# AADSTS501051: Client app isn't assigned to a role for the API (fix)

Canonical: https://brambrinkmeier.com/entra/aadsts/501051/
By Bram Brinkmeier. JSON: https://brambrinkmeier.com/api/aadsts/501051.json

**Short answer:** AADSTS501051 means a client app asked for an access token to a web API whose enterprise app has "Assignment required" set to Yes, and the client holds no app role on that API. Microsoft's error reference doesn't list it, but its protected web API docs do. Low attack value. Assign an app role to the client; don't switch assignment off.

**Fix:** Admin: assign the client an app role on the API, by granting consent for the role it requested or with New-MgServicePrincipalAppRoleAssignment. Don't set Assignment required back to No. Developer: expose an app role for Applications and request it under API permissions.

| Field | Value |
|---|---|
| Code | AADSTS501051 |
| Category | App configuration |
| Type | Configuration error |
| Attack signal | Low: usually configuration or user error |
| In Microsoft's error reference | No (checked 2026-10-30) |
| Verification | lab-reproduced (2026-10-30) |
| Last updated | 2026-10-30 |

## What does AADSTS501051 mean?

Microsoft's [error code reference](https://learn.microsoft.com/entra/identity-platform/reference-error-codes) doesn't list AADSTS501051 (checked 30 October 2026).

Microsoft does document it on another page. Its protected web API guide explains how to restrict token issuance to approved client apps, by setting **Assignment required?** to **Yes** on the API's enterprise application. Then:

> Microsoft Entra ID will now check for app role assignments of client applications that request access tokens for your web API. If a client app hasn't been assigned any app roles, Microsoft Entra ID returns an error message to the client similar to `invalid_client: AADSTS501051: Application <application name> isn't assigned to a role for the <web API>`.

So two things are true at once:
1. The API's enterprise application (its service principal) has **Assignment required?** set to **Yes**.
2. The client app that asked for the token has no app role on that API.

Microsoft's enterprise app properties page describes the switch: *"If this option is set to **Yes**, then users and other applications or services must first be assigned this application before being able to access it."* It applies to *"Applications or services for which other applications or service are requesting access tokens."*

Our reading: 501051 is the app-side twin of [50105](https://brambrinkmeier.com/entra/aadsts/50105/). 50105 is a user without an assignment. 501051 is a client app without one. Microsoft doesn't say so in those words.

## Is it an attack?

Usually not. It is the assignment check doing what it was set up to do.

| Pattern | Likely meaning |
|---|---|
| A new daemon or service fails on its first token request | Nobody assigned it an app role on the API yet. |
| A working client starts failing after a change | Someone turned on **Assignment required?** on the API, or removed the client's app role assignment. Check the audit log. |
| A client you don't recognise hits 501051 against an internal API | Possibly a client with valid credentials trying an API it was never granted (see below). Find out who owns that client. |
| Repeated 501051 from one client, every few minutes | A scheduled job retrying with no fix in sight. Noise until someone assigns the role. |

Microsoft doesn't document this, but the role check probably runs after the client has authenticated, so a 501051 from an unknown client may mean it holds working credentials in your tenant. That deserves a look, even though no token was issued.

## How do I find it in my logs (KQL)?

Microsoft doesn't document which sign-in table 501051 is logged in. App-only requests (client credentials) probably land in `AADServicePrincipalSignInLogs`. Check where it lands in your workspace:

```kusto
union withsource=SourceTable SigninLogs, AADNonInteractiveUserSignInLogs, AADServicePrincipalSignInLogs
| where TimeGenerated > ago(30d)
| where ResultType == "501051"
| summarize Rows = count() by SourceTable
```

Which clients are refused, and for which API:

```kusto
AADServicePrincipalSignInLogs
| where TimeGenerated > ago(30d)
| where ResultType == "501051"
| summarize Rows = count(),
            IPs = make_set(IPAddress, 10),
            FirstSeen = min(TimeGenerated),
            LastSeen = max(TimeGenerated)
          by ServicePrincipalName, AppId, ResourceDisplayName, ResourceIdentity
| sort by Rows desc
```

Service principal sign-in rows are aggregated, so `Rows` is not a request count.

Who changed assignments. Microsoft's audit log reference lists **Add app role assignment to service principal**, **Remove app role assignment from service principal** and **Update service principal** in the ApplicationManagement category:

```kusto
AuditLogs
| where TimeGenerated > ago(30d)
| where Category == "ApplicationManagement"
| where OperationName in ("Add app role assignment to service principal",
                          "Remove app role assignment from service principal",
                          "Update service principal")
| project TimeGenerated, OperationName,
          Target = tostring(TargetResources[0].displayName),
          ByUser = tostring(InitiatedBy.user.userPrincipalName),
          ByApp = tostring(InitiatedBy.app.displayName)
| sort by TimeGenerated desc
```

Our assumption: turning **Assignment required?** on or off is logged as **Update service principal**. Microsoft's reference lists the activity but not which property changes it covers.

## How do I fix AADSTS501051?

**For the user:** this error is between two apps, not about your account. Report it to whoever runs the app.

**For developers:**
1. Make sure the API exposes an app role for applications. Microsoft's guide: in **Create app role**, under **Allowed member types**, select **Applications**.
2. Request the role in the client's app registration: **API permissions** > **Add a permission** > **My APIs** > your API > the role.
3. Get an admin to grant consent. Microsoft: *"Because these are application permissions, not delegated permissions, an admin must grant consent to use the app roles assigned to the application."*
4. Don't branch on the AADSTS code in your code. Microsoft warns that the codes and message strings *"may be changed by Microsoft at any time and without your knowledge."*

**For admins:**
1. Don't fix this by setting **Assignment required?** back to **No**. That opens the API to every client in the tenant again.
2. Grant consent for the app role the client requested, or assign the role directly with Microsoft Graph PowerShell. `-ServicePrincipalId` and `principalId` are the client's service principal. `resourceId` is the API's service principal:

```powershell
Connect-MgGraph -Scopes "AppRoleAssignment.ReadWrite.All"

$client = Get-MgServicePrincipal -Filter "appId eq '<client app id>'"
$api    = Get-MgServicePrincipal -Filter "appId eq '<api app id>'"

$params = @{
    principalId = $client.Id
    resourceId  = $api.Id
    appRoleId   = "<app role id from the API>"
}
New-MgServicePrincipalAppRoleAssignment -ServicePrincipalId $client.Id -BodyParameter $params
```

3. If the API defines no app roles, Microsoft's cmdlet reference says a default ID of `00000000-0000-0000-0000-000000000000` *"can be specified to signal that the principal is assigned to the resource app without any specific app roles."* Our reading: a dedicated app role is the better choice, because the API can then check the `roles` claim.
4. If the client is one you don't recognise, don't assign anything. Find its owner first.

## Evidence

Reproduced in a lab tenant on 2026-10-30 (token-endpoint requests against a lab tenant; scenario: App-only token for an API that requires assignment). First line returned:

> AADSTS501051: Application '{app-id}'(lab-fic-holder) is not assigned to a role for the application

Lab-run rows naming this code (3; full list at https://brambrinkmeier.com/lab-runs.json):

| Date | Scenario | Expected | Got | Message (first line) |
|---|---|---|---|---|
| 2026-10-30 | App-only token for an API that requires assignment | 501051 | 501051 | AADSTS501051: Application '{app-id}'(lab-fic-holder-41143330001) is not assigned to a role for the application 'api://{guid} |
| 2026-10-31 | App-only token for an API that requires assignment | 501051 | 501051 | AADSTS501051: Application '{app-id}'(lab-fic-holder-41146039117) is not assigned to a role for the application 'api://{guid} |
| 2026-10-31 | App-only token for an API that requires assignment | 501051 | 501051 | AADSTS501051: Application '{app-id}'(lab-fic-holder-41150019626) is not assigned to a role for the application 'api://{guid} |

## Sources

1. [Microsoft Entra authentication and authorization error codes](https://learn.microsoft.com/entra/identity-platform/reference-error-codes)
2. [Protected web API: App registration and scopes](https://learn.microsoft.com/entra/identity-platform/scenario-protected-web-api-expose-scopes)
3. [Properties of an enterprise application](https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/application-properties)
4. [Add app roles to your application and receive them in the token](https://learn.microsoft.com/en-us/entra/identity-platform/howto-add-app-roles-in-apps)
5. [New-MgServicePrincipalAppRoleAssignment (Microsoft Graph PowerShell)](https://learn.microsoft.com/en-us/powershell/module/microsoft.graph.applications/new-mgserviceprincipalapproleassignment)
6. [Microsoft Entra audit log categories and activities](https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities)
7. [AADServicePrincipalSignInLogs table reference (Azure Monitor)](https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/aadserviceprincipalsigninlogs)

## Related codes

[AADSTS50105](https://brambrinkmeier.com/entra/aadsts/50105/), [AADSTS500011](https://brambrinkmeier.com/entra/aadsts/500011/), [AADSTS700016](https://brambrinkmeier.com/entra/aadsts/700016/), [AADSTS65001](https://brambrinkmeier.com/entra/aadsts/65001/), [AADSTS7000112](https://brambrinkmeier.com/entra/aadsts/7000112/)

## License and citation

CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). CC BY 4.0 covers the author's own text and classification fields. Quoted Microsoft error wording belongs to Microsoft, is quoted with its source and can change.

Cite as: Bram Brinkmeier, "AADSTS501051: Client app isn't assigned to a role for the API (fix)", https://brambrinkmeier.com/entra/aadsts/501051/ (CC BY 4.0), last updated 2026-10-30.