AADSTS900023: Tenant identifier is not a valid tenant ID or domain (fix)

What does AADSTS900023 mean?

Microsoft’s error code reference doesn’t list AADSTS900023 (checked 30 October 2026).

The lab reproduced it. A token request to the tenant segment not_a_valid~tenant returned:

AADSTS900023: Specified tenant identifier ‘not_a_valid~tenant’ is neither a valid DNS name, nor a valid external domain.

Every sign-in URL names a tenant: https://login.microsoftonline.com/<tenant>/.... Microsoft’s MSAL configuration page says that part can be “A GUID (the ID of your Microsoft Entra instance)”, “A domain name associated with your Microsoft Entra instance”, or one of the placeholders organizations, consumers or common.

900023 means the value matches none of those shapes. Our reading: Entra rejects it on its form, before it looks for a tenant. Compare AADSTS90002: in the same lab run, a well-formed GUID for a tenant that doesn’t exist returned 90002 (“Tenant … not found”), not 900023.

Reproduced in the lab

On 30 October 2026 an automated lab run sent a token request to https://login.microsoftonline.com/not_a_valid~tenant/.... Entra returned AADSTS900023 with the first line quoted above. The message echoes the bad value back, which is the fastest way to see what the app actually sent.

That confirms the code and its wording at the token endpoint. No row for it appeared in the lab tenant’s exported sign-in logs (interactive, non-interactive and service principal, exported 30 October 2026). Our reading: there is no tenant to write it to, because the request named none; see how pages are checked.

Is it an attack?

No. It is a broken setting in the app, script or integration that sent the request. Users report these causes:

Value in the message	Likely meaning
'undefined'	The code built the URL from a variable that was never set. A post on the Auth0 Community forum reports it when the connection has no domain and tenant_domain set.
A value with a stray or wrong character	A typo or copy-paste error. A user on Microsoft Q&A found “an incorrect character in the Tenant ID for the integration”.
The tenant field of a third-party integration	A misconfigured tenant value in the product’s settings. Okta reports this for its Office 365 integration.
Empty, a placeholder, or a whole URL	Probably a config template that was never filled in, or the wrong field pasted (unconfirmed).

Our reading: an attacker gains nothing from this error. The request never reaches a tenant, so it says nothing about yours.

How do I find it in my logs (KQL)?

Microsoft doesn’t document which sign-in table 900023 is logged in. Likely no row is written in your tenant: the request named no valid tenant, so Entra can’t tell whose logs it belongs in. You can check; expect nothing:

union withsource=SourceTable SigninLogs, AADNonInteractiveUserSignInLogs, AADServicePrincipalSignInLogs
| where TimeGenerated > ago(30d)
| where ResultType == "900023"
| summarize Rows = count() by SourceTable

Debug from the app side instead: its logs, its config, and the error message, which shows the exact tenant value it sent.

How do I fix AADSTS900023?

For the user: you can’t fix this yourself. Report the app name and the full error message to whoever set the app up.

For developers:

1. Read the tenant value in the message. That is what your code sent.
2. If it says undefined or null, find the variable or setting that builds the authority URL and make sure it is set in every environment.
3. Use a tenant GUID, a verified domain such as contoso.onmicrosoft.com, or organizations / common / consumers. Those are the values Microsoft documents for the authority.
4. Remove spaces, quotes and other characters that came along in a copy-paste.

For admins:

1. Get your tenant ID. Microsoft’s page on finding it says to use Entra ID > Overview > Properties in the Entra admin center, or Get-AzTenant in Azure PowerShell:

Connect-AzAccount
Get-AzTenant

2. Paste it into the integration’s tenant field again. For Auth0, check the connection’s domain and tenant_domain options; the Auth0 Community post warns that an update to options drops values you leave out.
3. If the integration still fails with AADSTS90002, the value is now well-formed but names the wrong tenant or cloud.