# AADSTS90002: Tenant not found (fix) Canonical: https://brambrinkmeier.com/entra/aadsts/90002/ By Bram Brinkmeier. JSON: https://brambrinkmeier.com/api/aadsts/90002.json **Short answer:** AADSTS90002 means the sign-in request named a tenant that Entra can't find. Usually the tenant ID or domain in the app's settings is wrong, the app talks to the wrong cloud, or the domain was derived from an email address and isn't registered. It is a configuration error with low attack value. Check the tenant ID and the cloud endpoint. **Fix:** Developer: check the tenant ID or domain in the authority URL against the real tenant ID (Entra ID > Overview > Properties, or Get-AzTenant), and use the login endpoint of the tenant's cloud. User: report the app name to whoever set it up; you can't fix this yourself. | Field | Value | |---|---| | Code | AADSTS90002 | | Microsoft name | InvalidTenantName | | Category | App configuration | | Type | Configuration error | | Attack signal | Low: usually configuration or user error | | In Microsoft's error reference | Yes | | Verification | lab-reproduced (2026-10-25) | | Last updated | 2026-10-30 | ## What does AADSTS90002 mean? Microsoft's description: > **InvalidTenantName**: The tenant name wasn't found in the data store. Check to make sure you have the correct tenant ID. The application developer will receive this error if their app attempts to sign into a tenant that we cannot find. Often, this is because a cross-cloud app was used against the wrong cloud, or the developer attempted to sign in to a tenant derived from an email address, but the domain isn't registered. Every sign-in request names a tenant in its URL, as a tenant ID (a GUID) or a domain: `https://login.microsoftonline.com//...`. 90002 means Entra has no tenant by that name in the cloud the request went to. The "wrong cloud" cause is real because the clouds are separate. Microsoft's national clouds page says *"Each cloud instance is separate from the others and has its own environment and endpoints"* and lists `https://login.microsoftonline.com` (global), `https://login.microsoftonline.us` (US Government) and `https://login.partner.microsoftonline.cn` (China, operated by 21Vianet). A US Government tenant ID sent to the global endpoint is not found, and the other way round. ## Reproduced in the lab On 25 October 2026 an automated lab run sent a token request to a tenant ID that doesn't exist (a random GUID the script generated). Entra returned `AADSTS90002` with this first line: > AADSTS90002: Tenant '{tenant-id}' not found. Check to make sure you have the correct tenant ID and are signing into the correct cloud. That confirms the code and its wording at the token endpoint. Note that the returned message mentions the cloud as well as the tenant ID. No sign-in log row was captured. Our reading: there is no tenant to log it in, because the tenant named in the request doesn't exist, and the request never reached the lab tenant either. See [how pages are checked](https://brambrinkmeier.com/methodology/). ## Is it an attack? No. It is a configuration error in the app or script that sent the request. | Pattern | Likely meaning | |---|---| | A new app or script fails on its first run | Typo in the tenant ID, or a placeholder value left in the config. | | An app that works in one environment fails in another | The app points at the wrong cloud endpoint for that tenant. | | A multi-tenant app that builds the tenant from the user's email domain | The domain isn't a verified domain of any tenant, as Microsoft's description says. | | An app that worked before and now fails | The tenant was deleted, or the custom domain used as tenant name was removed from it. Our interpretation. | Our reading: tenant discovery by attackers doesn't need this error and doesn't show up in your logs through it. A request to a tenant that doesn't exist reaches no tenant. ## How do I find it in my logs (KQL)? Microsoft doesn't document which sign-in table 90002 is logged in. It probably lands in none of yours, for the reason in the lab note above. Check anyway; this query is expected to return nothing: ```kusto union withsource=SourceTable SigninLogs, AADNonInteractiveUserSignInLogs, AADServicePrincipalSignInLogs | where TimeGenerated > ago(30d) | where ResultType == "90002" | summarize Rows = count() by SourceTable ``` What the logs can do is tell you the right value to configure. For an app that fails with 90002, find where it signs in successfully and which tenant that is. `ResourceTenantId` is documented as *"the tenant identifier of the resource referenced in the sign in"*: ```kusto union withsource=SourceTable SigninLogs, (AADServicePrincipalSignInLogs | extend ResourceTenantId = AADTenantId, AppDisplayName = ServicePrincipalName) | where TimeGenerated > ago(30d) | where ResultType == "0" | where AppId == "" | summarize Rows = count(), LastSeen = max(TimeGenerated) by SourceTable, ResourceTenantId, AppDisplayName ``` `AADServicePrincipalSignInLogs` has no `ResourceTenantId` or `AppDisplayName` column, so the query uses `AADTenantId` and `ServicePrincipalName` there (our choice; the table reference doesn't describe `AADTenantId`). If this returns your tenant ID and the app config holds a different one, you found the cause. ## How do I fix AADSTS90002? **For the user:** you can't fix this yourself. Report the app name to whoever set it up. **For developers:** 1. Check the tenant ID or domain in the authority URL. Compare it with the real tenant ID; Microsoft's page on finding it says to use **Entra ID** > **Overview** > **Properties** in the Entra admin center, or `Get-AzTenant` in Azure PowerShell. 2. Check the cloud. Microsoft's national clouds page: *"use the endpoints for the cloud instance where you'll deploy the application."* A tenant in US Government or China needs that cloud's login endpoint, not `login.microsoftonline.com`. 3. Don't derive the tenant from the user's email domain unless you handle the case where the domain isn't registered. For a multi-tenant app, sign in through `/organizations` or `/common` and read the tenant from the token instead. **For admins:** 1. Get the correct tenant ID from the admin center or with PowerShell: ```powershell Connect-AzAccount Get-AzTenant ``` 2. If the app uses a domain name as tenant, check that the domain is still verified in your tenant. 3. If the app is a third-party product, give the vendor your tenant ID and tell them which cloud your tenant is in. ## Evidence Reproduced in a lab tenant on 2026-10-25 (ROPC token request against a lab tenant; scenario: Tenant does not exist). First line returned: > AADSTS90002: Tenant '{tenant-id}' not found. Check to make sure you have the correct tenant ID and are signing into the correct cloud. Lab-run rows naming this code (9; full list at https://brambrinkmeier.com/lab-runs.json): | Date | Scenario | Expected | Got | Message (first line) | |---|---|---|---|---| | 2026-10-25 | Tenant does not exist | 90002 | 90002 | AADSTS90002: Tenant '{tenant-id}' not found. Check to make sure you have the correct tenant ID and are signing into the correct cloud. | | 2026-10-30 | Tenant does not exist | 90002 | 90002 | AADSTS90002: Tenant '{tenant-id}' not found. Check to make sure you have the correct tenant ID and are signing into the correct cloud. | | 2026-10-30 | Tenant does not exist | 90002 | 90002 | AADSTS90002: Tenant '{tenant-id}' not found. Check to make sure you have the correct tenant ID and are signing into the correct cloud. | | 2026-10-30 | Tenant does not exist | 90002 | 90002 | AADSTS90002: Tenant '{tenant-id}' not found. Check to make sure you have the correct tenant ID and are signing into the correct cloud. | | 2026-10-30 | Tenant does not exist | 90002 | 90002 | AADSTS90002: Tenant '{tenant-id}' not found. Check to make sure you have the correct tenant ID and are signing into the correct cloud. | | 2026-10-30 | Tenant does not exist | 90002 | 90002 | AADSTS90002: Tenant '{tenant-id}' not found. Check to make sure you have the correct tenant ID and are signing into the correct cloud. | | 2026-10-30 | Tenant does not exist | 90002 | 90002 | AADSTS90002: Tenant '{tenant-id}' not found. Check to make sure you have the correct tenant ID and are signing into the correct cloud. | | 2026-10-31 | Tenant does not exist | 90002 | 90002 | AADSTS90002: Tenant '{tenant-id}' not found. Check to make sure you have the correct tenant ID and are signing into the correct cloud. | | 2026-10-31 | Tenant does not exist | 90002 | 90002 | AADSTS90002: Tenant '{tenant-id}' not found. Check to make sure you have the correct tenant ID and are signing into the correct cloud. | ## Sources 1. [Microsoft Entra authentication and authorization error codes](https://learn.microsoft.com/en-us/entra/identity-platform/reference-error-codes) 2. [National clouds (Microsoft identity platform)](https://learn.microsoft.com/en-us/entra/identity-platform/authentication-national-cloud) 3. [How to find your Microsoft Entra tenant ID](https://learn.microsoft.com/en-us/entra/fundamentals/how-to-find-tenant) 4. [SigninLogs table reference (Azure Monitor)](https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/signinlogs) ## Related codes [AADSTS700016](https://brambrinkmeier.com/entra/aadsts/700016/), [AADSTS500011](https://brambrinkmeier.com/entra/aadsts/500011/), [AADSTS16000](https://brambrinkmeier.com/entra/aadsts/16000/), [AADSTS50034](https://brambrinkmeier.com/entra/aadsts/50034/), [AADSTS50059](https://brambrinkmeier.com/entra/aadsts/50059/), [AADSTS50194](https://brambrinkmeier.com/entra/aadsts/50194/), [AADSTS90019](https://brambrinkmeier.com/entra/aadsts/90019/), [AADSTS90133](https://brambrinkmeier.com/entra/aadsts/90133/), [AADSTS900023](https://brambrinkmeier.com/entra/aadsts/900023/), [AADSTS900439](https://brambrinkmeier.com/entra/aadsts/900439/), [AADSTS1002016](https://brambrinkmeier.com/entra/aadsts/1002016/), [AADSTS5000224](https://brambrinkmeier.com/entra/aadsts/5000224/), [AADSTS5000225](https://brambrinkmeier.com/entra/aadsts/5000225/), [AADSTS9002331](https://brambrinkmeier.com/entra/aadsts/9002331/), [AADSTS9002346](https://brambrinkmeier.com/entra/aadsts/9002346/) ## License and citation CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). CC BY 4.0 covers the author's own text and classification fields. Quoted Microsoft error wording belongs to Microsoft, is quoted with its source and can change. Cite as: Bram Brinkmeier, "AADSTS90002: Tenant not found (fix)", https://brambrinkmeier.com/entra/aadsts/90002/ (CC BY 4.0), last updated 2026-10-30.