# AADSTS900144: Request body is missing a required parameter (fix)

Canonical: https://brambrinkmeier.com/entra/aadsts/900144/
By Bram Brinkmeier. JSON: https://brambrinkmeier.com/api/aadsts/900144.json

**Short answer:** AADSTS900144 means an app sent a request to Microsoft Entra ID without a parameter the flow requires, such as password, client_id or grant_type. Microsoft calls it a developer error. The error names the missing parameter. It has low attack value; fix the request the app builds. Look for it by app and error text in all three sign-in tables.

**Fix:** Developer: read the parameter name in the error and add it to the request body, not the query string. For ROPC, send `client_id`, `grant_type`, `username` and `password` as a form-encoded `POST`. User: report the error and the parameter name to whoever runs the app.

| Field | Value |
|---|---|
| Code | AADSTS900144 |
| Category | App configuration |
| Type | Configuration error |
| Attack signal | Low: usually configuration or user error |
| Where to look | `SigninLogs`, `AADNonInteractiveUserSignInLogs`, `AADServicePrincipalSignInLogs` |
| In Microsoft's error reference | Yes |
| Verification | lab-reproduced (2026-10-25) |
| Last updated | 2026-10-30 |

## What does AADSTS900144 mean?

Microsoft's description:

> The request body must contain the following parameter: '{name}'. Developer error - the app is attempting to sign in without the necessary or correct authentication parameters.

The app sent a request to the Microsoft identity platform and left out a parameter that the flow requires. The error replaces `{name}` with the missing parameter, so the message tells you exactly what to add.

Which parameters are required depends on the flow. For the resource owner password credentials (ROPC) flow, for example, Microsoft lists `client_id`, `grant_type` (*"Must be set to `password`"*), `username` and `password` as **Required**. A confidential client must also send `client_secret` or `client_assertion`.

## Reproduced in the lab

On 25 October 2026 an automated lab run sent an ROPC token request to my lab tenant without the `password` parameter. Entra returned `AADSTS900144` with this first line:

> AADSTS900144: The request body must contain the following parameter: 'password'.

That confirms the code and its wording at the token endpoint, with `{name}` filled in as `password`. The sign-in log row was not captured, and the KQL on this page is not checked against it yet; see [how pages are checked](https://brambrinkmeier.com/methodology/).

## Is it an attack?

No documented attack pattern exists for 900144. Microsoft calls it a *"Developer error"*. The request is incomplete, so no credential is checked and nothing is issued. Our reading: an attacker learns nothing from it either.

| Pattern | Likely meaning |
|---|---|
| 900144 from one app, starting right after a release | A bug in the new version builds the request without a parameter. Configuration. |
| 900144 naming `client_secret` or `client_assertion` | Our interpretation: a confidential client sent no credential, often an empty secret in the configuration or a missing environment variable. |
| 900144 naming `password` or `username` from a script or tool | A script built an ROPC request with an empty value. Usually a broken automation. |
| 900144 from an unknown IP, for an app ID you don't recognise | Someone is calling the token endpoint with a hand-built request. Not an attack by itself, but worth checking who owns the client. |

Exclude it from failure-based attack detections. A password spray sends a password; it fails with codes such as [50126](https://brambrinkmeier.com/entra/aadsts/50126/), not 900144.

## How do I find it in my logs (KQL)?

Microsoft doesn't document whether or where 900144 is logged, and the lab run above didn't capture a sign-in row, so we can't say yet whether one is written. Check all three sign-in tables:

```kusto
union withsource=SourceTable SigninLogs, AADNonInteractiveUserSignInLogs, AADServicePrincipalSignInLogs
| where TimeGenerated > ago(7d)
| where ResultType == "900144"
| summarize Rows = count(), Apps = dcount(AppId) by SourceTable
```

Which app is missing which parameter. We assume `ResultDescription` carries the message with the parameter name filled in; we haven't checked that against a logged row:

```kusto
union SigninLogs, AADNonInteractiveUserSignInLogs, AADServicePrincipalSignInLogs
| where TimeGenerated > ago(7d)
| where ResultType == "900144"
| extend Parameter = extract(@"parameter: '([^']+)'", 1, ResultDescription)
| summarize Rows = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated),
            IPs = make_set(IPAddress, 5)
          by AppDisplayName, AppId, Parameter
| sort by Rows desc
```

New sources: apps that produced 900144 today but not in the previous 14 days. A `FirstSeen` right after a deployment points to the release that broke it:

```kusto
let recent =
    union SigninLogs, AADNonInteractiveUserSignInLogs, AADServicePrincipalSignInLogs
    | where TimeGenerated > ago(1d)
    | where ResultType == "900144"
    | summarize Rows = count(), FirstSeen = min(TimeGenerated) by AppId, AppDisplayName;
let before =
    union SigninLogs, AADNonInteractiveUserSignInLogs, AADServicePrincipalSignInLogs
    | where TimeGenerated between (ago(15d) .. ago(1d))
    | where ResultType == "900144"
    | distinct AppId;
recent
| join kind=leftanti before on AppId
| sort by Rows desc
```

`AppDisplayName` doesn't exist in `AADServicePrincipalSignInLogs`; there, use `ServicePrincipalName`. `ResultType` is a **string** column, so compare it with `"900144"`, not `900144`.

## How do I fix AADSTS900144?

**For the user:** you can't fix this yourself. Report the error, with the parameter name from the message, to whoever runs the app.

**For developers:**
1. Read the parameter name in the error and add it to the request.
2. Check the flow's parameter table in Microsoft's documentation. For ROPC, `client_id`, `grant_type`, `username` and `password` are required, and the request is a `POST` with `Content-Type: application/x-www-form-urlencoded`.
3. Check that the parameter is in the request **body**, not the query string, as the message says. Our reading: a value that is empty or missing in your configuration ends up as no parameter at all.
4. Prefer a Microsoft Authentication Library (MSAL) over hand-built requests. Microsoft also recommends against ROPC: *"it's incompatible with multifactor authentication (MFA)."*

**For admins:**
1. Use the second query to find the app and the parameter, and send both to the app's owner.
2. If the app ID is unknown, look it up in Enterprise applications or App registrations. If nobody owns it, treat it like any unknown client calling your tenant.

## Evidence

Reproduced in a lab tenant on 2026-10-25 (ROPC token request against a lab tenant; scenario: Password parameter missing). First line returned:

> AADSTS900144: The request body must contain the following parameter: 'password'.

Lab-run rows naming this code (9; full list at https://brambrinkmeier.com/lab-runs.json):

| Date | Scenario | Expected | Got | Message (first line) |
|---|---|---|---|---|
| 2026-10-25 | Password parameter missing | 900144 | 900144 | AADSTS900144: The request body must contain the following parameter: 'password'. |
| 2026-10-30 | Password parameter missing | 900144 | 900144 | AADSTS900144: The request body must contain the following parameter: 'password'. |
| 2026-10-30 | Password parameter missing | 900144 | 900144 | AADSTS900144: The request body must contain the following parameter: 'password'. |
| 2026-10-30 | Password parameter missing | 900144 | 900144 | AADSTS900144: The request body must contain the following parameter: 'password'. |
| 2026-10-30 | Password parameter missing | 900144 | 900144 | AADSTS900144: The request body must contain the following parameter: 'password'. |
| 2026-10-30 | Password parameter missing | 900144 | 900144 | AADSTS900144: The request body must contain the following parameter: 'password'. |
| 2026-10-30 | Password parameter missing | 900144 | 900144 | AADSTS900144: The request body must contain the following parameter: 'password'. |
| 2026-10-31 | Password parameter missing | 900144 | 900144 | AADSTS900144: The request body must contain the following parameter: 'password'. |
| 2026-10-31 | Password parameter missing | 900144 | 900144 | AADSTS900144: The request body must contain the following parameter: 'password'. |

## Sources

1. [Microsoft Entra authentication and authorization error codes](https://learn.microsoft.com/en-us/entra/identity-platform/reference-error-codes)
2. [Microsoft identity platform and OAuth 2.0 Resource Owner Password Credentials](https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth-ropc)
3. [SigninLogs table reference (Azure Monitor)](https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/signinlogs)
4. [AADNonInteractiveUserSignInLogs table reference (Azure Monitor)](https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/aadnoninteractiveusersigninlogs)
5. [AADServicePrincipalSignInLogs table reference (Azure Monitor)](https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/aadserviceprincipalsigninlogs)

## Related codes

[AADSTS7000215](https://brambrinkmeier.com/entra/aadsts/7000215/), [AADSTS700016](https://brambrinkmeier.com/entra/aadsts/700016/), [AADSTS50126](https://brambrinkmeier.com/entra/aadsts/50126/), [AADSTS90014](https://brambrinkmeier.com/entra/aadsts/90014/), [AADSTS90015](https://brambrinkmeier.com/entra/aadsts/90015/), [AADSTS900023](https://brambrinkmeier.com/entra/aadsts/900023/), [AADSTS900561](https://brambrinkmeier.com/entra/aadsts/900561/), [AADSTS901002](https://brambrinkmeier.com/entra/aadsts/901002/)

## License and citation

CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). CC BY 4.0 covers the author's own text and classification fields. Quoted Microsoft error wording belongs to Microsoft, is quoted with its source and can change.

Cite as: Bram Brinkmeier, "AADSTS900144: Request body is missing a required parameter (fix)", https://brambrinkmeier.com/entra/aadsts/900144/ (CC BY 4.0), last updated 2026-10-30.