# AADSTS90019 fix: no tenant found in the sign-in request

Canonical: https://brambrinkmeier.com/entra/aadsts/90019/
By Bram Brinkmeier. JSON: https://brambrinkmeier.com/api/aadsts/90019.json

**Short answer:** AADSTS90019 means Microsoft Entra ID couldn't work out which tenant a sign-in was for: the request didn't name one and the credentials didn't imply one. Users often see it in Outlook or the browser after typing a short username. Our reading: developers can hit it when an app uses the `common` endpoint with no user or tenant hint. It is a configuration or input error with low attack value.

**Fix:** User: sign in with your full work email address ({user-principal-name}), not a short username, and retype saved credentials. Developer: put your tenant ID or verified domain in the authority URL, or send a `login_hint` or `domain_hint` when you use `common` or `organizations`.

| Field | Value |
|---|---|
| Code | AADSTS90019 |
| Microsoft name | MissingTenantRealm |
| Category | Graph request shape |
| Type | Failure |
| Attack signal | Low: usually configuration or user error |
| In Microsoft's error reference | Yes |
| Verification | documentation |
| Last updated | 2026-11-01 |

## What does AADSTS90019 mean?

Microsoft's description:

> **MissingTenantRealm**: Microsoft Entra ID was unable to determine the tenant identifier from the request.

The message users post is longer: *"No tenant-identifying information found in either the request or implied by any provided credentials."* Entra ID didn't know which organisation's directory to use, so, our reading, it stopped before checking anything else.

Entra ID gets the tenant from one of two places:

- **The URL.** In the authority `https://login.microsoftonline.com/<tenant>/`, Microsoft says *"the `<tenant>` in the URL is the tenant ID of the Microsoft Entra tenant (a GUID), or its tenant domain."*
- **The user.** On the common sign-in page users *"enter a user principal name (UPN). Microsoft Entra ID uses this information to determine the correct sign-in location."* Microsoft calls this Home Realm Discovery.

Our reading: 90019 is what you get when neither source gives an answer. The request went to `common` or `organizations`, and there was no username with a known domain, no hint, and no credential that points at a tenant.

Don't confuse it with two codes that already have pages. [90002](https://brambrinkmeier.com/entra/aadsts/90002/) means a tenant value was sent but no such tenant exists. [900023](https://brambrinkmeier.com/entra/aadsts/900023/) means the tenant value isn't a valid tenant ID or domain at all. With 90019 there was no tenant value to check.

## Is it an attack?

Rarely. Our reading: the request fails before any user, password or app in your tenant is looked at. Users report it in ordinary situations:

- A university helpdesk sees it when students sign in to **Outlook**. Their advice is to enter the full email address, retype saved credentials, and try another browser or a private window.
- TheWindowsClub reports it for Office 365 and Skype for Business sign-ins.
- Quest has a knowledge base entry for it in Essentials for Office 365, a migration tool, which suggests admin tools and integrations hit it too.

| Pattern | Likely meaning |
|---|---|
| One user, one app, then a success | The user typed a short username or a saved credential was wrong. Benign. |
| Every run of a script or service fails | The script sends an app-only request to `common` or `organizations`. A developer error. |
| A third-party federation or migration tool fails for everyone | The tool's tenant or domain setting is empty or wrong. Configuration. |

Our reading: since Entra ID didn't find a tenant, it may not write the failure to your tenant's sign-in log at all. Microsoft doesn't document this. An empty result from the queries below doesn't prove users aren't hitting it; ask them for the error page details.

## How do I find it in my logs (KQL)?

Microsoft doesn't document which sign-in table 90019 lands in, or whether it reaches a tenant's log at all. Check your workspace:

```kusto
union withsource=SourceTable SigninLogs, AADNonInteractiveUserSignInLogs, AADServicePrincipalSignInLogs
| where TimeGenerated > ago(30d)
| where ResultType == "90019"
| summarize Rows = count(), Apps = dcount(AppId) by SourceTable
```

If rows exist, see which app, client and user agent produce them:

```kusto
union SigninLogs, AADNonInteractiveUserSignInLogs
| where TimeGenerated > ago(30d)
| where ResultType == "90019"
| summarize Rows = count(),
            Users = dcount(UserPrincipalName),
            Clients = make_set(ClientAppUsed, 5),
            Agents = make_set(UserAgent, 5),
            FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
          by AppDisplayName, AppId
| sort by Rows desc
```

`ResultType` is a **string** column, so compare it with `"90019"`, not `90019`.

## How do I fix AADSTS90019?

**For the user:**
1. Sign in with your **full work email address** (for example `{user-principal-name}`), not just your username. Entra ID uses the domain part to find your organisation.
2. If a password manager or the app filled in the name, retype it yourself.
3. Users report that a private browser window, clearing the browser cache, or another browser also helps. If none of that works, send your IT helpdesk the error details.

**For developers:**
1. If your app serves one organisation, put the tenant ID (GUID) or a verified domain in the authority: `https://login.microsoftonline.com/<tenant>/`.
2. For app-only requests (client credentials), the token request needs a tenant. Microsoft's reference marks `tenant` as **Required**: *"The directory tenant the application plans to operate against, in GUID or domain-name format."*
3. For a multitenant app on `common` or `organizations`, give Entra ID a way to find the tenant: a `login_hint` with the user's address, or a domain hint. Microsoft lists the domain hint per protocol: `domain_hint` for OpenID Connect, `whr` for WS-Federation, and a domain hint or `whr` for SAML.

**For admins:**
1. For a third-party tool or federation service (a migration tool, a WS-Federation identity provider), check that its tenant or domain setting is filled in with your tenant ID or a verified domain.
2. Check that users' sign-in names use a domain verified in your tenant. Microsoft notes that sign-in uses *"organization and user settings for the username entered on the sign-in page."*

## Evidence

Not reproduced in the lab yet; the page is based on Microsoft's documentation.

## Sources

1. [Microsoft Entra authentication and authorization error codes](https://learn.microsoft.com/entra/identity-platform/reference-error-codes)
2. [Application configuration options (MSAL): Authority](https://learn.microsoft.com/en-us/entra/identity-platform/msal-client-application-configuration)
3. [Microsoft identity platform and the OAuth 2.0 client credentials flow](https://learn.microsoft.com/entra/identity-platform/v2-oauth2-client-creds-grant-flow)
4. [Home Realm Discovery for an application](https://learn.microsoft.com/entra/identity/enterprise-apps/home-realm-discovery-policy)
5. [Username lookup during sign-in (sign-in realm discovery)](https://learn.microsoft.com/en-us/entra/identity/users/signin-realm-discovery)
6. [Receiving error code AADSTS90019 in Outlook (CCAC help center, user report)](https://helpcenter.ccac.edu/137393-outlook/receiving-error-code-aadsts90019-in-outlook)
7. [AADSTS90019: No tenant-identifying information found (TheWindowsClub, user report)](https://www.thewindowsclub.com/aadsts90019-no-tenant-identifying-information-found)
8. [AADSTS90019 (Quest Essentials for Office 365 KB 4230157, user report)](https://support.quest.com/ja-jp/kb/4230157/aadsts90019-no-tenant-identifying-information-found-in-either-the-request-or-implied-by-any-provided-credentials)

## Related codes

[AADSTS90002](https://brambrinkmeier.com/entra/aadsts/90002/), [AADSTS900023](https://brambrinkmeier.com/entra/aadsts/900023/), [AADSTS50034](https://brambrinkmeier.com/entra/aadsts/50034/), [AADSTS700016](https://brambrinkmeier.com/entra/aadsts/700016/)

## License and citation

CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). CC BY 4.0 covers the author's own text and classification fields. Quoted Microsoft error wording belongs to Microsoft, is quoted with its source and can change.

Cite as: Bram Brinkmeier, "AADSTS90019 fix: no tenant found in the sign-in request", https://brambrinkmeier.com/entra/aadsts/90019/ (CC BY 4.0), last updated 2026-11-01.