AADSTS900144: Request body is missing a required parameter (fix)

What does AADSTS900144 mean?

Microsoft’s description:

The request body must contain the following parameter: ‘{name}’. Developer error - the app is attempting to sign in without the necessary or correct authentication parameters.

The app sent a request to the Microsoft identity platform and left out a parameter that the flow requires. The error replaces {name} with the missing parameter, so the message tells you exactly what to add.

Which parameters are required depends on the flow. For the resource owner password credentials (ROPC) flow, for example, Microsoft lists client_id, grant_type (“Must be set to password”), username and password as Required. A confidential client must also send client_secret or client_assertion.

Reproduced in the lab

On 25 October 2026 an automated lab run sent an ROPC token request to my lab tenant without the password parameter. Entra returned AADSTS900144 with this first line:

AADSTS900144: The request body must contain the following parameter: ‘password’.

That confirms the code and its wording at the token endpoint, with {name} filled in as password. The sign-in log row was not captured, and the KQL on this page is not checked against it yet; see how pages are checked.

Is it an attack?

No documented attack pattern exists for 900144. Microsoft calls it a “Developer error”. The request is incomplete, so no credential is checked and nothing is issued. Our reading: an attacker learns nothing from it either.

Pattern	Likely meaning
900144 from one app, starting right after a release	A bug in the new version builds the request without a parameter. Configuration.
900144 naming client_secret or client_assertion	Our interpretation: a confidential client sent no credential, often an empty secret in the configuration or a missing environment variable.
900144 naming password or username from a script or tool	A script built an ROPC request with an empty value. Usually a broken automation.
900144 from an unknown IP, for an app ID you don’t recognise	Someone is calling the token endpoint with a hand-built request. Not an attack by itself, but worth checking who owns the client.

Exclude it from failure-based attack detections. A password spray sends a password; it fails with codes such as 50126, not 900144.

How do I find it in my logs (KQL)?

Microsoft doesn’t document whether or where 900144 is logged, and the lab run above didn’t capture a sign-in row, so we can’t say yet whether one is written. Check all three sign-in tables:

union withsource=SourceTable SigninLogs, AADNonInteractiveUserSignInLogs, AADServicePrincipalSignInLogs
| where TimeGenerated > ago(7d)
| where ResultType == "900144"
| summarize Rows = count(), Apps = dcount(AppId) by SourceTable

Which app is missing which parameter. We assume ResultDescription carries the message with the parameter name filled in; we haven’t checked that against a logged row:

union SigninLogs, AADNonInteractiveUserSignInLogs, AADServicePrincipalSignInLogs
| where TimeGenerated > ago(7d)
| where ResultType == "900144"
| extend Parameter = extract(@"parameter: '([^']+)'", 1, ResultDescription)
| summarize Rows = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated),
            IPs = make_set(IPAddress, 5)
          by AppDisplayName, AppId, Parameter
| sort by Rows desc

New sources: apps that produced 900144 today but not in the previous 14 days. A FirstSeen right after a deployment points to the release that broke it:

let recent =
    union SigninLogs, AADNonInteractiveUserSignInLogs, AADServicePrincipalSignInLogs
    | where TimeGenerated > ago(1d)
    | where ResultType == "900144"
    | summarize Rows = count(), FirstSeen = min(TimeGenerated) by AppId, AppDisplayName;
let before =
    union SigninLogs, AADNonInteractiveUserSignInLogs, AADServicePrincipalSignInLogs
    | where TimeGenerated between (ago(15d) .. ago(1d))
    | where ResultType == "900144"
    | distinct AppId;
recent
| join kind=leftanti before on AppId
| sort by Rows desc

AppDisplayName doesn’t exist in AADServicePrincipalSignInLogs; there, use ServicePrincipalName. ResultType is a string column, so compare it with "900144", not 900144.

How do I fix AADSTS900144?

For the user: you can’t fix this yourself. Report the error, with the parameter name from the message, to whoever runs the app.

For developers:

1. Read the parameter name in the error and add it to the request.
2. Check the flow’s parameter table in Microsoft’s documentation. For ROPC, client_id, grant_type, username and password are required, and the request is a POST with Content-Type: application/x-www-form-urlencoded.
3. Check that the parameter is in the request body, not the query string, as the message says. Our reading: a value that is empty or missing in your configuration ends up as no parameter at all.
4. Prefer a Microsoft Authentication Library (MSAL) over hand-built requests. Microsoft also recommends against ROPC: “it’s incompatible with multifactor authentication (MFA).”

For admins:

1. Use the second query to find the app and the parameter, and send both to the app’s owner.
2. If the app ID is unknown, look it up in Enterprise applications or App registrations. If nobody owns it, treat it like any unknown client calling your tenant.