expected": "90133 / 9002331 / 700016",
      "got": "700016",
      "matchedExpectation": true,
      "message": "AADSTS700016: Application with identifier '{app-id}' was not found in the directory '{tenant-id}'. This can"
    },
    {
      "date": "2026-10-30",
      "run": "round 5 (first attempt)",
      "method": "token-endpoint requests against a lab tenant",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/68",
      "scenario": "Device code on /common by a single-tenant app",
      "expected": "90133 / 700016 / 50194",
      "got": "50059",
      "matchedExpectation": false,
      "message": "AADSTS50059: No tenant-identifying information found in either the request or implied by any provided credentials."
    },
    {
      "date": "2026-10-30",
      "run": "round 5 (first attempt)",
      "method": "token-endpoint requests against a lab tenant",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/68",
      "scenario": "Device code on /organizations by a single-tenant app",
      "expected": "90133 / 700016 / 50194",
      "got": "50059",
      "matchedExpectation": false,
      "message": "AADSTS50059: No tenant-identifying information found in either the request or implied by any provided credentials."
    },
    {
      "date": "2026-10-30",
      "run": "round 6",
      "method": "token-endpoint requests against a lab tenant, using lab-created test apps",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/70",
      "scenario": "Device code requested on /consumers by a work-account app",
      "expected": "90133 / 9002331 / 700016",
      "got": "700016",
      "matchedExpectation": true,
      "message": "AADSTS700016: Application with identifier '{app-id}' was not found in the directory '{tenant-id}'. This can"
    },
    {
      "date": "2026-10-30",
      "run": "round 6",
      "method": "token-endpoint requests against a lab tenant, using lab-created test apps",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/70",
      "scenario": "Device code on /common by a single-tenant app",
      "expected": "90133 / 700016 / 50194",
      "got": "50059",
      "matchedExpectation": false,
      "message": "AADSTS50059: No tenant-identifying information found in either the request or implied by any provided credentials."
    },
    {
      "date": "2026-10-30",
      "run": "round 6",
      "method": "token-endpoint requests against a lab tenant, using lab-created test apps",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/70",
      "scenario": "Device code on /organizations by a single-tenant app",
      "expected": "90133 / 700016 / 50194",
      "got": "50059",
      "matchedExpectation": false,
      "message": "AADSTS50059: No tenant-identifying information found in either the request or implied by any provided credentials."
    },
    {
      "date": "2026-10-30",
      "run": "round 7",
      "method": "token-endpoint requests against a lab tenant",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/71",
      "scenario": "Device code requested on /consumers by a work-account app",
      "expected": "90133 / 9002331 / 700016",
      "got": "700016",
      "matchedExpectation": true,
      "message": "AADSTS700016: Application with identifier '{app-id}' was not found in the directory '{tenant-id}'. This can"
    },
    {
      "date": "2026-10-30",
      "run": "round 7",
      "method": "token-endpoint requests against a lab tenant",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/71",
      "scenario": "Device code on /common by a single-tenant app",
      "expected": "90133 / 700016 / 50194",
      "got": "50059",
      "matchedExpectation": false,
      "message": "AADSTS50059: No tenant-identifying information found in either the request or implied by any provided credentials."
    },
    {
      "date": "2026-10-30",
      "run": "round 7",
      "method": "token-endpoint requests against a lab tenant",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/71",
      "scenario": "Device code on /organizations by a single-tenant app",
      "expected": "90133 / 700016 / 50194",
      "got": "50059",
      "matchedExpectation": false,
      "message": "AADSTS50059: No tenant-identifying information found in either the request or implied by any provided credentials."
    },
    {
      "date": "2026-10-30",
      "run": null,
      "method": "ROPC and other token-endpoint requests against a lab tenant",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/66",
      "scenario": "Device code requested on /consumers by a work-account app",
      "expected": "90133 / 9002331 / 700016",
      "got": "700016",
      "matchedExpectation": true,
      "message": "AADSTS700016: Application with identifier '{app-id}' was not found in the directory '{tenant-id}'. This can"
    },
    {
      "date": "2026-10-31",
      "run": "round 8",
      "method": "token-endpoint and device-code requests against a lab tenant",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/72",
      "scenario": "Device code requested on /consumers by a work-account app",
      "expected": "90133 / 9002331 / 700016",
      "got": "700016",
      "matchedExpectation": true,
      "message": "AADSTS700016: Application with identifier '{app-id}' was not found in the directory '{tenant-id}'. This can"
    },
    {
      "date": "2026-10-31",
      "run": "round 8",
      "method": "token-endpoint and device-code requests against a lab tenant",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/72",
      "scenario": "Device code on /common by a single-tenant app",
      "expected": "90133 / 700016 / 50194",
      "got": "50059",
      "matchedExpectation": false,
      "message": "AADSTS50059: No tenant-identifying information found in either the request or implied by any provided credentials."
    },
    {
      "date": "2026-10-31",
      "run": "round 8",
      "method": "token-endpoint and device-code requests against a lab tenant",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/72",
      "scenario": "Device code on /organizations by a single-tenant app",
      "expected": "90133 / 700016 / 50194",
      "got": "50059",
      "matchedExpectation": false,
      "message": "AADSTS50059: No tenant-identifying information found in either the request or implied by any provided credentials."
    },
    {
      "date": "2026-10-31",
      "run": "round 9",
      "method": "token-endpoint and device-code requests against a lab tenant",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/73",
      "scenario": "Device code requested on /consumers by a work-account app",
      "expected": "90133 / 9002331 / 700016",
      "got": "700016",
      "matchedExpectation": true,
      "message": "AADSTS700016: Application with identifier '{app-id}' was not found in the directory '{tenant-id}'. This can"
    },
    {
      "date": "2026-10-31",
      "run": "round 9",
      "method": "token-endpoint and device-code requests against a lab tenant",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/73",
      "scenario": "Device code on /common by a single-tenant app",
      "expected": "90133 / 700016 / 50194",
      "got": "50059",
      "matchedExpectation": false,
      "message": "AADSTS50059: No tenant-identifying information found in either the request or implied by any provided credentials."
    },
    {
      "date": "2026-10-31",
      "run": "round 9",
      "method": "token-endpoint and device-code requests against a lab tenant",
      "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/73",
      "scenario": "Device code on /organizations by a single-tenant app",
      "expected": "90133 / 700016 / 50194",
      "got": "50059",
      "matchedExpectation": false,
      "message": "AADSTS50059: No tenant-identifying information found in either the request or implied by any provided credentials."
    }
  ],
  "verification": "documentation",
  "related": [
    "700016",
    "90002",
    "500011",
    "7000218",
    "50194",
    "70016"
  ],
  "coveredBy": [],
  "sources": [
    {
      "title": "Microsoft Entra authentication and authorization error codes",
      "url": "https://learn.microsoft.com/entra/identity-platform/reference-error-codes"
    },
    {
      "title": "Desktop app that calls web APIs: Acquire a token by using device code flow",
      "url": "https://learn.microsoft.com/entra/identity-platform/scenario-desktop-acquire-token-device-code-flow"
    },
    {
      "title": "Microsoft identity platform and the OAuth 2.0 device authorization grant flow",
      "url": "https://learn.microsoft.com/entra/identity-platform/v2-oauth2-device-code"
    }
  ],
  "published": "2026-10-30",
  "lastUpdated": "2026-10-30",
  "lastVerified": null,
  "license": "CC BY 4.0",
  "licenseUrl": "https://creativecommons.org/licenses/by/4.0/",
  "licenseNote": "CC BY 4.0 covers the author's own text and classification fields. Quoted Microsoft error wording belongs to Microsoft, is quoted with its source and can change.",
  "attribution": "Bram Brinkmeier, \"AADSTS90133: Device code flow not supported on /common or /consumers (fix)\", https://brambrinkmeier.com/entra/aadsts/90133/ (CC BY 4.0)",
  "microsoftErrorLookup": "https://login.microsoftonline.com/error?code=90133"
}