# AADSTS900023: Tenant identifier is not a valid tenant ID or domain (fix) Canonical: https://brambrinkmeier.com/entra/aadsts/900023/ By Bram Brinkmeier. JSON: https://brambrinkmeier.com/api/aadsts/900023.json **Short answer:** AADSTS900023 means the tenant part of the sign-in URL isn't a valid tenant ID or domain name at all, for example 'undefined', a stray character or an empty setting. Microsoft's error reference doesn't list it. It is a configuration error with no attack value. Put the real tenant ID (a GUID) or a verified domain in the app's settings. **Fix:** Developer: read the tenant value in the message and set the authority to a tenant GUID, a verified domain, or `organizations`/`common`/`consumers`. Fix unset variables and stray copy-paste characters. Admin: copy the tenant ID from Entra ID > Overview into the integration again. | Field | Value | |---|---| | Code | AADSTS900023 | | Category | App configuration | | Type | Configuration error | | Attack signal | Low: usually configuration or user error | | In Microsoft's error reference | No (checked 2026-10-30) | | Verification | lab-reproduced (2026-10-30) | | Last updated | 2026-10-30 | ## What does AADSTS900023 mean? Microsoft's [error code reference](https://learn.microsoft.com/entra/identity-platform/reference-error-codes) doesn't list AADSTS900023 (checked 30 October 2026). The lab reproduced it. A token request to the tenant segment `not_a_valid~tenant` returned: > AADSTS900023: Specified tenant identifier 'not_a_valid~tenant' is neither a valid DNS name, nor a valid external domain. Every sign-in URL names a tenant: `https://login.microsoftonline.com//...`. Microsoft's MSAL configuration page says that part can be *"A GUID (the ID of your Microsoft Entra instance)"*, *"A domain name associated with your Microsoft Entra instance"*, or one of the placeholders `organizations`, `consumers` or `common`. 900023 means the value matches none of those shapes. Our reading: Entra rejects it on its form, before it looks for a tenant. Compare [AADSTS90002](https://brambrinkmeier.com/entra/aadsts/90002/): in the same lab run, a well-formed GUID for a tenant that doesn't exist returned 90002 ("Tenant ... not found"), not 900023. ## Reproduced in the lab On 30 October 2026 an automated lab run sent a token request to `https://login.microsoftonline.com/not_a_valid~tenant/...`. Entra returned `AADSTS900023` with the first line quoted above. The message echoes the bad value back, which is the fastest way to see what the app actually sent. That confirms the code and its wording at the token endpoint. No row for it appeared in the lab tenant's exported sign-in logs (interactive, non-interactive and service principal, exported 30 October 2026). Our reading: there is no tenant to write it to, because the request named none; see [how pages are checked](https://brambrinkmeier.com/methodology/). ## Is it an attack? No. It is a broken setting in the app, script or integration that sent the request. Users report these causes: | Value in the message | Likely meaning | |---|---| | `'undefined'` | The code built the URL from a variable that was never set. A post on the Auth0 Community forum reports it when the connection has no `domain` and `tenant_domain` set. | | A value with a stray or wrong character | A typo or copy-paste error. A user on [Microsoft Q&A](https://learn.microsoft.com/en-us/answers/a/1360543) found *"an incorrect character in the Tenant ID for the integration"*. | | The tenant field of a third-party integration | A misconfigured tenant value in the product's settings. Okta reports this for its Office 365 integration. | | Empty, a placeholder, or a whole URL | Probably a config template that was never filled in, or the wrong field pasted (unconfirmed). | Our reading: an attacker gains nothing from this error. The request never reaches a tenant, so it says nothing about yours. ## How do I find it in my logs (KQL)? Microsoft doesn't document which sign-in table 900023 is logged in. Likely no row is written in your tenant: the request named no valid tenant, so Entra can't tell whose logs it belongs in. You can check; expect nothing: ```kusto union withsource=SourceTable SigninLogs, AADNonInteractiveUserSignInLogs, AADServicePrincipalSignInLogs | where TimeGenerated > ago(30d) | where ResultType == "900023" | summarize Rows = count() by SourceTable ``` Debug from the app side instead: its logs, its config, and the error message, which shows the exact tenant value it sent. ## How do I fix AADSTS900023? **For the user:** you can't fix this yourself. Report the app name and the full error message to whoever set the app up. **For developers:** 1. Read the tenant value in the message. That is what your code sent. 2. If it says `undefined` or `null`, find the variable or setting that builds the authority URL and make sure it is set in every environment. 3. Use a tenant GUID, a verified domain such as `contoso.onmicrosoft.com`, or `organizations` / `common` / `consumers`. Those are the values Microsoft documents for the authority. 4. Remove spaces, quotes and other characters that came along in a copy-paste. **For admins:** 1. Get your tenant ID. Microsoft's page on finding it says to use **Entra ID** > **Overview** > **Properties** in the Entra admin center, or `Get-AzTenant` in Azure PowerShell: ```powershell Connect-AzAccount Get-AzTenant ``` 2. Paste it into the integration's tenant field again. For Auth0, check the connection's `domain` and `tenant_domain` options; the Auth0 Community post warns that an update to `options` drops values you leave out. 3. If the integration still fails with [AADSTS90002](https://brambrinkmeier.com/entra/aadsts/90002/), the value is now well-formed but names the wrong tenant or cloud. ## Evidence Reproduced in a lab tenant on 2026-10-30 (ROPC and other token-endpoint requests against a lab tenant; scenario: Malformed tenant identifier). First line returned: > AADSTS900023: Specified tenant identifier 'not_a_valid~tenant' is neither a valid DNS name, nor a valid external domain. Lab-run rows naming this code (8; full list at https://brambrinkmeier.com/lab-runs.json): | Date | Scenario | Expected | Got | Message (first line) | |---|---|---|---|---| | 2026-10-30 | Malformed tenant identifier | 900023 | 900023 | AADSTS900023: Specified tenant identifier 'not_a_valid~tenant' is neither a valid DNS name, nor a valid external domain. | | 2026-10-30 | Malformed tenant identifier | 900023 | 900023 | AADSTS900023: Specified tenant identifier 'not_a_valid~tenant' is neither a valid DNS name, nor a valid external domain. | | 2026-10-30 | Malformed tenant identifier | 900023 | 900023 | AADSTS900023: Specified tenant identifier 'not_a_valid~tenant' is neither a valid DNS name, nor a valid external domain. | | 2026-10-30 | Malformed tenant identifier | 900023 | 900023 | AADSTS900023: Specified tenant identifier 'not_a_valid~tenant' is neither a valid DNS name, nor a valid external domain. | | 2026-10-30 | Malformed tenant identifier | 900023 | 900023 | AADSTS900023: Specified tenant identifier 'not_a_valid~tenant' is neither a valid DNS name, nor a valid external domain. | | 2026-10-30 | Malformed tenant identifier | 900023 | 900023 | AADSTS900023: Specified tenant identifier 'not_a_valid~tenant' is neither a valid DNS name, nor a valid external domain. | | 2026-10-31 | Malformed tenant identifier | 900023 | 900023 | AADSTS900023: Specified tenant identifier 'not_a_valid~tenant' is neither a valid DNS name, nor a valid external domain. | | 2026-10-31 | Malformed tenant identifier | 900023 | 900023 | AADSTS900023: Specified tenant identifier 'not_a_valid~tenant' is neither a valid DNS name, nor a valid external domain. | ## Sources 1. [Microsoft Entra authentication and authorization error codes](https://learn.microsoft.com/entra/identity-platform/reference-error-codes) 2. [Application configuration options (MSAL)](https://learn.microsoft.com/en-us/entra/identity-platform/msal-client-application-configuration) 3. [Auth0 Community: AADSTS900023 Specified tenant identifier 'undefined' is neither a valid DNS name](https://community.auth0.com/t/azure-entra-connection-error-aadsts900023-specified-tenant-identifier-undefined-is-neither-a-valid-dns-name/122970) 4. [Okta: Microsoft Office 365 error AADSTS900023 occurs when authenticating API credentials in Okta](https://support.okta.com/help/s/article/microsoft-office-365-error-aadsts900023-occurs-when-authenticating-api-credentials-in-okta) 5. [Microsoft Q&A: Microsoft Graph API - AADSTS900023](https://learn.microsoft.com/en-us/answers/a/1360543) 6. [How to find your Microsoft Entra tenant ID](https://learn.microsoft.com/en-us/entra/fundamentals/how-to-find-tenant) 7. [SigninLogs table reference (Azure Monitor)](https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/signinlogs) ## Related codes [AADSTS90002](https://brambrinkmeier.com/entra/aadsts/90002/), [AADSTS700016](https://brambrinkmeier.com/entra/aadsts/700016/), [AADSTS900144](https://brambrinkmeier.com/entra/aadsts/900144/), [AADSTS9002313](https://brambrinkmeier.com/entra/aadsts/9002313/), [AADSTS50059](https://brambrinkmeier.com/entra/aadsts/50059/), [AADSTS90019](https://brambrinkmeier.com/entra/aadsts/90019/) ## License and citation CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). CC BY 4.0 covers the author's own text and classification fields. Quoted Microsoft error wording belongs to Microsoft, is quoted with its source and can change. Cite as: Bram Brinkmeier, "AADSTS900023: Tenant identifier is not a valid tenant ID or domain (fix)", https://brambrinkmeier.com/entra/aadsts/900023/ (CC BY 4.0), last updated 2026-10-30.