# AADSTS90133: Device code flow not supported on /common or /consumers (fix) Canonical: https://brambrinkmeier.com/entra/aadsts/90133/ By Bram Brinkmeier. JSON: https://brambrinkmeier.com/api/aadsts/90133.json **Short answer:** AADSTS90133 means a device code request went to the /common or /consumers endpoint, where Entra didn't support it for that app. Microsoft doesn't list the code, but a code comment in its device code docs gives the message and the fix: use a tenant-specific authority. It is a configuration error with low attack value. **Fix:** Developer: use a tenant-specific authority for device code flow (https://login.microsoftonline.com/), not /common or /consumers, and use the same value for the devicecode and token requests. User: ask whoever runs the tool to set your tenant ID. | Field | Value | |---|---| | Code | AADSTS90133 | | Category | App configuration | | Type | Configuration error | | Attack signal | Low: usually configuration or user error | | In Microsoft's error reference | No (checked 2026-10-30) | | Verification | documentation | | Last updated | 2026-10-30 | ## What does AADSTS90133 mean? Microsoft's [error code reference](https://learn.microsoft.com/entra/identity-platform/reference-error-codes) doesn't list AADSTS90133 (checked 30 October 2026). The nearest listed code is AADSTS90130: *"The application isn't supported over the /common or /consumers endpoints."* Microsoft does mention 90133 elsewhere. The .NET sample in its [device code flow article for desktop apps](https://learn.microsoft.com/entra/identity-platform/scenario-desktop-acquire-token-device-code-flow) lists it in a code comment, with the fix: ```csharp // AADSTS90133: Device Code flow is not supported under /common or /consumers endpoint. // Mitigation: as explained in the message from Azure AD, the authority needs to be tenanted ``` "Tenanted" means the sign-in URL names your tenant, by ID or domain, instead of `common` or `consumers`. The same sample uses `https://login.microsoftonline.com/contoso.com` as its authority. This is a code comment, not a reference entry. Microsoft's device code protocol page says something broader. It says the `{tenant}` value *"Can be `/common`, `/consumers`, or `/organizations`"*, or a tenant ID or domain. Our reading: the two pages don't contradict each other if 90133 applies only to some apps, but Microsoft doesn't say which ones. Treat the code comment as the documented trigger and the exact conditions as unknown. We tried to reproduce it on 30 October 2026. A lab run requested a device code on `/consumers` with an app registered for work accounts only. Entra didn't return 90133. It returned [AADSTS700016](https://brambrinkmeier.com/entra/aadsts/700016/) instead: > AADSTS700016: Application with identifier '{app-id}' was not found in the directory '{tenant-id}'. Our reading: on `/consumers` Entra looked for the app in a directory that isn't our lab tenant and didn't find it. In that one run, 700016 came back before any 90133 check. We haven't found the setup that returns 90133. See [how pages are checked](https://brambrinkmeier.com/methodology/). ## Is it an attack? No. Microsoft's comment points to a configuration error in the app or script that starts the device code flow. The device code request is the first step of the flow, before any user signs in. | Pattern | Likely meaning | |---|---| | A new CLI tool or script fails on its first run | The authority is `/common` or `/consumers`. Use your tenant ID or domain. | | A tool works for one tenant and fails after a config change | Someone replaced the tenant ID with a generic endpoint. Likely, but unconfirmed. | | A vendor tool fails for every customer | The vendor's default authority is generic. Ask for a tenant setting. | ## How do I find it in my logs (KQL)? Microsoft doesn't document which sign-in table 90133 is logged in. Probably no row is written in your tenant: the request fails before a user signs in, and `/common` and `/consumers` don't name your tenant. Check anyway; this query is expected to return nothing: ```kusto union withsource=SourceTable SigninLogs, AADNonInteractiveUserSignInLogs, AADServicePrincipalSignInLogs | where TimeGenerated > ago(30d) | where ResultType == "90133" | summarize Rows = count() by SourceTable ``` ## How do I fix AADSTS90133? **For the user:** you can't fix this. Tell whoever runs the tool that its sign-in setting needs your tenant ID. **For developers:** 1. Use a tenant-specific authority for device code flow, as Microsoft's comment says: `https://login.microsoftonline.com/`. 2. Use the same value for the device code request (`/oauth2/v2.0/devicecode`) and the token polling request (`/oauth2/v2.0/token`). Microsoft's protocol page says the polling request must use *"the same tenant or tenant alias used in the initial request."* 3. If the tool serves many tenants, make the tenant a setting instead of hard-coding `common`. **For admins:** give the tool your tenant ID. Our [AADSTS90002 page](https://brambrinkmeier.com/entra/aadsts/90002/) shows how to find it. ## Evidence Not in Microsoft's error reference and not reproduced in the lab; built from lab results, other Microsoft pages and user reports, which the page names. Lab-run rows naming this code (22; full list at https://brambrinkmeier.com/lab-runs.json): | Date | Scenario | Expected | Got | Message (first line) | |---|---|---|---|---| | 2026-10-30 | Device code requested on /consumers by a work-account app | 90133 / 9002331 / 700016 | 700016 | AADSTS700016: Application with identifier '{app-id}' was not found in the directory '{tenant-id}'. This can | | 2026-10-30 | Device code on /common by a single-tenant app | 90133 / 700016 / 50194 | 50059 | AADSTS50059: No tenant-identifying information found in either the request or implied by any provided credentials. | | 2026-10-30 | Device code on /organizations by a single-tenant app | 90133 / 700016 / 50194 | 50059 | AADSTS50059: No tenant-identifying information found in either the request or implied by any provided credentials. | | 2026-10-30 | Device code requested on /consumers by a work-account app | 90133 / 9002331 / 700016 | 700016 | AADSTS700016: Application with identifier '{app-id}' was not found in the directory '{tenant-id}'. This can | | 2026-10-30 | Device code on /common by a single-tenant app | 90133 / 700016 / 50194 | 50059 | AADSTS50059: No tenant-identifying information found in either the request or implied by any provided credentials. | | 2026-10-30 | Device code on /organizations by a single-tenant app | 90133 / 700016 / 50194 | 50059 | AADSTS50059: No tenant-identifying information found in either the request or implied by any provided credentials. | | 2026-10-30 | Device code requested on /consumers by a work-account app | 90133 / 9002331 / 700016 | 700016 | AADSTS700016: Application with identifier '{app-id}' was not found in the directory '{tenant-id}'. This can | | 2026-10-30 | Device code on /common by a single-tenant app | 90133 / 700016 / 50194 | 50059 | AADSTS50059: No tenant-identifying information found in either the request or implied by any provided credentials. | | 2026-10-30 | Device code on /organizations by a single-tenant app | 90133 / 700016 / 50194 | 50059 | AADSTS50059: No tenant-identifying information found in either the request or implied by any provided credentials. | | 2026-10-30 | Device code requested on /consumers by a work-account app | 90133 / 9002331 / 700016 | 700016 | AADSTS700016: Application with identifier '{app-id}' was not found in the directory '{tenant-id}'. This can | | 2026-10-30 | Device code on /common by a single-tenant app | 90133 / 700016 / 50194 | 50059 | AADSTS50059: No tenant-identifying information found in either the request or implied by any provided credentials. | | 2026-10-30 | Device code on /organizations by a single-tenant app | 90133 / 700016 / 50194 | 50059 | AADSTS50059: No tenant-identifying information found in either the request or implied by any provided credentials. | | 2026-10-30 | Device code requested on /consumers by a work-account app | 90133 / 9002331 / 700016 | 700016 | AADSTS700016: Application with identifier '{app-id}' was not found in the directory '{tenant-id}'. This can | | 2026-10-30 | Device code on /common by a single-tenant app | 90133 / 700016 / 50194 | 50059 | AADSTS50059: No tenant-identifying information found in either the request or implied by any provided credentials. | | 2026-10-30 | Device code on /organizations by a single-tenant app | 90133 / 700016 / 50194 | 50059 | AADSTS50059: No tenant-identifying information found in either the request or implied by any provided credentials. | | 2026-10-30 | Device code requested on /consumers by a work-account app | 90133 / 9002331 / 700016 | 700016 | AADSTS700016: Application with identifier '{app-id}' was not found in the directory '{tenant-id}'. This can | | 2026-10-31 | Device code requested on /consumers by a work-account app | 90133 / 9002331 / 700016 | 700016 | AADSTS700016: Application with identifier '{app-id}' was not found in the directory '{tenant-id}'. This can | | 2026-10-31 | Device code on /common by a single-tenant app | 90133 / 700016 / 50194 | 50059 | AADSTS50059: No tenant-identifying information found in either the request or implied by any provided credentials. | | 2026-10-31 | Device code on /organizations by a single-tenant app | 90133 / 700016 / 50194 | 50059 | AADSTS50059: No tenant-identifying information found in either the request or implied by any provided credentials. | | 2026-10-31 | Device code requested on /consumers by a work-account app | 90133 / 9002331 / 700016 | 700016 | AADSTS700016: Application with identifier '{app-id}' was not found in the directory '{tenant-id}'. This can | | 2026-10-31 | Device code on /common by a single-tenant app | 90133 / 700016 / 50194 | 50059 | AADSTS50059: No tenant-identifying information found in either the request or implied by any provided credentials. | | 2026-10-31 | Device code on /organizations by a single-tenant app | 90133 / 700016 / 50194 | 50059 | AADSTS50059: No tenant-identifying information found in either the request or implied by any provided credentials. | ## Sources 1. [Microsoft Entra authentication and authorization error codes](https://learn.microsoft.com/entra/identity-platform/reference-error-codes) 2. [Desktop app that calls web APIs: Acquire a token by using device code flow](https://learn.microsoft.com/entra/identity-platform/scenario-desktop-acquire-token-device-code-flow) 3. [Microsoft identity platform and the OAuth 2.0 device authorization grant flow](https://learn.microsoft.com/entra/identity-platform/v2-oauth2-device-code) ## Related codes [AADSTS700016](https://brambrinkmeier.com/entra/aadsts/700016/), [AADSTS90002](https://brambrinkmeier.com/entra/aadsts/90002/), [AADSTS500011](https://brambrinkmeier.com/entra/aadsts/500011/), [AADSTS7000218](https://brambrinkmeier.com/entra/aadsts/7000218/), [AADSTS50194](https://brambrinkmeier.com/entra/aadsts/50194/), [AADSTS70016](https://brambrinkmeier.com/entra/aadsts/70016/) ## License and citation CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). CC BY 4.0 covers the author's own text and classification fields. Quoted Microsoft error wording belongs to Microsoft, is quoted with its source and can change. Cite as: Bram Brinkmeier, "AADSTS90133: Device code flow not supported on /common or /consumers (fix)", https://brambrinkmeier.com/entra/aadsts/90133/ (CC BY 4.0), last updated 2026-10-30.