# AADSTS9002346: App is for personal Microsoft accounts only (fix)

Canonical: https://brambrinkmeier.com/entra/aadsts/9002346/
By Bram Brinkmeier. JSON: https://brambrinkmeier.com/api/aadsts/9002346.json

**Short answer:** AADSTS9002346 means the app registration is set to personal Microsoft accounts only, and the request went to a tenant endpoint instead of /consumers. Microsoft's error reference doesn't list it. It is a configuration error with low attack value. Either call /consumers, or change Supported account types on the app registration.

**Fix:** Developer: for a personal-accounts-only app, send the request to `https://login.microsoftonline.com/consumers/`. If work or school accounts must sign in too, change Supported account types on the app registration. User: try your personal Microsoft account.

| Field | Value |
|---|---|
| Code | AADSTS9002346 |
| Category | App configuration |
| Type | Configuration error |
| Attack signal | Low: usually configuration or user error |
| In Microsoft's error reference | No (checked 2026-10-30) |
| Verification | lab-reproduced (2026-10-30) |
| Last updated | 2026-10-30 |

## What does AADSTS9002346 mean?

Microsoft's [error code reference](https://learn.microsoft.com/entra/identity-platform/reference-error-codes) doesn't list AADSTS9002346 (checked 30 October 2026). We found no other Microsoft page that names it. The wording below is from a lab run:

> AADSTS9002346: Application '\<app id>'(\<app name>) is configured for use by Microsoft Account users only. Please use th...

The lab records only the first line of `error_description`, cut at about 160 characters. The sentence completes as *"Please use the /consumers endpoint to serve this request"*, which is how the same message appears in a user report for the near-identical code [9002331](https://brambrinkmeier.com/entra/aadsts/9002331/).

The setting behind it is **Supported account types** on the app registration. Microsoft's signInAudience page maps the portal choices to manifest values:

| Supported account types | `signInAudience` |
|---|---|
| Accounts in this organizational directory only (Single tenant) | `AzureADMyOrg` |
| Accounts in any organizational directory (Any Microsoft Entra directory - Multitenant) | `AzureADMultipleOrgs` |
| Accounts in any organizational directory ... and personal Microsoft accounts (such as Skype, Xbox) | `AzureADandPersonalMicrosoftAccount` |
| Personal Microsoft accounts only | `PersonalMicrosoftAccount` |

An app at `PersonalMicrosoftAccount` exists only for consumer accounts, and consumer accounts sign in through `/consumers`. Microsoft's OpenID Connect reference describes the endpoint values:

| Value | Microsoft's description |
|---|---|
| `common` | Users with both a personal Microsoft account and a work or school account from Microsoft Entra ID can sign in to the application. |
| `organizations` | Only users with work or school accounts from Microsoft Entra ID can sign in to the application. |
| `consumers` | Only users with a personal Microsoft account can sign in to the application. |
| Directory (tenant) ID or domain | Only users from a specific Microsoft Entra tenant ... can sign in to the application. |

So the request named a tenant that the app does not serve. Microsoft's reference does list the mirror case, **AADSTS9002332**: *"Application '{principalId}'({principalName}) is configured for use by Microsoft Entra users only. Please do not use the /consumers endpoint to serve this request."* 9002346 is the same check in the other direction.

### 9002346 and 9002331
[9002331](https://brambrinkmeier.com/entra/aadsts/9002331/) carries the same sentence with a different number. A Microsoft Q&A thread quotes it as *"AADSTS9002331: Application '...73f'(...Demo) is configured for use by Microsoft Account users only. Please use the /consumers endpoint to serve this request."*, and a Microsoft moderator answers: *"From your error message, it looks like your App Registration is set for users to sign-in using their `PersonalMicrosoftAccount` only."*

On a current tenant, the lab run below produced 9002346 for that condition, not 9002331. We can't tell from one tenant whether 9002331 is older, path-specific or flow-specific, so treat them as one condition and match on both in a detection rule.

## Reproduced in the lab

On 30 October 2026 an automated lab run registered an app with **Supported account types** set to personal Microsoft accounts only, then sent a password-grant (ROPC) token request to the lab tenant's own endpoint, with a user from that tenant. Entra returned `AADSTS9002346`:

> AADSTS9002346: Application '\<app id>'(\<app name>) is configured for use by Microsoft Account users only. Please use th...

Control requests in the same run, using an ordinary single-tenant app on the same endpoint with the same user, reached the credential check and returned either a token or a credential error. So 9002346 is about the app's supported account types and the endpoint, not about the user or the password.

No sign-in log row was captured. See [how pages are checked](https://brambrinkmeier.com/methodology/).

In the lab tenant's sign-in logs the row appears under **User sign-ins (interactive)**, Status **Failure**, Conditional Access **Not Applied**, with the Application column naming the personal-accounts-only app.

## Is it an attack?

No. The app's supported account types and the endpoint the code calls disagree.

| Pattern | Likely meaning |
|---|---|
| A sample or tutorial app fails on the first run | Registered as **Personal Microsoft accounts only** while the code uses a tenant ID, `/organizations` or `/common`. |
| Work account users can't sign in to an app that works with a personal account | The app was never meant for work accounts, or the account type was set wrongly at registration. |
| A third-party product fails for all your staff | The vendor's app registration is consumer-only. Only the vendor can change that. |
| It appears right after someone edited the app registration | **Supported account types** was narrowed to personal accounts only. Check the audit log. |

## How do I find it in my logs (KQL)?

Which sign-in table 9002346 lands in is undocumented, and our reading is that most of these never reach your tenant's logs at all: a consumer-only app usually has no service principal in your tenant, and the refusal happens at the endpoint. Expect few or no rows, and check with a union rather than guessing one table:

```kusto
union withsource=SourceTable SigninLogs, AADNonInteractiveUserSignInLogs, AADServicePrincipalSignInLogs
| where TimeGenerated > ago(30d)
| where ResultType in ("9002346", "9002331") or ResultSignature in ("9002346", "9002331")
| summarize Rows = count(), Apps = make_set(AppId, 10), LastSeen = max(TimeGenerated) by SourceTable, ResultType
```

If you do get rows, the faster question is which account types your own app registrations use. That is a Graph or PowerShell query against the directory, not a log query:

```powershell
Connect-MgGraph -Scopes "Application.Read.All"
Get-MgApplication -All |
    Where-Object { $_.SignInAudience -eq "PersonalMicrosoftAccount" } |
    Select-Object DisplayName, AppId, SignInAudience
```

## How do I fix AADSTS9002346?

**For the user:** if you have a personal Microsoft account (Outlook.com, Hotmail, Xbox), try signing in with that one. If the app is meant for your work account, report it to whoever owns the app.

**For developers:**
1. Decide who the app is for. Personal accounts only: send the request to `https://login.microsoftonline.com/consumers/`, which is what the error message asks for.
2. If work or school accounts must sign in too, change **Supported account types** on the app registration. For both kinds of account, use `AzureADandPersonalMicrosoftAccount` and the `/common` endpoint.
3. Don't hardcode a tenant ID in an app registered for personal accounts only. The two settings contradict each other.

**For admins:**
1. For your own app registration, check **Supported account types** on the app's **Authentication** page, and agree any change with the developer. Microsoft's signInAudience page lists the validation rules that differ between the account types, so a change can also require edits elsewhere in the registration.
2. For a vendor's app, you cannot change it. Ask the vendor for a registration that supports work accounts.

## Evidence

Reproduced in a lab tenant on 2026-10-30 (Password-grant (ROPC) token request against a lab tenant; scenario: Personal-accounts-only app on a tenant endpoint). First line returned:

> AADSTS9002346: Application '{app-id}'(lab-msa-only-41136574530) is configured for use by Microsoft Account users only. Please use th

Sign-in log row read: 2026-10-31.

Lab-run rows naming this code (5; full list at https://brambrinkmeier.com/lab-runs.json):

| Date | Scenario | Expected | Got | Message (first line) |
|---|---|---|---|---|
| 2026-10-30 | Personal-accounts-only app on a tenant endpoint | 9002331 | 9002346 | AADSTS9002346: Application '{app-id}'(lab-msa-only-41136574530) is configured for use by Microsoft Account users only. Please use th |
| 2026-10-30 | Personal-accounts-only app on a tenant endpoint | 9002331 | 9002346 | AADSTS9002346: Application '{app-id}'(lab-msa-only-41139925607) is configured for use by Microsoft Account users only. Please use th |
| 2026-10-30 | Personal-accounts-only app on a tenant endpoint | 9002331 | 9002346 | AADSTS9002346: Application '{app-id}'(lab-msa-only-41143330001) is configured for use by Microsoft Account users only. Please use th |
| 2026-10-31 | Personal-accounts-only app on a tenant endpoint | 9002331 | 9002346 | AADSTS9002346: Application '{app-id}'(lab-msa-only-41146039117) is configured for use by Microsoft Account users only. Please use th |
| 2026-10-31 | Personal-accounts-only app on a tenant endpoint | 9002331 | 9002346 | AADSTS9002346: Application '{app-id}'(lab-msa-only-41150019626) is configured for use by Microsoft Account users only. Please use th |

## Sources

1. [Microsoft Entra authentication and authorization error codes](https://learn.microsoft.com/en-us/entra/identity-platform/reference-error-codes)
2. [Validation differences by supported account types (signInAudience)](https://learn.microsoft.com/en-us/entra/identity-platform/supported-accounts-validation)
3. [OpenID Connect on the Microsoft identity platform](https://learn.microsoft.com/en-us/entra/identity-platform/v2-protocols-oidc)
4. [Microsoft Q&A: Access issue (1160493)](https://learn.microsoft.com/en-us/answers/questions/1160493/access-issue)
5. [SigninLogs table reference (Azure Monitor)](https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/signinlogs)

## Related codes

[AADSTS9002331](https://brambrinkmeier.com/entra/aadsts/9002331/), [AADSTS50020](https://brambrinkmeier.com/entra/aadsts/50020/), [AADSTS700016](https://brambrinkmeier.com/entra/aadsts/700016/), [AADSTS90002](https://brambrinkmeier.com/entra/aadsts/90002/)

## License and citation

CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). CC BY 4.0 covers the author's own text and classification fields. Quoted Microsoft error wording belongs to Microsoft, is quoted with its source and can change.

Cite as: Bram Brinkmeier, "AADSTS9002346: App is for personal Microsoft accounts only (fix)", https://brambrinkmeier.com/entra/aadsts/9002346/ (CC BY 4.0), last updated 2026-10-30.