AADSTS9002331: App is for personal Microsoft accounts only (fix)

What does AADSTS9002331 mean?

Microsoft’s error code reference doesn’t list AADSTS9002331 (checked 30 October 2026).

The wording below comes from a user report on Microsoft Q&A. The user posted a screenshot; a Microsoft moderator quoted the text as:

AADSTS9002331: Application ‘…73f’(…Demo) is configured for use by Microsoft Account users only. Please use the /consumers endpoint to serve this request.

The moderator’s explanation: the app registration allows only personal Microsoft accounts (PersonalMicrosoftAccount), and the error happens when a user from a Microsoft Entra tenant or another identity provider tries to sign in. The fix given was to change the app’s supported account types. The thread doesn’t confirm the fix.

The app setting behind it is Supported account types. Microsoft’s signInAudience page maps Personal Microsoft accounts only to signInAudience value PersonalMicrosoftAccount.

A lab test on 30 October 2026 returned a different code for this case. I registered an app with Supported account types set to personal Microsoft accounts only, then sent a password-grant request to my tenant’s own endpoint. Entra answered with AADSTS9002346, not 9002331:

AADSTS9002346: Application ‘’() is configured for use by Microsoft Account users only. Please use the /consumers endpoint to serve this request.

The wording is the same apart from the number. So on a current tenant this condition produces 9002346, while the user report above shows 9002331 for the same situation. Match on both if you are writing a rule, and see 9002346 for the lab-reproduced page.

The endpoint matters too. Microsoft’s OpenID Connect reference describes the {tenant} values in the sign-in URL:

Value	Microsoft’s description
common	Users with both a personal Microsoft account and a work or school account from Microsoft Entra ID can sign in to the application.
organizations	Only users with work or school accounts from Microsoft Entra ID can sign in to the application.
consumers	Only users with a personal Microsoft account can sign in to the application.
tenant ID or domain	Only users from a specific Microsoft Entra tenant […] can sign in to the application.

Microsoft’s error reference does list the reverse case, AADSTS9002332: “Application ‘{principalId}’({principalName}) is configured for use by Microsoft Entra users only. Please do not use the /consumers endpoint to serve this request.” Our reading: 9002331 is its mirror. A personal-accounts-only app was called on an endpoint other than /consumers.

Is it an attack?

No. It is a mismatch between the app’s supported account types and the sign-in endpoint or the account used.

Pattern	Likely meaning
A sample or tutorial app fails on first run	The app was registered as Personal Microsoft accounts only but the code uses a tenant ID, /organizations or /common. Our interpretation.
A work account user can’t sign in to an app that works for a personal account	The app was never meant for work accounts, or was registered with the wrong account type.
A third-party product fails for your staff	The vendor’s app is registered for personal accounts only. Only the vendor can change that.

How do I find it in my logs (KQL)?

Microsoft doesn’t document which table 9002331 is logged in. Our reading: an app registered for personal accounts only usually has no service principal in your tenant, and a request on /consumers or /common may never reach your tenant at all. Expect few or no rows. Check anyway:

union withsource=SourceTable SigninLogs, AADNonInteractiveUserSignInLogs, AADServicePrincipalSignInLogs
| where TimeGenerated > ago(30d)
| where ResultType == "9002331"
| summarize Rows = count(), Apps = make_set(AppId, 10) by SourceTable

How do I fix AADSTS9002331?

For the user: if you have a personal Microsoft account (Outlook.com, Hotmail, Xbox), try that one. If the app should work with your work account, report it to the app’s owner.

For developers:

1. Decide who the app is for. Personal accounts only: sign in through https://login.microsoftonline.com/consumers/. That is what the error message asks for.
2. If work or school accounts must sign in too, change Supported account types on the app registration. The Microsoft moderator’s fix was exactly this. Microsoft’s signInAudience page lists the options and the validation rules that differ between them.
3. For both personal and work accounts, use AzureADandPersonalMicrosoftAccount and the /common endpoint. Microsoft notes that with common or consumers “the consuming resource application must be configured to support such type of accounts”.

For admins:

1. If this is your own app registration, check Supported account types under the app’s Authentication page, and agree the change with the developer.
2. If it is a vendor’s app, you can’t change it. Ask the vendor for a version registered for work accounts.