# AADSTS65005 fix: app asks for a resource it didn't register

Canonical: https://brambrinkmeier.com/entra/aadsts/65005/
By Bram Brinkmeier. JSON: https://brambrinkmeier.com/api/aadsts/65005.json

**Short answer:** AADSTS65005 means an app asked for access to a resource (an API) that isn't in the app's registered permissions, or that isn't available in the tenant. For SAML apps it can also mean a wrong Identifier (Entity ID). Users hit it on company apps, scripts and integrations that sign in to Microsoft 365, Intune or Dynamics. It is a configuration error with low attack value.

**Fix:** Developer: add the resource and every permission your code requests under App registrations > API permissions. Admin: if the resource isn't in your tenant, provision it by subscription, consent, admin center grant or gallery. SAML app: match the Identifier (Entity ID).

| Field | Value |
|---|---|
| Code | AADSTS65005 |
| Microsoft name | MisconfiguredApplication |
| Category | Consent and app permissions |
| Type | Configuration error |
| Attack signal | Low: usually configuration or user error |
| In Microsoft's error reference | Yes |
| Verification | documentation |
| Last updated | 2026-11-01 |

## What does AADSTS65005 mean?

Microsoft's description:

> **MisconfiguredApplication**: The app required resource access list doesn't contain apps discoverable by the resource, or the client app has requested access to resource, which wasn't specified in its required resource access list or Graph service returned bad request or resource not found. If the app supports SAML, you might have configured the app with the wrong Identifier (Entity). To learn more, see the troubleshooting article for error AADSTS650056.

The "required resource access list" is the list of APIs and permissions in the app's registration (**API permissions** in the portal, `requiredResourceAccess` in the manifest). An older Microsoft KB quotes the message users saw: *"The client application has requested access to resource. This request has failed because the client has not specified this resource in its requiredResourceAccess list."*

Microsoft's consent troubleshooting article shows two other wordings, which point at two different causes:

- **Resource not available in the tenant**: *"`clientAppDisplayName` is requesting access to a resource `resourceAppDisplayName` that isn't available in your organization."*
- **Permissions mismatch**: *"The app requested consent to access resource `resourceAppDisplayName`. This request failed because it doesn't match how the app was preconfigured during app registration."*

How it differs from codes that already have pages:

- [650056](https://brambrinkmeier.com/entra/aadsts/650056/) is also "misconfigured application", with missing permissions, missing admin consent or a wrong identifier. The two overlap, and Microsoft's 65005 description sends SAML cases to the 650056 article. Our reading: start with the resource named in the 65005 message.
- [500011](https://brambrinkmeier.com/entra/aadsts/500011/) means the resource has no service principal in the tenant at token time. 65005 can have the same root cause, a missing resource service principal. Our reading is that it tends to show up at consent rather than at token time.

## Is it an attack?

No. The request fails because the app is set up wrong, and nothing is granted. Users report it in a few typical places:

- Microsoft's KB: *"When you use a company app to sign in to or authenticate to one of the Microsoft Cloud Services, such as Microsoft 365, Microsoft Intune, Microsoft Dynamics, Microsoft Power BI, or Microsoft Azure."* The KB's cause: the app *"may not be registered with Microsoft Entra ID, or it may not have the correct permissions applied."*
- A Linux PAM module for Entra ID sign-in (pam_aad): the author found the app's permissions were set on the legacy Windows Azure Active Directory API instead of Microsoft Graph.

| Pattern | Likely meaning |
|---|---|
| One in-house app or script, every user, after a code change | The code asks for an API that isn't in the registration. Developer error. |
| A vendor app fails at the consent screen in your tenant only | The API it needs isn't provisioned in your tenant. Setup step missing. |
| A SAML app fails for everyone | Wrong Identifier (Entity ID). Follow the [650056](https://brambrinkmeier.com/entra/aadsts/650056/) fix. |

## How do I find it in my logs (KQL)?

Microsoft doesn't document which sign-in table 65005 lands in. Check your workspace:

```kusto
union withsource=SourceTable SigninLogs, AADNonInteractiveUserSignInLogs, AADServicePrincipalSignInLogs
| where TimeGenerated > ago(30d)
| where ResultType == "65005"
| summarize Rows = count(), Apps = dcount(AppId) by SourceTable
```

Which client apps fail, and which resources they asked for:

```kusto
union SigninLogs, AADNonInteractiveUserSignInLogs
| where TimeGenerated > ago(30d)
| where ResultType == "65005"
| summarize Rows = count(),
            Users = dcount(UserPrincipalName),
            Resources = make_set(ResourceDisplayName, 10),
            Protocols = make_set(AuthenticationProtocol, 5),
            FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
          by AppDisplayName, AppId
| sort by Users desc
```

The resource in the request may not exist in your tenant, so `ResourceDisplayName` can be empty on these rows. Microsoft doesn't document it either way. If it is empty, read the resource name from the error message the user saw.

Failed consent attempts in the audit log. Microsoft lists **Consent to application** as an `ApplicationManagement` activity. Our assumption: a consent stopped by 65005 is logged there as a failure.

```kusto
AuditLogs
| where TimeGenerated > ago(30d)
| where Category == "ApplicationManagement"
| where OperationName == "Consent to application"
| where Result =~ "failure"
| project TimeGenerated,
          App = tostring(TargetResources[0].displayName),
          ByUser = tostring(InitiatedBy.user.userPrincipalName),
          ResultReason
| sort by TimeGenerated desc
```

`ResultType` is a **string** column, so compare it with `"65005"`.

## How do I fix AADSTS65005?

**For the user:** you can't fix this. Send IT the app name and the resource named in the error.

**For developers (you own the app registration):**
1. Open **App registrations** > your app > **API permissions**. Add every API and permission your code requests. Microsoft: *"Compare the resource you're requesting access to in code with the configured permissions in the **Required Resources** tab to make sure you only request resources you've configured."*
2. Check you registered the right API. In the pam_aad report, permissions were on the legacy Windows Azure Active Directory API while the code needed Microsoft Graph.
3. Microsoft's consent article: when the app requests an invalid resource, *"the application developer must update the configuration of the client application to resolve this problem."*

**For admins:**
1. If the resource isn't in your tenant, provision its service principal. Microsoft lists four ways, depending on the app: *"Acquiring a subscription for the resource application (Microsoft-published applications)"*, *"Consenting to the resource application"*, *"Granting the application permissions via the Microsoft Entra admin center"*, and *"Adding the application from the Microsoft Entra application gallery."*
2. For a vendor app you don't own, the fix is on the vendor's side if its registration requests the wrong resource. Microsoft's message says *"Contact the app vendor."*
3. For a SAML app, check that the **Identifier (Entity ID)** in Entra ID matches the Issuer the app sends. See [650056](https://brambrinkmeier.com/entra/aadsts/650056/).

## Evidence

Not reproduced in the lab yet; the page is based on Microsoft's documentation.

## Sources

1. [Microsoft Entra authentication and authorization error codes](https://learn.microsoft.com/entra/identity-platform/reference-error-codes)
2. [Unexpected error when performing consent to an application](https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/application-sign-in-unexpected-user-consent-error)
3. [AADSTS65005 error when you try to sign in to Microsoft Cloud services](https://learn.microsoft.com/microsoft-365/troubleshoot/active-directory/aadsts65005-error-when-sign-in-cloud)
4. [Problems signing in to SAML-based single sign-on configured apps](https://learn.microsoft.com/en-us/troubleshoot/entra/entra-id/app-integration/troubleshoot-sign-in-saml-based-apps)
5. [Microsoft Entra audit log categories and activities](https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities)
6. [AADSTS65005: Misconfigured application (pam_aad GitHub issue, user report)](https://github.com/cyberninjas/pam_aad/issues/6)

## Related codes

[AADSTS650056](https://brambrinkmeier.com/entra/aadsts/650056/), [AADSTS500011](https://brambrinkmeier.com/entra/aadsts/500011/), [AADSTS65001](https://brambrinkmeier.com/entra/aadsts/65001/), [AADSTS700016](https://brambrinkmeier.com/entra/aadsts/700016/), [AADSTS50001](https://brambrinkmeier.com/entra/aadsts/50001/)

## License and citation

CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). CC BY 4.0 covers the author's own text and classification fields. Quoted Microsoft error wording belongs to Microsoft, is quoted with its source and can change.

Cite as: Bram Brinkmeier, "AADSTS65005 fix: app asks for a resource it didn't register", https://brambrinkmeier.com/entra/aadsts/65005/ (CC BY 4.0), last updated 2026-11-01.