{ "schemaVersion": "1.0", "generatedAt": "2026-11-08T15:15:25.046Z", "name": "Entra ID and Microsoft Graph error-code lab runs", "description": "Every automated lab run recorded in data/lab-runs/ of the site repository: the scenario sent, the code expected, the code returned and the first line of the message as returned. Identifiers from the lab tenant (tenant id, app and object ids, addresses) are replaced with placeholders such as {tenant-id}.", "semantics": "Append-only: a run is never edited after the fact; a later run is a new record with its own date. A result is a measurement on that date and can differ from a later run.", "license": "CC BY 4.0", "licenseUrl": "https://creativecommons.org/licenses/by/4.0/", "attribution": "Bram Brinkmeier, https://brambrinkmeier.com/ (Bram Brinkmeier), CC BY 4.0", "method": "https://brambrinkmeier.com/methodology/", "documentation": "https://brambrinkmeier.com/for-agents/", "runCount": 14, "resultCount": 505, "runs": [ { "id": "2026-10-25", "kind": "token-endpoint", "date": "2026-10-25", "run": null, "method": "ROPC token request against a lab tenant", "workflow": ".github/workflows/lab-error-codes.yml", "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/38", "note": "message is the first line of error_description as recorded in the issue, which cuts it at about 160 characters.", "results": [ { "scenario": "User does not exist", "request": null, "httpStatus": null, "expected": "50034", "got": "50034", "matchedExpectation": true, "message": "AADSTS50034: The user account {EUII Hidden} does not exist in the {tenant-id} directory. To sign into this application, the account mus" }, { "scenario": "Wrong password", "request": null, "httpStatus": null, "expected": "50126", "got": "50126", "matchedExpectation": true, "message": "AADSTS50126: Error validating credentials due to invalid username or password." }, { "scenario": "Account disabled", "request": null, "httpStatus": null, "expected": "50057", "got": "50057", "matchedExpectation": true, "message": "AADSTS50057: The user account is disabled." }, { "scenario": "Must change password at next sign-in", "request": null, "httpStatus": null, "expected": "50055 / 50144 / 50173", "got": "50055", "matchedExpectation": true, "message": "AADSTS50055: The password is expired." }, { "scenario": "Correct password (security defaults / MFA / consent decide)", "request": null, "httpStatus": null, "expected": "success / 50076 / 50079 / 65001 / 50072", "got": "65001", "matchedExpectation": true, "message": "AADSTS65001: The user or administrator has not consented to use the application with ID '{app-id}' named 'lab-signin-client'. Send a" }, { "scenario": "Unknown client ID", "request": null, "httpStatus": null, "expected": "700016", "got": "700016", "matchedExpectation": true, "message": "AADSTS700016: Application with identifier '{app-id}' was not found in the directory '{tenant-id}'. This can" }, { "scenario": "Resource does not exist in tenant", "request": null, "httpStatus": null, "expected": "500011", "got": "500011", "matchedExpectation": true, "message": "AADSTS500011: The resource principal named https://does-not-exist.brambrinkmeier.com was not found in the tenant named {tenant-id}. Thi" }, { "scenario": "Tenant does not exist", "request": null, "httpStatus": null, "expected": "90002", "got": "90002", "matchedExpectation": true, "message": "AADSTS90002: Tenant '{tenant-id}' not found. Check to make sure you have the correct tenant ID and are signing into the correct cloud." }, { "scenario": "Password parameter missing", "request": null, "httpStatus": null, "expected": "900144", "got": "900144", "matchedExpectation": true, "message": "AADSTS900144: The request body must contain the following parameter: 'password'." } ] }, { "id": "2026-10-30-round4", "kind": "token-endpoint", "date": "2026-10-30", "run": "round 4", "method": "token-endpoint requests against a lab tenant", "workflow": ".github/workflows/lab-error-codes.yml", "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/67", "note": "message is the first line of error_description as recorded in the issue, which cuts it at about 160 characters.", "results": [ { "scenario": "User does not exist", "request": null, "httpStatus": null, "expected": "50034", "got": "50034", "matchedExpectation": true, "message": "AADSTS50034: The user account {EUII Hidden} does not exist in the {tenant-id} directory. To sign into this application, the account mus" }, { "scenario": "Wrong password", "request": null, "httpStatus": null, "expected": "50126", "got": "50126", "matchedExpectation": true, "message": "AADSTS50126: Error validating credentials due to invalid username or password." }, { "scenario": "Account disabled", "request": null, "httpStatus": null, "expected": "50057", "got": "50057", "matchedExpectation": true, "message": "AADSTS50057: The user account is disabled." }, { "scenario": "Must change password at next sign-in", "request": null, "httpStatus": null, "expected": "50055 / 50144 / 50173", "got": "50055", "matchedExpectation": true, "message": "AADSTS50055: The password is expired." }, { "scenario": "Correct password (security defaults / MFA / consent decide)", "request": null, "httpStatus": null, "expected": "success / 50076 / 50079 / 65001 / 50072", "got": "65001", "matchedExpectation": true, "message": "AADSTS65001: The user or administrator has not consented to use the application with ID '{app-id}' named 'lab-signin-client'. Send a" }, { "scenario": "Unknown client ID", "request": null, "httpStatus": null, "expected": "700016", "got": "700016", "matchedExpectation": true, "message": "AADSTS700016: Application with identifier '{app-id}' was not found in the directory '{tenant-id}'. This can" }, { "scenario": "Resource does not exist in tenant", "request": null, "httpStatus": null, "expected": "500011", "got": "500011", "matchedExpectation": true, "message": "AADSTS500011: The resource principal named https://does-not-exist.brambrinkmeier.com was not found in the tenant named {tenant-id}. Thi" }, { "scenario": "Tenant does not exist", "request": null, "httpStatus": null, "expected": "90002", "got": "90002", "matchedExpectation": true, "message": "AADSTS90002: Tenant '{tenant-id}' not found. Check to make sure you have the correct tenant ID and are signing into the correct cloud. " }, { "scenario": "Password parameter missing", "request": null, "httpStatus": null, "expected": "900144", "got": "900144", "matchedExpectation": true, "message": "AADSTS900144: The request body must contain the following parameter: 'password'." }, { "scenario": "Token request with a browser Origin header from a non-SPA client", "request": null, "httpStatus": null, "expected": "9002326", "got": "9002326", "matchedExpectation": true, "message": "AADSTS9002326: Cross-origin token redemption is permitted only for the 'Single-Page Application' client-type. Request origin: 'https://lab.brambrinkmeier.com'." }, { "scenario": "Malformed tenant identifier", "request": null, "httpStatus": null, "expected": "900023", "got": "900023", "matchedExpectation": true, "message": "AADSTS900023: Specified tenant identifier 'not_a_valid~tenant' is neither a valid DNS name, nor a valid external domain." }, { "scenario": "Password longer than 256 characters", "request": null, "httpStatus": null, "expected": "50052", "got": "50052", "matchedExpectation": true, "message": "AADSTS50052: The password entered exceeds the maximum length. Please reach out to your admin to reset the password." }, { "scenario": "Deleted user signs in", "request": null, "httpStatus": null, "expected": "500341 / 50034", "got": "65001", "matchedExpectation": false, "message": "AADSTS65001: The user or administrator has not consented to use the application with ID '{app-id}' named 'lab-signin-client'. Send a" }, { "scenario": "Device code that was never issued", "request": null, "httpStatus": null, "expected": "70020 / 70000 / 9002313", "got": "7000014", "matchedExpectation": false, "message": "AADSTS7000014: The provided value for the input parameter 'device_code' is not valid." }, { "scenario": "Device code requested on /consumers by a work-account app", "request": null, "httpStatus": null, "expected": "90133 / 9002331 / 700016", "got": "700016", "matchedExpectation": true, "message": "AADSTS700016: Application with identifier '{app-id}' was not found in the directory '{tenant-id}'. This can" }, { "scenario": "Both scope and resource sent", "request": null, "httpStatus": null, "expected": "9010010", "got": "9010010", "matchedExpectation": true, "message": "AADSTS9010010: The resource parameter provided in the request doesn't match with the requested scopes." }, { "scenario": "Confidential client sends no credential", "request": null, "httpStatus": null, "expected": "7000218", "got": "7000216", "matchedExpectation": false, "message": "AADSTS7000216: 'client_assertion', 'client_secret' or 'request' is required for the 'client_credentials' grant type." }, { "scenario": "Client assertion that is not a JWT", "request": null, "httpStatus": null, "expected": "9002313 / 50027 / 700027", "got": "50027", "matchedExpectation": true, "message": "AADSTS50027: JWT token is invalid or malformed." }, { "scenario": "Unknown client_assertion_type", "request": null, "httpStatus": null, "expected": "9002313 / 700027", "got": "90023", "matchedExpectation": false, "message": "AADSTS90023: Unexpected client assertion type." }, { "scenario": "Device code on /common by a single-tenant app", "request": null, "httpStatus": null, "expected": "90133 / 700016 / 50194", "got": "50059", "matchedExpectation": false, "message": "AADSTS50059: No tenant-identifying information found in either the request or implied by any provided credentials." }, { "scenario": "Device code on /organizations by a single-tenant app", "request": null, "httpStatus": null, "expected": "90133 / 700016 / 50194", "got": "50059", "matchedExpectation": false, "message": "AADSTS50059: No tenant-identifying information found in either the request or implied by any provided credentials." }, { "scenario": "Old password after an admin reset", "request": null, "httpStatus": null, "expected": "50054 / 50126", "got": "error", "matchedExpectation": false, "message": "Graph PATCH /users/{object-id}: HTTP 403 {\"error\":{\"code\":\"Authorization_RequestDenied\",\"message\":\"Insufficient privileges to complete " }, { "scenario": "Repeated wrong passwords (smart lockout)", "request": null, "httpStatus": null, "expected": "50053", "got": "50053", "matchedExpectation": true, "message": "AADSTS50053: The account is locked, you've tried to sign in too many times with an incorrect user ID or password." }, { "scenario": "Token request over TLS 1.0", "request": null, "httpStatus": null, "expected": "1002016", "got": null, "matchedExpectation": false, "message": "no response: ECONNRESET" }, { "scenario": "Client assertion expired", "request": null, "httpStatus": null, "expected": "700024", "got": "700024", "matchedExpectation": true, "message": "AADSTS700024: Client assertion is not within its valid time range. Current time: 2026-10-30T21:40:51.4941498Z, assertion valid from 2026-10-30T21:24:51.0000000Z" }, { "scenario": "Deleted user signs in, about 12 minutes after deletion", "request": null, "httpStatus": null, "expected": "500341 / 50034", "got": "50034", "matchedExpectation": true, "message": "AADSTS50034: The user account {EUII Hidden} does not exist in the {tenant-id} directory. To sign into this application, the account mus" } ] }, { "id": "2026-10-30-round5", "kind": "token-endpoint", "date": "2026-10-30", "run": "round 5", "method": "token-endpoint requests against a lab tenant, using lab-created test apps", "workflow": ".github/workflows/lab-error-codes.yml", "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/69", "note": "message is the first line of error_description as recorded in the issue, which cuts it at about 160 characters.", "results": [ { "scenario": "User does not exist", "request": null, "httpStatus": null, "expected": "50034", "got": "50034", "matchedExpectation": true, "message": "AADSTS50034: The user account {EUII Hidden} does not exist in the {tenant-id} directory. To sign into this application, the account mus" }, { "scenario": "Wrong password", "request": null, "httpStatus": null, "expected": "50126", "got": "50126", "matchedExpectation": true, "message": "AADSTS50126: Error validating credentials due to invalid username or password." }, { "scenario": "Account disabled", "request": null, "httpStatus": null, "expected": "50057", "got": "50057", "matchedExpectation": true, "message": "AADSTS50057: The user account is disabled." }, { "scenario": "Must change password at next sign-in", "request": null, "httpStatus": null, "expected": "50055 / 50144 / 50173", "got": "50055", "matchedExpectation": true, "message": "AADSTS50055: The password is expired." }, { "scenario": "Correct password (security defaults / MFA / consent decide)", "request": null, "httpStatus": null, "expected": "success / 50076 / 50079 / 65001 / 50072", "got": "success", "matchedExpectation": true, "message": "" }, { "scenario": "Unknown client ID", "request": null, "httpStatus": null, "expected": "700016", "got": "700016", "matchedExpectation": true, "message": "AADSTS700016: Application with identifier '{app-id}' was not found in the directory '{tenant-id}'. This can" }, { "scenario": "Resource does not exist in tenant", "request": null, "httpStatus": null, "expected": "500011", "got": "500011", "matchedExpectation": true, "message": "AADSTS500011: The resource principal named https://does-not-exist.brambrinkmeier.com was not found in the tenant named {tenant-id}. Thi" }, { "scenario": "Tenant does not exist", "request": null, "httpStatus": null, "expected": "90002", "got": "90002", "matchedExpectation": true, "message": "AADSTS90002: Tenant '{tenant-id}' not found. Check to make sure you have the correct tenant ID and are signing into the correct cloud. " }, { "scenario": "Password parameter missing", "request": null, "httpStatus": null, "expected": "900144", "got": "900144", "matchedExpectation": true, "message": "AADSTS900144: The request body must contain the following parameter: 'password'." }, { "scenario": "Token request with a browser Origin header from a non-SPA client", "request": null, "httpStatus": null, "expected": "9002326", "got": "9002326", "matchedExpectation": true, "message": "AADSTS9002326: Cross-origin token redemption is permitted only for the 'Single-Page Application' client-type. Request origin: 'https://lab.brambrinkmeier.com'." }, { "scenario": "Malformed tenant identifier", "request": null, "httpStatus": null, "expected": "900023", "got": "900023", "matchedExpectation": true, "message": "AADSTS900023: Specified tenant identifier 'not_a_valid~tenant' is neither a valid DNS name, nor a valid external domain." }, { "scenario": "Password longer than 256 characters", "request": null, "httpStatus": null, "expected": "50052", "got": "50052", "matchedExpectation": true, "message": "AADSTS50052: The password entered exceeds the maximum length. Please reach out to your admin to reset the password." }, { "scenario": "Deleted user signs in", "request": null, "httpStatus": null, "expected": "500341 / 50034", "got": "success", "matchedExpectation": false, "message": "" }, { "scenario": "Device code that was never issued", "request": null, "httpStatus": null, "expected": "70020 / 70000 / 9002313", "got": "7000014", "matchedExpectation": false, "message": "AADSTS7000014: The provided value for the input parameter 'device_code' is not valid." }, { "scenario": "Device code requested on /consumers by a work-account app", "request": null, "httpStatus": null, "expected": "90133 / 9002331 / 700016", "got": "700016", "matchedExpectation": true, "message": "AADSTS700016: Application with identifier '{app-id}' was not found in the directory '{tenant-id}'. This can" }, { "scenario": "Both scope and resource sent", "request": null, "httpStatus": null, "expected": "9010010", "got": "9010010", "matchedExpectation": true, "message": "AADSTS9010010: The resource parameter provided in the request doesn't match with the requested scopes." }, { "scenario": "Confidential client sends no credential", "request": null, "httpStatus": null, "expected": "7000218", "got": "7000216", "matchedExpectation": false, "message": "AADSTS7000216: 'client_assertion', 'client_secret' or 'request' is required for the 'client_credentials' grant type." }, { "scenario": "Client assertion that is not a JWT", "request": null, "httpStatus": null, "expected": "9002313 / 50027 / 700027", "got": "50027", "matchedExpectation": true, "message": "AADSTS50027: JWT token is invalid or malformed." }, { "scenario": "Unknown client_assertion_type", "request": null, "httpStatus": null, "expected": "9002313 / 700027", "got": "90023", "matchedExpectation": false, "message": "AADSTS90023: Unexpected client assertion type." }, { "scenario": "Device code on /common by a single-tenant app", "request": null, "httpStatus": null, "expected": "90133 / 700016 / 50194", "got": "50059", "matchedExpectation": false, "message": "AADSTS50059: No tenant-identifying information found in either the request or implied by any provided credentials." }, { "scenario": "Device code on /organizations by a single-tenant app", "request": null, "httpStatus": null, "expected": "90133 / 700016 / 50194", "got": "50059", "matchedExpectation": false, "message": "AADSTS50059: No tenant-identifying information found in either the request or implied by any provided credentials." }, { "scenario": "Repeated wrong passwords (smart lockout)", "request": null, "httpStatus": null, "expected": "50053", "got": "50126", "matchedExpectation": false, "message": "AADSTS50126: Error validating credentials due to invalid username or password." }, { "scenario": "Token request over TLS 1.0", "request": null, "httpStatus": null, "expected": "1002016", "got": null, "matchedExpectation": false, "message": "no response: ECONNRESET" }, { "scenario": "Client assertion expired", "request": null, "httpStatus": null, "expected": "700024", "got": "700024", "matchedExpectation": true, "message": "AADSTS700024: Client assertion is not within its valid time range. Current time: 2026-10-30T22:30:55.4651851Z, assertion valid from 2026-10-30T22:14:55.0000000Z" }, { "scenario": "Federated credential: no credential configured at all", "request": null, "httpStatus": null, "expected": "70025", "got": "70025", "matchedExpectation": true, "message": "AADSTS70025: The client '{app-id}'(lab-fic-target-41136574530) has no configured federated identity credentials." }, { "scenario": "Federated credential matches", "request": null, "httpStatus": null, "expected": "success", "got": "700226", "matchedExpectation": false, "message": "AADSTS700226: Only MSI tokens may be used as Federated Identity Credentials for AAD issuer." }, { "scenario": "Federated credential: subject does not match", "request": null, "httpStatus": null, "expected": "700213 / 70021", "got": "700213", "matchedExpectation": true, "message": "AADSTS700213: No matching federated identity record found for presented assertion subject '{guid}'. Check your federated identity " }, { "scenario": "Federated credential: issuer does not match", "request": null, "httpStatus": null, "expected": "700211 / 70021", "got": "700211", "matchedExpectation": true, "message": "AADSTS700211: No matching federated identity record found for presented assertion issuer 'https://login.microsoftonline.com/{tenant-id}" }, { "scenario": "Federated credential: audience does not match", "request": null, "httpStatus": null, "expected": "700212 / 700213 / 70021", "got": "7002121", "matchedExpectation": false, "message": "AADSTS7002121: No matching federated identity record found for presented assertion audience '{audience-id}'. The Audience for the federat" }, { "scenario": "Federated credential: subject differs only by case", "request": null, "httpStatus": null, "expected": "7002138 / 700213", "got": "7002138", "matchedExpectation": true, "message": "AADSTS7002138: No matching federated identity record found for presented assertion subject '{guid}'. The subject matches with case" }, { "scenario": "Wrong client secret", "request": null, "httpStatus": null, "expected": "7000215", "got": "7000215", "matchedExpectation": true, "message": "AADSTS7000215: Invalid client secret provided. Ensure the secret being sent in the request is the client secret value, not the client secret ID, for a secret ad" }, { "scenario": "Confidential client does ROPC without a secret", "request": null, "httpStatus": null, "expected": "7000218", "got": "7000218", "matchedExpectation": true, "message": "AADSTS7000218: The request body must contain the following parameter: 'client_assertion' or 'client_secret'." }, { "scenario": "Correct client secret (control)", "request": null, "httpStatus": null, "expected": "success", "got": "success", "matchedExpectation": true, "message": "" }, { "scenario": "SPA-registered client redeems without an Origin header", "request": null, "httpStatus": null, "expected": "9002327", "got": "65001", "matchedExpectation": false, "message": "AADSTS65001: The user or administrator has not consented to use the application with ID '{app-id}' named 'lab-spa-41136574530'. Send" }, { "scenario": "Personal-accounts-only app on a tenant endpoint", "request": null, "httpStatus": null, "expected": "9002331", "got": "9002346", "matchedExpectation": false, "message": "AADSTS9002346: Application '{app-id}'(lab-msa-only-41136574530) is configured for use by Microsoft Account users only. Please use th" }, { "scenario": "App-based scenarios (round 5)", "request": null, "httpStatus": null, "expected": "several", "got": "error", "matchedExpectation": false, "message": "Graph PATCH /servicePrincipals/{guid}: HTTP 404 {\"error\":{\"code\":\"Request_ResourceNotFound\",\"message\":\"Resource '{audience-id}" }, { "scenario": "Deleted user signs in, about 12 minutes after deletion", "request": null, "httpStatus": null, "expected": "500341 / 50034", "got": "50034", "matchedExpectation": true, "message": "AADSTS50034: The user account {EUII Hidden} does not exist in the {tenant-id} directory. To sign into this application, the account mus" } ] }, { "id": "2026-10-30-round5a", "kind": "token-endpoint", "date": "2026-10-30", "run": "round 5 (first attempt)", "method": "token-endpoint requests against a lab tenant", "workflow": null, "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/68", "note": "App-based scenarios failed on a Graph replication delay; rerun followed.", "results": [ { "scenario": "User does not exist", "request": null, "httpStatus": null, "expected": "50034", "got": "50034", "matchedExpectation": true, "message": "AADSTS50034: The user account {EUII Hidden} does not exist in the {tenant-id} directory. To sign into this application, the account mus" }, { "scenario": "Wrong password", "request": null, "httpStatus": null, "expected": "50126", "got": "50126", "matchedExpectation": true, "message": "AADSTS50126: Error validating credentials due to invalid username or password." }, { "scenario": "Account disabled", "request": null, "httpStatus": null, "expected": "50057", "got": "50057", "matchedExpectation": true, "message": "AADSTS50057: The user account is disabled." }, { "scenario": "Must change password at next sign-in", "request": null, "httpStatus": null, "expected": "50055 / 50144 / 50173", "got": "50055", "matchedExpectation": true, "message": "AADSTS50055: The password is expired." }, { "scenario": "Correct password (security defaults / MFA / consent decide)", "request": null, "httpStatus": null, "expected": "success / 50076 / 50079 / 65001 / 50072", "got": "success", "matchedExpectation": true, "message": "" }, { "scenario": "Unknown client ID", "request": null, "httpStatus": null, "expected": "700016", "got": "700016", "matchedExpectation": true, "message": "AADSTS700016: Application with identifier '{app-id}' was not found in the directory '{tenant-id}'. This can" }, { "scenario": "Resource does not exist in tenant", "request": null, "httpStatus": null, "expected": "500011", "got": "500011", "matchedExpectation": true, "message": "AADSTS500011: The resource principal named https://does-not-exist.brambrinkmeier.com was not found in the tenant named {tenant-id}. Thi" }, { "scenario": "Tenant does not exist", "request": null, "httpStatus": null, "expected": "90002", "got": "90002", "matchedExpectation": true, "message": "AADSTS90002: Tenant '{tenant-id}' not found. Check to make sure you have the correct tenant ID and are signing into the correct cloud. " }, { "scenario": "Password parameter missing", "request": null, "httpStatus": null, "expected": "900144", "got": "900144", "matchedExpectation": true, "message": "AADSTS900144: The request body must contain the following parameter: 'password'." }, { "scenario": "Token request with a browser Origin header from a non-SPA client", "request": null, "httpStatus": null, "expected": "9002326", "got": "9002326", "matchedExpectation": true, "message": "AADSTS9002326: Cross-origin token redemption is permitted only for the 'Single-Page Application' client-type. Request origin: 'https://lab.brambrinkmeier.com'." }, { "scenario": "Malformed tenant identifier", "request": null, "httpStatus": null, "expected": "900023", "got": "900023", "matchedExpectation": true, "message": "AADSTS900023: Specified tenant identifier 'not_a_valid~tenant' is neither a valid DNS name, nor a valid external domain." }, { "scenario": "Password longer than 256 characters", "request": null, "httpStatus": null, "expected": "50052", "got": "50052", "matchedExpectation": true, "message": "AADSTS50052: The password entered exceeds the maximum length. Please reach out to your admin to reset the password." }, { "scenario": "Deleted user signs in", "request": null, "httpStatus": null, "expected": "500341 / 50034", "got": "success", "matchedExpectation": false, "message": "" }, { "scenario": "Device code that was never issued", "request": null, "httpStatus": null, "expected": "70020 / 70000 / 9002313", "got": "7000014", "matchedExpectation": false, "message": "AADSTS7000014: The provided value for the input parameter 'device_code' is not valid." }, { "scenario": "Device code requested on /consumers by a work-account app", "request": null, "httpStatus": null, "expected": "90133 / 9002331 / 700016", "got": "700016", "matchedExpectation": true, "message": "AADSTS700016: Application with identifier '{app-id}' was not found in the directory '{tenant-id}'. This can" }, { "scenario": "Both scope and resource sent", "request": null, "httpStatus": null, "expected": "9010010", "got": "9010010", "matchedExpectation": true, "message": "AADSTS9010010: The resource parameter provided in the request doesn't match with the requested scopes." }, { "scenario": "Confidential client sends no credential", "request": null, "httpStatus": null, "expected": "7000218", "got": "7000216", "matchedExpectation": false, "message": "AADSTS7000216: 'client_assertion', 'client_secret' or 'request' is required for the 'client_credentials' grant type." }, { "scenario": "Client assertion that is not a JWT", "request": null, "httpStatus": null, "expected": "9002313 / 50027 / 700027", "got": "50027", "matchedExpectation": true, "message": "AADSTS50027: JWT token is invalid or malformed." }, { "scenario": "Unknown client_assertion_type", "request": null, "httpStatus": null, "expected": "9002313 / 700027", "got": "90023", "matchedExpectation": false, "message": "AADSTS90023: Unexpected client assertion type." }, { "scenario": "Device code on /common by a single-tenant app", "request": null, "httpStatus": null, "expected": "90133 / 700016 / 50194", "got": "50059", "matchedExpectation": false, "message": "AADSTS50059: No tenant-identifying information found in either the request or implied by any provided credentials." }, { "scenario": "Device code on /organizations by a single-tenant app", "request": null, "httpStatus": null, "expected": "90133 / 700016 / 50194", "got": "50059", "matchedExpectation": false, "message": "AADSTS50059: No tenant-identifying information found in either the request or implied by any provided credentials." }, { "scenario": "Repeated wrong passwords (smart lockout)", "request": null, "httpStatus": null, "expected": "50053", "got": "50053", "matchedExpectation": true, "message": "AADSTS50053: The account is locked, you've tried to sign in too many times with an incorrect user ID or password." }, { "scenario": "Token request over TLS 1.0", "request": null, "httpStatus": null, "expected": "1002016", "got": null, "matchedExpectation": false, "message": "no response: ECONNRESET" }, { "scenario": "Client assertion expired", "request": null, "httpStatus": null, "expected": "700024", "got": "700024", "matchedExpectation": true, "message": "AADSTS700024: Client assertion is not within its valid time range. Current time: 2026-10-30T22:11:38.3450502Z, assertion valid from 2026-10-30T21:55:38.0000000Z" }, { "scenario": "App-based scenarios (round 5)", "request": null, "httpStatus": null, "expected": "several", "got": "error", "matchedExpectation": false, "message": "Graph POST /applications/{guid}/addPassword: HTTP 404 {\"error\":{\"code\":\"Request_ResourceNotFound\",\"message\":\"Resource '{audience-id}" }, { "scenario": "Deleted user signs in, about 12 minutes after deletion", "request": null, "httpStatus": null, "expected": "500341 / 50034", "got": "50034", "matchedExpectation": true, "message": "AADSTS50034: The user account {EUII Hidden} does not exist in the {tenant-id} directory. To sign into this application, the account mus" } ] }, { "id": "2026-10-30-round6", "kind": "token-endpoint", "date": "2026-10-30", "run": "round 6", "method": "token-endpoint requests against a lab tenant, using lab-created test apps", "workflow": ".github/workflows/lab-error-codes.yml", "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/70", "note": "message is the first line of error_description as recorded in the issue.", "results": [ { "scenario": "User does not exist", "request": null, "httpStatus": null, "expected": "50034", "got": "50034", "matchedExpectation": true, "message": "AADSTS50034: The user account {EUII Hidden} does not exist in the {tenant-id} directory. To sign into this application, the account mus" }, { "scenario": "Wrong password", "request": null, "httpStatus": null, "expected": "50126", "got": "50126", "matchedExpectation": true, "message": "AADSTS50126: Error validating credentials due to invalid username or password." }, { "scenario": "Account disabled", "request": null, "httpStatus": null, "expected": "50057", "got": "50057", "matchedExpectation": true, "message": "AADSTS50057: The user account is disabled." }, { "scenario": "Must change password at next sign-in", "request": null, "httpStatus": null, "expected": "50055 / 50144 / 50173", "got": "50055", "matchedExpectation": true, "message": "AADSTS50055: The password is expired." }, { "scenario": "Correct password (security defaults / MFA / consent decide)", "request": null, "httpStatus": null, "expected": "success / 50076 / 50079 / 65001 / 50072", "got": "success", "matchedExpectation": true, "message": "" }, { "scenario": "Unknown client ID", "request": null, "httpStatus": null, "expected": "700016", "got": "700016", "matchedExpectation": true, "message": "AADSTS700016: Application with identifier '{app-id}' was not found in the directory '{tenant-id}'. This can" }, { "scenario": "Resource does not exist in tenant", "request": null, "httpStatus": null, "expected": "500011", "got": "500011", "matchedExpectation": true, "message": "AADSTS500011: The resource principal named https://does-not-exist.brambrinkmeier.com was not found in the tenant named {tenant-id}. Thi" }, { "scenario": "Tenant does not exist", "request": null, "httpStatus": null, "expected": "90002", "got": "90002", "matchedExpectation": true, "message": "AADSTS90002: Tenant '{tenant-id}' not found. Check to make sure you have the correct tenant ID and are signing into the correct cloud. " }, { "scenario": "Password parameter missing", "request": null, "httpStatus": null, "expected": "900144", "got": "900144", "matchedExpectation": true, "message": "AADSTS900144: The request body must contain the following parameter: 'password'." }, { "scenario": "Token request with a browser Origin header from a non-SPA client", "request": null, "httpStatus": null, "expected": "9002326", "got": "9002326", "matchedExpectation": true, "message": "AADSTS9002326: Cross-origin token redemption is permitted only for the 'Single-Page Application' client-type. Request origin: 'https://lab.brambrinkmeier.com'." }, { "scenario": "Malformed tenant identifier", "request": null, "httpStatus": null, "expected": "900023", "got": "900023", "matchedExpectation": true, "message": "AADSTS900023: Specified tenant identifier 'not_a_valid~tenant' is neither a valid DNS name, nor a valid external domain." }, { "scenario": "Password longer than 256 characters", "request": null, "httpStatus": null, "expected": "50052", "got": "50052", "matchedExpectation": true, "message": "AADSTS50052: The password entered exceeds the maximum length. Please reach out to your admin to reset the password." }, { "scenario": "Deleted user signs in", "request": null, "httpStatus": null, "expected": "500341 / 50034", "got": "success", "matchedExpectation": false, "message": "" }, { "scenario": "Device code that was never issued", "request": null, "httpStatus": null, "expected": "70020 / 70000 / 9002313", "got": "7000014", "matchedExpectation": false, "message": "AADSTS7000014: The provided value for the input parameter 'device_code' is not valid." }, { "scenario": "Device code requested on /consumers by a work-account app", "request": null, "httpStatus": null, "expected": "90133 / 9002331 / 700016", "got": "700016", "matchedExpectation": true, "message": "AADSTS700016: Application with identifier '{app-id}' was not found in the directory '{tenant-id}'. This can" }, { "scenario": "Both scope and resource sent", "request": null, "httpStatus": null, "expected": "9010010", "got": "success", "matchedExpectation": false, "message": "" }, { "scenario": "Confidential client sends no credential", "request": null, "httpStatus": null, "expected": "7000218", "got": "7000216", "matchedExpectation": false, "message": "AADSTS7000216: 'client_assertion', 'client_secret' or 'request' is required for the 'client_credentials' grant type." }, { "scenario": "Client assertion that is not a JWT", "request": null, "httpStatus": null, "expected": "9002313 / 50027 / 700027", "got": "50027", "matchedExpectation": true, "message": "AADSTS50027: JWT token is invalid or malformed." }, { "scenario": "Unknown client_assertion_type", "request": null, "httpStatus": null, "expected": "9002313 / 700027", "got": "90023", "matchedExpectation": false, "message": "AADSTS90023: Unexpected client assertion type." }, { "scenario": "Device code on /common by a single-tenant app", "request": null, "httpStatus": null, "expected": "90133 / 700016 / 50194", "got": "50059", "matchedExpectation": false, "message": "AADSTS50059: No tenant-identifying information found in either the request or implied by any provided credentials." }, { "scenario": "Device code on /organizations by a single-tenant app", "request": null, "httpStatus": null, "expected": "90133 / 700016 / 50194", "got": "50059", "matchedExpectation": false, "message": "AADSTS50059: No tenant-identifying information found in either the request or implied by any provided credentials." }, { "scenario": "Repeated wrong passwords (smart lockout)", "request": null, "httpStatus": null, "expected": "50053", "got": "50053", "matchedExpectation": true, "message": "AADSTS50053: The account is locked, you've tried to sign in too many times with an incorrect user ID or password." }, { "scenario": "Token request over TLS 1.0", "request": null, "httpStatus": null, "expected": "1002016", "got": null, "matchedExpectation": false, "message": "no response: ECONNRESET" }, { "scenario": "Client assertion expired", "request": null, "httpStatus": null, "expected": "700024", "got": "700024", "matchedExpectation": true, "message": "AADSTS700024: Client assertion is not within its valid time range. Current time: 2026-10-30T23:01:02.2283272Z, assertion valid from 2026-10-30T22:45:02.0000000Z" }, { "scenario": "Federated credential: no credential configured at all", "request": null, "httpStatus": null, "expected": "70025", "got": "70025", "matchedExpectation": true, "message": "AADSTS70025: The client '{app-id}'(lab-fic-target-41139925607) has no configured federated identity credentials." }, { "scenario": "Federated credential matches", "request": null, "httpStatus": null, "expected": "success", "got": "700226", "matchedExpectation": false, "message": "AADSTS700226: Only MSI tokens may be used as Federated Identity Credentials for AAD issuer." }, { "scenario": "Federated credential: subject does not match", "request": null, "httpStatus": null, "expected": "700213 / 70021", "got": "700213", "matchedExpectation": true, "message": "AADSTS700213: No matching federated identity record found for presented assertion subject '{guid}'. Check your federated identity " }, { "scenario": "Federated credential: issuer does not match", "request": null, "httpStatus": null, "expected": "700211 / 70021", "got": "700211", "matchedExpectation": true, "message": "AADSTS700211: No matching federated identity record found for presented assertion issuer 'https://login.microsoftonline.com/{tenant-id}" }, { "scenario": "Federated credential: audience does not match", "request": null, "httpStatus": null, "expected": "700212 / 700213 / 70021", "got": "7002121", "matchedExpectation": false, "message": "AADSTS7002121: No matching federated identity record found for presented assertion audience '{audience-id}'. The Audience for the federat" }, { "scenario": "Federated credential: subject differs only by case", "request": null, "httpStatus": null, "expected": "7002138 / 700213", "got": "7002138", "matchedExpectation": true, "message": "AADSTS7002138: No matching federated identity record found for presented assertion subject '{guid}'. The subject matches with case" }, { "scenario": "Wrong client secret", "request": null, "httpStatus": null, "expected": "7000215", "got": "7000215", "matchedExpectation": true, "message": "AADSTS7000215: Invalid client secret provided. Ensure the secret being sent in the request is the client secret value, not the client secret ID, for a secret ad" }, { "scenario": "Confidential client does ROPC without a secret", "request": null, "httpStatus": null, "expected": "7000218", "got": "7000218", "matchedExpectation": true, "message": "AADSTS7000218: The request body must contain the following parameter: 'client_assertion' or 'client_secret'." }, { "scenario": "Correct client secret (control)", "request": null, "httpStatus": null, "expected": "success", "got": "success", "matchedExpectation": true, "message": "" }, { "scenario": "SPA-registered client redeems without an Origin header", "request": null, "httpStatus": null, "expected": "9002327 / 65001", "got": "65001", "matchedExpectation": true, "message": "AADSTS65001: The user or administrator has not consented to use the application with ID '{app-id}' named 'lab-spa-41139925607'. Send" }, { "scenario": "Personal-accounts-only app on a tenant endpoint", "request": null, "httpStatus": null, "expected": "9002331", "got": "9002346", "matchedExpectation": false, "message": "AADSTS9002346: Application '{app-id}'(lab-msa-only-41139925607) is configured for use by Microsoft Account users only. Please use th" }, { "scenario": "Application disabled for sign-in", "request": null, "httpStatus": null, "expected": "7000112", "got": "7000112", "matchedExpectation": true, "message": "AADSTS7000112: Application '{app-id}'(lab-disabled-sp-41139925607) is disabled." }, { "scenario": "App-based scenarios (round 5)", "request": null, "httpStatus": null, "expected": "several", "got": "error", "matchedExpectation": false, "message": "Graph PATCH /servicePrincipals/{guid}: HTTP 403 {\"error\":{\"code\":\"Authorization_RequestDenied\",\"message\":\"Insufficient privileges " }, { "scenario": "Deleted user signs in, about 12 minutes after deletion", "request": null, "httpStatus": null, "expected": "500341 / 50034", "got": "50034", "matchedExpectation": true, "message": "AADSTS50034: The user account {EUII Hidden} does not exist in the {tenant-id} directory. To sign into this application, the account mus" } ] }, { "id": "2026-10-30-round7", "kind": "token-endpoint", "date": "2026-10-30", "run": "round 7", "method": "token-endpoint requests against a lab tenant", "workflow": ".github/workflows/lab-error-codes.yml", "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/71", "note": "message is the first line of error_description as recorded in the issue.", "results": [ { "scenario": "User does not exist", "request": null, "httpStatus": null, "expected": "50034", "got": "50034", "matchedExpectation": true, "message": "AADSTS50034: The user account {EUII Hidden} does not exist in the {tenant-id} directory. To sign into this application, the account mus" }, { "scenario": "Wrong password", "request": null, "httpStatus": null, "expected": "50126", "got": "50126", "matchedExpectation": true, "message": "AADSTS50126: Error validating credentials due to invalid username or password." }, { "scenario": "Account disabled", "request": null, "httpStatus": null, "expected": "50057", "got": "50057", "matchedExpectation": true, "message": "AADSTS50057: The user account is disabled." }, { "scenario": "Must change password at next sign-in", "request": null, "httpStatus": null, "expected": "50055 / 50144 / 50173", "got": "50055", "matchedExpectation": true, "message": "AADSTS50055: The password is expired." }, { "scenario": "Correct password (security defaults / MFA / consent decide)", "request": null, "httpStatus": null, "expected": "success / 50076 / 50079 / 65001 / 50072", "got": "success", "matchedExpectation": true, "message": "" }, { "scenario": "Unknown client ID", "request": null, "httpStatus": null, "expected": "700016", "got": "700016", "matchedExpectation": true, "message": "AADSTS700016: Application with identifier '{app-id}' was not found in the directory '{tenant-id}'. This can" }, { "scenario": "Resource does not exist in tenant", "request": null, "httpStatus": null, "expected": "500011", "got": "500011", "matchedExpectation": true, "message": "AADSTS500011: The resource principal named https://does-not-exist.brambrinkmeier.com was not found in the tenant named {tenant-id}. Thi" }, { "scenario": "Tenant does not exist", "request": null, "httpStatus": null, "expected": "90002", "got": "90002", "matchedExpectation": true, "message": "AADSTS90002: Tenant '{tenant-id}' not found. Check to make sure you have the correct tenant ID and are signing into the correct cloud. " }, { "scenario": "Password parameter missing", "request": null, "httpStatus": null, "expected": "900144", "got": "900144", "matchedExpectation": true, "message": "AADSTS900144: The request body must contain the following parameter: 'password'." }, { "scenario": "Token request with a browser Origin header from a non-SPA client", "request": null, "httpStatus": null, "expected": "9002326", "got": "9002326", "matchedExpectation": true, "message": "AADSTS9002326: Cross-origin token redemption is permitted only for the 'Single-Page Application' client-type. Request origin: 'https://lab.brambrinkmeier.com'." }, { "scenario": "Malformed tenant identifier", "request": null, "httpStatus": null, "expected": "900023", "got": "900023", "matchedExpectation": true, "message": "AADSTS900023: Specified tenant identifier 'not_a_valid~tenant' is neither a valid DNS name, nor a valid external domain." }, { "scenario": "Password longer than 256 characters", "request": null, "httpStatus": null, "expected": "50052", "got": "50052", "matchedExpectation": true, "message": "AADSTS50052: The password entered exceeds the maximum length. Please reach out to your admin to reset the password." }, { "scenario": "Deleted user signs in", "request": null, "httpStatus": null, "expected": "500341 / 50034", "got": "success", "matchedExpectation": false, "message": "" }, { "scenario": "Device code that was never issued", "request": null, "httpStatus": null, "expected": "70020 / 70000 / 9002313", "got": "7000014", "matchedExpectation": false, "message": "AADSTS7000014: The provided value for the input parameter 'device_code' is not valid." }, { "scenario": "Device code requested on /consumers by a work-account app", "request": null, "httpStatus": null, "expected": "90133 / 9002331 / 700016", "got": "700016", "matchedExpectation": true, "message": "AADSTS700016: Application with identifier '{app-id}' was not found in the directory '{tenant-id}'. This can" }, { "scenario": "Both scope and resource sent", "request": null, "httpStatus": null, "expected": "9010010", "got": "success", "matchedExpectation": false, "message": "" }, { "scenario": "Confidential client sends no credential", "request": null, "httpStatus": null, "expected": "7000218", "got": "7000216", "matchedExpectation": false, "message": "AADSTS7000216: 'client_assertion', 'client_secret' or 'request' is required for the 'client_credentials' grant type." }, { "scenario": "Client assertion that is not a JWT", "request": null, "httpStatus": null, "expected": "9002313 / 50027 / 700027", "got": "50027", "matchedExpectation": true, "message": "AADSTS50027: JWT token is invalid or malformed." }, { "scenario": "Unknown client_assertion_type", "request": null, "httpStatus": null, "expected": "9002313 / 700027", "got": "90023", "matchedExpectation": false, "message": "AADSTS90023: Unexpected client assertion type." }, { "scenario": "Device code on /common by a single-tenant app", "request": null, "httpStatus": null, "expected": "90133 / 700016 / 50194", "got": "50059", "matchedExpectation": false, "message": "AADSTS50059: No tenant-identifying information found in either the request or implied by any provided credentials." }, { "scenario": "Device code on /organizations by a single-tenant app", "request": null, "httpStatus": null, "expected": "90133 / 700016 / 50194", "got": "50059", "matchedExpectation": false, "message": "AADSTS50059: No tenant-identifying information found in either the request or implied by any provided credentials." }, { "scenario": "Repeated wrong passwords (smart lockout)", "request": null, "httpStatus": null, "expected": "50053", "got": "50053", "matchedExpectation": true, "message": "AADSTS50053: The account is locked, you've tried to sign in too many times with an incorrect user ID or password." }, { "scenario": "Token request over TLS 1.0", "request": null, "httpStatus": null, "expected": "1002016", "got": null, "matchedExpectation": false, "message": "no response: ECONNRESET" }, { "scenario": "Client assertion expired", "request": null, "httpStatus": null, "expected": "700024", "got": "700024", "matchedExpectation": true, "message": "AADSTS700024: Client assertion is not within its valid time range. Current time: 2026-10-30T23:33:21.4471912Z, assertion valid from 2026-10-30T23:17:21.0000000Z" }, { "scenario": "Refresh token before revocation (control)", "request": null, "httpStatus": null, "expected": "success", "got": "success", "matchedExpectation": true, "message": "" }, { "scenario": "Refresh token after the admin revoked sessions", "request": null, "httpStatus": null, "expected": "50173 / 700082 / 50076", "got": "50173", "matchedExpectation": true, "message": "AADSTS50173: The provided grant has expired due to it being revoked, a fresh auth token is needed. The user might have changed or reset their password. The gran" }, { "scenario": "Federated credential: no credential configured at all", "request": null, "httpStatus": null, "expected": "70025", "got": "70025", "matchedExpectation": true, "message": "AADSTS70025: The client '{app-id}'(lab-fic-target-41143330001) has no configured federated identity credentials." }, { "scenario": "Federated credential matches", "request": null, "httpStatus": null, "expected": "success", "got": "700226", "matchedExpectation": false, "message": "AADSTS700226: Only MSI tokens may be used as Federated Identity Credentials for AAD issuer." }, { "scenario": "Federated credential: subject does not match", "request": null, "httpStatus": null, "expected": "700213 / 70021", "got": "700213", "matchedExpectation": true, "message": "AADSTS700213: No matching federated identity record found for presented assertion subject '{guid}'. Check your federated identity " }, { "scenario": "Federated credential: issuer does not match", "request": null, "httpStatus": null, "expected": "700211 / 70021", "got": "700211", "matchedExpectation": true, "message": "AADSTS700211: No matching federated identity record found for presented assertion issuer 'https://login.microsoftonline.com/{tenant-id}" }, { "scenario": "Federated credential: audience does not match", "request": null, "httpStatus": null, "expected": "700212 / 700213 / 70021", "got": "7002121", "matchedExpectation": false, "message": "AADSTS7002121: No matching federated identity record found for presented assertion audience '{audience-id}'. The Audience for the federat" }, { "scenario": "Federated credential: subject differs only by case", "request": null, "httpStatus": null, "expected": "7002138 / 700213", "got": "7002138", "matchedExpectation": true, "message": "AADSTS7002138: No matching federated identity record found for presented assertion subject '{guid}'. The subject matches with case" }, { "scenario": "Wrong client secret", "request": null, "httpStatus": null, "expected": "7000215", "got": "7000215", "matchedExpectation": true, "message": "AADSTS7000215: Invalid client secret provided. Ensure the secret being sent in the request is the client secret value, not the client secret ID, for a secret ad" }, { "scenario": "Confidential client does ROPC without a secret", "request": null, "httpStatus": null, "expected": "7000218", "got": "7000218", "matchedExpectation": true, "message": "AADSTS7000218: The request body must contain the following parameter: 'client_assertion' or 'client_secret'." }, { "scenario": "Correct client secret (control)", "request": null, "httpStatus": null, "expected": "success", "got": "success", "matchedExpectation": true, "message": "" }, { "scenario": "SPA-registered client redeems without an Origin header", "request": null, "httpStatus": null, "expected": "9002327 / 65001", "got": "65001", "matchedExpectation": true, "message": "AADSTS65001: The user or administrator has not consented to use the application with ID '{app-id}' named 'lab-spa-41143330001'. Send" }, { "scenario": "Personal-accounts-only app on a tenant endpoint", "request": null, "httpStatus": null, "expected": "9002331", "got": "9002346", "matchedExpectation": false, "message": "AADSTS9002346: Application '{app-id}'(lab-msa-only-41143330001) is configured for use by Microsoft Account users only. Please use th" }, { "scenario": "Application disabled for sign-in", "request": null, "httpStatus": null, "expected": "7000112", "got": "7000112", "matchedExpectation": true, "message": "AADSTS7000112: Application '{app-id}'(lab-disabled-sp-41143330001) is disabled." }, { "scenario": "App-only token for an API that requires assignment", "request": null, "httpStatus": null, "expected": "501051", "got": "501051", "matchedExpectation": true, "message": "AADSTS501051: Application '{app-id}'(lab-fic-holder-41143330001) is not assigned to a role for the application 'api://{guid}" }, { "scenario": "Deleted user signs in, about 12 minutes after deletion", "request": null, "httpStatus": null, "expected": "500341 / 50034", "got": "50034", "matchedExpectation": true, "message": "AADSTS50034: The user account {EUII Hidden} does not exist in the {tenant-id} directory. To sign into this application, the account mus" } ] }, { "id": "2026-10-30", "kind": "token-endpoint", "date": "2026-10-30", "run": null, "method": "ROPC and other token-endpoint requests against a lab tenant", "workflow": ".github/workflows/lab-error-codes.yml", "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/66", "note": "message is the first line of error_description as recorded in the issue, which cuts it at about 160 characters. The two browser entries were reproduced by hand: an unauthenticated GET to the authorize endpoint in a private browser window, error text read from the page.", "results": [ { "scenario": "User does not exist", "request": null, "httpStatus": null, "expected": "50034", "got": "50034", "matchedExpectation": true, "message": "AADSTS50034: The user account {EUII Hidden} does not exist in the {tenant-id} directory. To sign into this application, the account mus" }, { "scenario": "Wrong password", "request": null, "httpStatus": null, "expected": "50126", "got": "50126", "matchedExpectation": true, "message": "AADSTS50126: Error validating credentials due to invalid username or password." }, { "scenario": "Account disabled", "request": null, "httpStatus": null, "expected": "50057", "got": "50057", "matchedExpectation": true, "message": "AADSTS50057: The user account is disabled." }, { "scenario": "Must change password at next sign-in", "request": null, "httpStatus": null, "expected": "50055 / 50144 / 50173", "got": "50055", "matchedExpectation": true, "message": "AADSTS50055: The password is expired." }, { "scenario": "Correct password (security defaults / MFA / consent decide)", "request": null, "httpStatus": null, "expected": "success / 50076 / 50079 / 65001 / 50072", "got": "65001", "matchedExpectation": true, "message": "AADSTS65001: The user or administrator has not consented to use the application with ID '{app-id}' named 'lab-signin-client'. Send a" }, { "scenario": "Unknown client ID", "request": null, "httpStatus": null, "expected": "700016", "got": "700016", "matchedExpectation": true, "message": "AADSTS700016: Application with identifier '{app-id}' was not found in the directory '{tenant-id}'. This can" }, { "scenario": "Resource does not exist in tenant", "request": null, "httpStatus": null, "expected": "500011", "got": "500011", "matchedExpectation": true, "message": "AADSTS500011: The resource principal named https://does-not-exist.brambrinkmeier.com was not found in the tenant named {tenant-id}. Thi" }, { "scenario": "Tenant does not exist", "request": null, "httpStatus": null, "expected": "90002", "got": "90002", "matchedExpectation": true, "message": "AADSTS90002: Tenant '{tenant-id}' not found. Check to make sure you have the correct tenant ID and are signing into the correct cloud. " }, { "scenario": "Password parameter missing", "request": null, "httpStatus": null, "expected": "900144", "got": "900144", "matchedExpectation": true, "message": "AADSTS900144: The request body must contain the following parameter: 'password'." }, { "scenario": "Token request with a browser Origin header from a non-SPA client", "request": null, "httpStatus": null, "expected": "9002326", "got": "9002326", "matchedExpectation": true, "message": "AADSTS9002326: Cross-origin token redemption is permitted only for the 'Single-Page Application' client-type. Request origin: 'https://lab.brambrinkmeier.com'." }, { "scenario": "Malformed tenant identifier", "request": null, "httpStatus": null, "expected": "900023", "got": "900023", "matchedExpectation": true, "message": "AADSTS900023: Specified tenant identifier 'not_a_valid~tenant' is neither a valid DNS name, nor a valid external domain." }, { "scenario": "Password longer than 256 characters", "request": null, "httpStatus": null, "expected": "50052", "got": "50052", "matchedExpectation": true, "message": "AADSTS50052: The password entered exceeds the maximum length. Please reach out to your admin to reset the password." }, { "scenario": "Deleted user signs in", "request": null, "httpStatus": null, "expected": "500341 / 50034", "got": "65001", "matchedExpectation": false, "message": "AADSTS65001: The user or administrator has not consented to use the application with ID '{app-id}' named 'lab-signin-client'. Send a" }, { "scenario": "Device code that was never issued", "request": null, "httpStatus": null, "expected": "70020 / 70000 / 9002313", "got": "7000014", "matchedExpectation": false, "message": "AADSTS7000014: The provided value for the input parameter 'device_code' is not valid." }, { "scenario": "Device code requested on /consumers by a work-account app", "request": null, "httpStatus": null, "expected": "90133 / 9002331 / 700016", "got": "700016", "matchedExpectation": true, "message": "AADSTS700016: Application with identifier '{app-id}' was not found in the directory '{tenant-id}'. This can" }, { "scenario": "Both scope and resource sent", "request": null, "httpStatus": null, "expected": "9010010", "got": "9010010", "matchedExpectation": true, "message": "AADSTS9010010: The resource parameter provided in the request doesn't match with the requested scopes." }, { "scenario": "Client assertion expired", "request": null, "httpStatus": null, "expected": "700024", "got": "700024", "matchedExpectation": true, "message": "AADSTS700024: Client assertion is not within its valid time range. Current time: 2026-10-30T17:08:40.4130764Z, assertion valid from 2026-10-30T16:52:40.0000000Z" }, { "scenario": "Authorize request for an app with no reply address (browser)", "request": null, "httpStatus": null, "expected": "500113", "got": "500113", "matchedExpectation": true, "message": "AADSTS500113: No reply address is registered for the application.", "method": "Authorize request in a browser against a lab tenant" }, { "scenario": "Implicit access token requested, implicit grant not enabled (browser)", "request": null, "httpStatus": null, "expected": "700051", "got": "700051", "matchedExpectation": true, "message": "AADSTS700051: response_type 'token' is not enabled for the application.", "method": "Authorize request in a browser against a lab tenant" } ] }, { "id": "2026-10-31-graph-round1", "kind": "graph", "date": "2026-10-31", "run": "graph round 1", "method": "Microsoft Graph requests against a lab tenant", "workflow": null, "issue": null, "note": "Graph error-code lab run 2026-10-31: 10/17 scenarios returned the expected code. Objects created for this run were deleted afterwards. No tokens or secrets are recorded.", "results": [ { "scenario": "Read sign-in logs on a tenant without a premium licence", "request": "GET /auditLogs/signIns?$top=1", "httpStatus": 403, "expected": null, "got": "Authentication_MSGraphPermissionMissing", "matchedExpectation": false, "message": "The principal does not have any one of the required Microsoft Graph permissions: AuditLog.Read.All to call this API. For more information about Microsoft Graph permissions, please visit https://learn." }, { "scenario": "Read directory audit logs without AuditLog.Read.All", "request": "GET /auditLogs/directoryAudits?$top=1", "httpStatus": 403, "expected": null, "got": "Authentication_MSGraphPermissionMissing", "matchedExpectation": false, "message": "The principal does not have any one of the required Microsoft Graph permissions: AuditLog.Read.All to call this API. For more information about Microsoft Graph permissions, please visit https://learn." }, { "scenario": "Read Conditional Access policies without Policy.Read.All", "request": "GET /identity/conditionalAccess/policies", "httpStatus": 403, "expected": null, "got": "AccessDenied", "matchedExpectation": false, "message": "You cannot perform the requested operation, required scopes are missing in the token." }, { "scenario": "Write a group without Group.ReadWrite.All", "request": "POST /groups", "httpStatus": 403, "expected": null, "got": "Authorization_RequestDenied", "matchedExpectation": true, "message": "Insufficient privileges to complete the operation." }, { "scenario": "Token issued for a different audience", "request": "GET /users?$top=1", "httpStatus": 401, "expected": null, "got": "InvalidAuthenticationToken", "matchedExpectation": true, "message": "Access token validation failure. Invalid audience." }, { "scenario": "Token with a tampered signature", "request": "GET /users?$top=1", "httpStatus": 401, "expected": null, "got": "InvalidAuthenticationToken", "matchedExpectation": true, "message": "Signature is invalid." }, { "scenario": "No Authorization header at all", "request": "GET /users?$top=1", "httpStatus": 401, "expected": null, "got": "InvalidAuthenticationToken", "matchedExpectation": true, "message": "UnableToParseTokens" }, { "scenario": "Authorization header that is not a JWT", "request": "GET /users?$top=1", "httpStatus": 401, "expected": null, "got": "InvalidAuthenticationToken", "matchedExpectation": true, "message": "Protocol 'Bearer' failed to validate because The token could not be read." }, { "scenario": "Count users without the ConsistencyLevel header", "request": "GET /users?$count=true", "httpStatus": 200, "expected": null, "got": "success", "matchedExpectation": false, "message": "" }, { "scenario": "Count users with ConsistencyLevel: eventual (control)", "request": "GET /users?$count=true", "httpStatus": 200, "expected": null, "got": "success", "matchedExpectation": true, "message": "" }, { "scenario": "Filter on a property that does not exist", "request": "GET /users?$filter=notARealProperty eq 'x'", "httpStatus": 400, "expected": null, "got": "Request_UnsupportedQuery", "matchedExpectation": true, "message": "Property 'notARealProperty' does not exist as a declared property or extension property." }, { "scenario": "Object ID that is not a GUID", "request": "GET /users/not-a-guid", "httpStatus": 404, "expected": null, "got": "Request_ResourceNotFound", "matchedExpectation": true, "message": "Resource 'not-a-guid' does not exist or one of its queried reference-property objects are not present." }, { "scenario": "User object that does not exist", "request": "GET /users/{object-id}", "httpStatus": 404, "expected": null, "got": "Request_ResourceNotFound", "matchedExpectation": true, "message": "Resource '{audience-id}' does not exist or one of its queried reference-property objects are not present." }, { "scenario": "Path segment that does not exist", "request": "GET /users/does/not/exist", "httpStatus": 400, "expected": null, "got": "Request_BadRequest", "matchedExpectation": false, "message": "Unexpected segment DynamicPathSegment. Expected property/$value." }, { "scenario": "Create a user with no required fields", "request": "POST /users", "httpStatus": 400, "expected": null, "got": "Request_BadRequest", "matchedExpectation": true, "message": "A password must be specified to create a new user." }, { "scenario": "Create a second user with the same userPrincipalName", "request": "POST /users", "httpStatus": 400, "expected": null, "got": "Request_BadRequest", "matchedExpectation": false, "message": "Another object with the same value for property userPrincipalName already exists." }, { "scenario": "Burst of 120 identical reads", "request": "GET /users?$top=1 x120", "httpStatus": 200, "expected": null, "got": "no throttling seen", "matchedExpectation": false, "message": "all 120 requests succeeded" } ] }, { "id": "2026-10-31-graph-round2", "kind": "graph", "date": "2026-10-31", "run": "graph round 2", "method": "Microsoft Graph requests against a lab tenant", "workflow": null, "issue": null, "note": "Graph error-code lab run 2026-10-31: 23/34 scenarios returned the expected code. Objects created for this run were deleted afterwards. No tokens or secrets are recorded.", "results": [ { "scenario": "Read sign-in logs on a tenant without a premium licence", "request": "GET /auditLogs/signIns?$top=1", "httpStatus": 403, "expected": null, "got": "Authentication_MSGraphPermissionMissing", "matchedExpectation": false, "message": "The principal does not have any one of the required Microsoft Graph permissions: AuditLog.Read.All to call this API. For more information about Microsoft Graph permissions, please visit https://learn." }, { "scenario": "Read directory audit logs without AuditLog.Read.All", "request": "GET /auditLogs/directoryAudits?$top=1", "httpStatus": 403, "expected": null, "got": "Authentication_MSGraphPermissionMissing", "matchedExpectation": false, "message": "The principal does not have any one of the required Microsoft Graph permissions: AuditLog.Read.All to call this API. For more information about Microsoft Graph permissions, please visit https://learn." }, { "scenario": "Read Conditional Access policies without Policy.Read.All", "request": "GET /identity/conditionalAccess/policies", "httpStatus": 403, "expected": null, "got": "AccessDenied", "matchedExpectation": false, "message": "You cannot perform the requested operation, required scopes are missing in the token." }, { "scenario": "Write a group without Group.ReadWrite.All", "request": "POST /groups", "httpStatus": 403, "expected": null, "got": "Authorization_RequestDenied", "matchedExpectation": true, "message": "Insufficient privileges to complete the operation." }, { "scenario": "Token issued for a different audience", "request": "GET /users?$top=1", "httpStatus": 401, "expected": null, "got": "InvalidAuthenticationToken", "matchedExpectation": true, "message": "Access token validation failure. Invalid audience." }, { "scenario": "Token with a tampered signature", "request": "GET /users?$top=1", "httpStatus": 401, "expected": null, "got": "InvalidAuthenticationToken", "matchedExpectation": true, "message": "Signature is invalid." }, { "scenario": "No Authorization header at all", "request": "GET /users?$top=1", "httpStatus": 401, "expected": null, "got": "InvalidAuthenticationToken", "matchedExpectation": true, "message": "UnableToParseTokens" }, { "scenario": "Authorization header that is not a JWT", "request": "GET /users?$top=1", "httpStatus": 401, "expected": null, "got": "InvalidAuthenticationToken", "matchedExpectation": true, "message": "Protocol 'Bearer' failed to validate because The token could not be read." }, { "scenario": "Count users without the ConsistencyLevel header", "request": "GET /users?$count=true", "httpStatus": 200, "expected": null, "got": "success", "matchedExpectation": false, "message": "" }, { "scenario": "Count users with ConsistencyLevel: eventual (control)", "request": "GET /users?$count=true", "httpStatus": 200, "expected": null, "got": "success", "matchedExpectation": true, "message": "" }, { "scenario": "Filter on a property that does not exist", "request": "GET /users?$filter=notARealProperty eq 'x'", "httpStatus": 400, "expected": null, "got": "Request_UnsupportedQuery", "matchedExpectation": true, "message": "Property 'notARealProperty' does not exist as a declared property or extension property." }, { "scenario": "Object ID that is not a GUID", "request": "GET /users/not-a-guid", "httpStatus": 404, "expected": null, "got": "Request_ResourceNotFound", "matchedExpectation": true, "message": "Resource 'not-a-guid' does not exist or one of its queried reference-property objects are not present." }, { "scenario": "User object that does not exist", "request": "GET /users/{object-id}", "httpStatus": 404, "expected": null, "got": "Request_ResourceNotFound", "matchedExpectation": true, "message": "Resource '{audience-id}' does not exist or one of its queried reference-property objects are not present." }, { "scenario": "Path segment that does not exist", "request": "GET /users/does/not/exist", "httpStatus": 400, "expected": null, "got": "Request_BadRequest", "matchedExpectation": false, "message": "Unexpected segment DynamicPathSegment. Expected property/$value." }, { "scenario": "Create a user with no required fields", "request": "POST /users", "httpStatus": 400, "expected": null, "got": "Request_BadRequest", "matchedExpectation": true, "message": "A password must be specified to create a new user." }, { "scenario": "Create a second user with the same userPrincipalName", "request": "POST /users", "httpStatus": 400, "expected": null, "got": "Request_BadRequest", "matchedExpectation": false, "message": "Another object with the same value for property userPrincipalName already exists." }, { "scenario": "Count users without the ConsistencyLevel header", "request": "GET /users?$count=true", "httpStatus": 200, "expected": null, "got": "success", "matchedExpectation": true, "message": "" }, { "scenario": "Advanced-query filter (endsWith) without the ConsistencyLevel header", "request": "GET /users?$filter=endsWith(userPrincipalName,'onmicrosoft.com')", "httpStatus": 400, "expected": null, "got": "Request_UnsupportedQuery", "matchedExpectation": true, "message": "Operator 'endsWith' is not supported because the 'ConsistencyLevel:eventual' header is missing. Refer to https://aka.ms/graph-docs/advanced-queries for more information" }, { "scenario": "Advanced-query filter with ConsistencyLevel: eventual (control)", "request": "GET /users?$filter=endsWith(userPrincipalName,'onmicrosoft.com')&$count=true", "httpStatus": 200, "expected": null, "got": "success", "matchedExpectation": true, "message": "" }, { "scenario": "$search without the ConsistencyLevel header", "request": "GET /users?$search=\"displayName:lab\"", "httpStatus": 400, "expected": null, "got": "Request_UnsupportedQuery", "matchedExpectation": true, "message": "Request with $search query parameter only works through MSGraph with a special request header: 'ConsistencyLevel: eventual'" }, { "scenario": "$top above the page-size limit", "request": "GET /users?$top=5000", "httpStatus": 400, "expected": null, "got": "Request_UnsupportedQuery", "matchedExpectation": true, "message": "Invalid page size specified: '5000'. Must be between 1 and 999 inclusive." }, { "scenario": "$select naming a property that does not exist", "request": "GET /users?$select=notARealProperty", "httpStatus": 200, "expected": null, "got": "success", "matchedExpectation": false, "message": "" }, { "scenario": "Same missing object, applications instead of users", "request": "GET /applications/{guid}", "httpStatus": 404, "expected": null, "got": "Request_ResourceNotFound", "matchedExpectation": true, "message": "Resource '{audience-id}' does not exist or one of its queried reference-property objects are not present." }, { "scenario": "Same missing object, groups instead of users", "request": "GET /groups/{guid}", "httpStatus": 403, "expected": null, "got": "Authorization_RequestDenied", "matchedExpectation": false, "message": "Insufficient privileges to complete the operation." }, { "scenario": "Same missing object, servicePrincipals instead of users", "request": "GET /servicePrincipals/{guid}", "httpStatus": 404, "expected": null, "got": "Request_ResourceNotFound", "matchedExpectation": true, "message": "Resource '{audience-id}' does not exist or one of its queried reference-property objects are not present." }, { "scenario": "Same missing object, directoryRoles instead of users", "request": "GET /directoryRoles/{guid}", "httpStatus": 403, "expected": null, "got": "Authorization_RequestDenied", "matchedExpectation": false, "message": "Insufficient privileges to complete the operation." }, { "scenario": "A method the collection does not allow", "request": "DELETE /users", "httpStatus": 405, "expected": null, "got": "Request_BadRequest", "matchedExpectation": true, "message": "Specified HTTP method is not allowed for the request target." }, { "scenario": "Top-level path that is not a Graph resource", "request": "GET /notAResource", "httpStatus": 400, "expected": null, "got": "BadRequest", "matchedExpectation": true, "message": "Resource not found for the segment 'notAResource'." }, { "scenario": "Request body that is not valid JSON", "request": "POST /users", "httpStatus": 400, "expected": null, "got": "BadRequest", "matchedExpectation": true, "message": "Unable to read JSON request payload. Please ensure Content-Type header is set and payload is of valid JSON format." }, { "scenario": "Authorization header with a scheme other than Bearer", "request": "GET /users?$top=1", "httpStatus": 401, "expected": null, "got": "InvalidAuthenticationToken", "matchedExpectation": true, "message": "Protocol 'Bearer' failed to validate because The token could not be read." }, { "scenario": "Delete an object that is already deleted", "request": "DELETE /users/{object-id}", "httpStatus": 404, "expected": null, "got": "Request_ResourceNotFound", "matchedExpectation": true, "message": "Resource '{audience-id}' does not exist or one of its queried reference-property objects are not present." }, { "scenario": "Same sign-in log read on the beta endpoint", "request": "GET /auditLogs/signIns?$top=1", "httpStatus": 403, "expected": null, "got": "Authentication_MSGraphPermissionMissing", "matchedExpectation": true, "message": "The principal does not have any one of the required Microsoft Graph permissions: AuditLog.Read.All to call this API. For more information about Microsoft Graph permissions, please visit https://learn." }, { "scenario": "Did the uncounted request actually return @odata.count?", "request": "GET /users?$count=true", "httpStatus": 200, "expected": null, "got": "observation", "matchedExpectation": true, "message": "see countPresent" }, { "scenario": "Burst of up to 400 identical reads, 20 at a time", "request": "GET /users?$top=1 (concurrent)", "httpStatus": 200, "expected": null, "got": "no throttling seen", "matchedExpectation": false, "message": "all 400 requests succeeded" } ] }, { "id": "2026-10-31-graph-round3", "kind": "graph", "date": "2026-10-31", "run": "graph round 3", "method": "Microsoft Graph requests against a lab tenant", "workflow": null, "issue": null, "note": "Graph error-code lab run 2026-10-31: 35/48 scenarios returned the expected code. Objects created for this run were deleted afterwards. No tokens or secrets are recorded.", "results": [ { "scenario": "Read sign-in logs on a tenant without a premium licence", "request": "GET /auditLogs/signIns?$top=1", "httpStatus": 403, "expected": null, "got": "Authentication_MSGraphPermissionMissing", "matchedExpectation": false, "message": "The principal does not have any one of the required Microsoft Graph permissions: AuditLog.Read.All to call this API. For more information about Microsoft Graph permissions, please visit https://learn." }, { "scenario": "Read directory audit logs without AuditLog.Read.All", "request": "GET /auditLogs/directoryAudits?$top=1", "httpStatus": 403, "expected": null, "got": "Authentication_MSGraphPermissionMissing", "matchedExpectation": false, "message": "The principal does not have any one of the required Microsoft Graph permissions: AuditLog.Read.All to call this API. For more information about Microsoft Graph permissions, please visit https://learn." }, { "scenario": "Read Conditional Access policies without Policy.Read.All", "request": "GET /identity/conditionalAccess/policies", "httpStatus": 403, "expected": null, "got": "AccessDenied", "matchedExpectation": false, "message": "You cannot perform the requested operation, required scopes are missing in the token." }, { "scenario": "Write a group without Group.ReadWrite.All", "request": "POST /groups", "httpStatus": 403, "expected": null, "got": "Authorization_RequestDenied", "matchedExpectation": true, "message": "Insufficient privileges to complete the operation." }, { "scenario": "Token issued for a different audience", "request": "GET /users?$top=1", "httpStatus": 401, "expected": null, "got": "InvalidAuthenticationToken", "matchedExpectation": true, "message": "Access token validation failure. Invalid audience." }, { "scenario": "Token with a tampered signature", "request": "GET /users?$top=1", "httpStatus": 401, "expected": null, "got": "InvalidAuthenticationToken", "matchedExpectation": true, "message": "Signature is invalid." }, { "scenario": "No Authorization header at all", "request": "GET /users?$top=1", "httpStatus": 401, "expected": null, "got": "InvalidAuthenticationToken", "matchedExpectation": true, "message": "UnableToParseTokens" }, { "scenario": "Authorization header that is not a JWT", "request": "GET /users?$top=1", "httpStatus": 401, "expected": null, "got": "InvalidAuthenticationToken", "matchedExpectation": true, "message": "Protocol 'Bearer' failed to validate because The token could not be read." }, { "scenario": "Count users without the ConsistencyLevel header", "request": "GET /users?$count=true", "httpStatus": 200, "expected": null, "got": "success", "matchedExpectation": false, "message": "" }, { "scenario": "Count users with ConsistencyLevel: eventual (control)", "request": "GET /users?$count=true", "httpStatus": 200, "expected": null, "got": "success", "matchedExpectation": true, "message": "" }, { "scenario": "Filter on a property that does not exist", "request": "GET /users?$filter=notARealProperty eq 'x'", "httpStatus": 400, "expected": null, "got": "Request_UnsupportedQuery", "matchedExpectation": true, "message": "Property 'notARealProperty' does not exist as a declared property or extension property." }, { "scenario": "Object ID that is not a GUID", "request": "GET /users/not-a-guid", "httpStatus": 404, "expected": null, "got": "Request_ResourceNotFound", "matchedExpectation": true, "message": "Resource 'not-a-guid' does not exist or one of its queried reference-property objects are not present." }, { "scenario": "User object that does not exist", "request": "GET /users/{object-id}", "httpStatus": 404, "expected": null, "got": "Request_ResourceNotFound", "matchedExpectation": true, "message": "Resource '{audience-id}' does not exist or one of its queried reference-property objects are not present." }, { "scenario": "Path segment that does not exist", "request": "GET /users/does/not/exist", "httpStatus": 400, "expected": null, "got": "Request_BadRequest", "matchedExpectation": false, "message": "Unexpected segment DynamicPathSegment. Expected property/$value." }, { "scenario": "Create a user with no required fields", "request": "POST /users", "httpStatus": 400, "expected": null, "got": "Request_BadRequest", "matchedExpectation": true, "message": "A password must be specified to create a new user." }, { "scenario": "Create a second user with the same userPrincipalName", "request": "POST /users", "httpStatus": 400, "expected": null, "got": "Request_BadRequest", "matchedExpectation": false, "message": "Another object with the same value for property userPrincipalName already exists." }, { "scenario": "Count users without the ConsistencyLevel header", "request": "GET /users?$count=true", "httpStatus": 200, "expected": null, "got": "success", "matchedExpectation": true, "message": "" }, { "scenario": "Advanced-query filter (endsWith) without the ConsistencyLevel header", "request": "GET /users?$filter=endsWith(userPrincipalName,'onmicrosoft.com')", "httpStatus": 400, "expected": null, "got": "Request_UnsupportedQuery", "matchedExpectation": true, "message": "Operator 'endsWith' is not supported because the 'ConsistencyLevel:eventual' header is missing. Refer to https://aka.ms/graph-docs/advanced-queries for more information" }, { "scenario": "Advanced-query filter with ConsistencyLevel: eventual (control)", "request": "GET /users?$filter=endsWith(userPrincipalName,'onmicrosoft.com')&$count=true", "httpStatus": 200, "expected": null, "got": "success", "matchedExpectation": true, "message": "" }, { "scenario": "$search without the ConsistencyLevel header", "request": "GET /users?$search=\"displayName:lab\"", "httpStatus": 400, "expected": null, "got": "Request_UnsupportedQuery", "matchedExpectation": true, "message": "Request with $search query parameter only works through MSGraph with a special request header: 'ConsistencyLevel: eventual'" }, { "scenario": "$top above the page-size limit", "request": "GET /users?$top=5000", "httpStatus": 400, "expected": null, "got": "Request_UnsupportedQuery", "matchedExpectation": true, "message": "Invalid page size specified: '5000'. Must be between 1 and 999 inclusive." }, { "scenario": "$select naming a property that does not exist", "request": "GET /users?$select=notARealProperty", "httpStatus": 200, "expected": null, "got": "success", "matchedExpectation": false, "message": "" }, { "scenario": "Same missing object, applications instead of users", "request": "GET /applications/{guid}", "httpStatus": 404, "expected": null, "got": "Request_ResourceNotFound", "matchedExpectation": true, "message": "Resource '{audience-id}' does not exist or one of its queried reference-property objects are not present." }, { "scenario": "Same missing object, groups instead of users", "request": "GET /groups/{guid}", "httpStatus": 403, "expected": null, "got": "Authorization_RequestDenied", "matchedExpectation": false, "message": "Insufficient privileges to complete the operation." }, { "scenario": "Same missing object, servicePrincipals instead of users", "request": "GET /servicePrincipals/{guid}", "httpStatus": 404, "expected": null, "got": "Request_ResourceNotFound", "matchedExpectation": true, "message": "Resource '{audience-id}' does not exist or one of its queried reference-property objects are not present." }, { "scenario": "Same missing object, directoryRoles instead of users", "request": "GET /directoryRoles/{guid}", "httpStatus": 403, "expected": null, "got": "Authorization_RequestDenied", "matchedExpectation": false, "message": "Insufficient privileges to complete the operation." }, { "scenario": "A method the collection does not allow", "request": "DELETE /users", "httpStatus": 405, "expected": null, "got": "Request_BadRequest", "matchedExpectation": true, "message": "Specified HTTP method is not allowed for the request target." }, { "scenario": "Top-level path that is not a Graph resource", "request": "GET /notAResource", "httpStatus": 400, "expected": null, "got": "BadRequest", "matchedExpectation": true, "message": "Resource not found for the segment 'notAResource'." }, { "scenario": "Request body that is not valid JSON", "request": "POST /users", "httpStatus": 400, "expected": null, "got": "BadRequest", "matchedExpectation": true, "message": "Unable to read JSON request payload. Please ensure Content-Type header is set and payload is of valid JSON format." }, { "scenario": "Authorization header with a scheme other than Bearer", "request": "GET /users?$top=1", "httpStatus": 401, "expected": null, "got": "InvalidAuthenticationToken", "matchedExpectation": true, "message": "Protocol 'Bearer' failed to validate because The token could not be read." }, { "scenario": "Delete an object that is already deleted", "request": "DELETE /users/{object-id}", "httpStatus": 404, "expected": null, "got": "Request_ResourceNotFound", "matchedExpectation": true, "message": "Resource '{audience-id}' does not exist or one of its queried reference-property objects are not present." }, { "scenario": "Same sign-in log read on the beta endpoint", "request": "GET /auditLogs/signIns?$top=1", "httpStatus": 403, "expected": null, "got": "Authentication_MSGraphPermissionMissing", "matchedExpectation": true, "message": "The principal does not have any one of the required Microsoft Graph permissions: AuditLog.Read.All to call this API. For more information about Microsoft Graph permissions, please visit https://learn." }, { "scenario": "Did the uncounted request actually return @odata.count?", "request": "GET /users?$count=true", "httpStatus": 200, "expected": null, "got": "observation", "matchedExpectation": true, "message": "see countPresent" }, { "scenario": "GET /me with an app-only token", "request": "GET /me", "httpStatus": 400, "expected": null, "got": "BadRequest", "matchedExpectation": true, "message": "/me request is only valid with delegated authentication flow." }, { "scenario": "GET /me/messages with an app-only token", "request": "GET /me/messages", "httpStatus": 400, "expected": null, "got": "BadRequest", "matchedExpectation": true, "message": "/me request is only valid with delegated authentication flow." }, { "scenario": "$skip on a directory collection", "request": "GET /users?$skip=1", "httpStatus": 400, "expected": null, "got": "Request_BadRequest", "matchedExpectation": true, "message": "'$skip' is not supported by the service." }, { "scenario": "$top=0", "request": "GET /users?$top=0", "httpStatus": 400, "expected": null, "got": "Request_UnsupportedQuery", "matchedExpectation": true, "message": "Invalid page size specified: '0'. Must be between 1 and 999 inclusive." }, { "scenario": "$filter with the contains operator", "request": "GET /users?$filter=contains(displayName,'lab')", "httpStatus": 400, "expected": null, "got": "Request_UnsupportedQuery", "matchedExpectation": true, "message": "Filter operator 'Contains' is not supported." }, { "scenario": "$filter and $orderby together without ConsistencyLevel", "request": "GET /users?$filter=startsWith(displayName,'lab')&$orderby=displayName", "httpStatus": 400, "expected": null, "got": "Request_UnsupportedQuery", "matchedExpectation": true, "message": "Sorting not supported for current query." }, { "scenario": "$orderby on a property that does not support it", "request": "GET /users?$orderby=mailNickname", "httpStatus": 400, "expected": null, "got": "Request_UnsupportedQuery", "matchedExpectation": true, "message": "Unsupported sort property 'mailNickname' for 'User'." }, { "scenario": "$expand together with advanced query parameters", "request": "GET /users?$count=true&$expand=manager", "httpStatus": 200, "expected": null, "got": "success", "matchedExpectation": true, "message": "" }, { "scenario": "Create a user with a password the policy rejects", "request": "POST /users", "httpStatus": 400, "expected": null, "got": "Request_BadRequest", "matchedExpectation": true, "message": "The specified password does not comply with password complexity requirements. Please provide a different password." }, { "scenario": "Create a user whose userPrincipalName domain is not in the tenant", "request": "POST /users", "httpStatus": 400, "expected": null, "got": "Request_BadRequest", "matchedExpectation": true, "message": "The domain portion of the userPrincipalName property is invalid. You must use one of the verified domain names in your organization." }, { "scenario": "PATCH a read-only property (id)", "request": "PATCH /users/{object-id}", "httpStatus": 204, "expected": null, "got": "success", "matchedExpectation": false, "message": "" }, { "scenario": "PATCH a property that does not exist", "request": "PATCH /users/{object-id}", "httpStatus": 404, "expected": null, "got": "Request_ResourceNotFound", "matchedExpectation": false, "message": "Resource '' does not exist or one of its queried reference-property objects are not present." }, { "scenario": "PATCH a boolean property with a string", "request": "PATCH /users/{object-id}", "httpStatus": 400, "expected": null, "got": "Request_BadRequest", "matchedExpectation": true, "message": "Cannot convert the literal 'yes' to the expected type 'Edm.Boolean'." }, { "scenario": "A $batch with one good and two failing inner requests", "request": "POST /$batch", "httpStatus": 200, "expected": null, "got": "HTTP 200", "matchedExpectation": true, "message": "inner results: 1:200, 2:404 Request_ResourceNotFound, 3:403 AccessDenied" }, { "scenario": "Burst of up to 400 identical reads, 20 at a time", "request": "GET /users?$top=1 (concurrent)", "httpStatus": 200, "expected": null, "got": "no throttling seen", "matchedExpectation": false, "message": "all 400 requests succeeded" } ] }, { "id": "2026-10-31-graph-round4", "kind": "graph", "date": "2026-10-31", "run": "graph round 4", "method": "Microsoft Graph requests against a lab tenant", "workflow": null, "issue": null, "note": "Graph error-code lab run 2026-10-31: 43/57 scenarios returned the expected code. Application permissions in the token used for this run, read from its own `roles` claim: `Application.ReadWrite.OwnedBy`, `User.ReadWrite.All`. Audience `https://graph.microsoft.com`. Objects created for this run were deleted afterwards. No tokens or secrets are recorded.", "results": [ { "scenario": "Read sign-in logs on a tenant without a premium licence", "request": "GET /auditLogs/signIns?$top=1", "httpStatus": 403, "expected": null, "got": "Authentication_MSGraphPermissionMissing", "matchedExpectation": false, "message": "The principal does not have any one of the required Microsoft Graph permissions: AuditLog.Read.All to call this API. For more information about Microsoft Graph permissions, please visit https://learn.microsoft.com/graph/permissions-overview." }, { "scenario": "Read directory audit logs without AuditLog.Read.All", "request": "GET /auditLogs/directoryAudits?$top=1", "httpStatus": 403, "expected": null, "got": "Authentication_MSGraphPermissionMissing", "matchedExpectation": false, "message": "The principal does not have any one of the required Microsoft Graph permissions: AuditLog.Read.All to call this API. For more information about Microsoft Graph permissions, please visit https://learn.microsoft.com/graph/permissions-overview." }, { "scenario": "Read Conditional Access policies without Policy.Read.All", "request": "GET /identity/conditionalAccess/policies", "httpStatus": 403, "expected": null, "got": "AccessDenied", "matchedExpectation": false, "message": "You cannot perform the requested operation, required scopes are missing in the token." }, { "scenario": "Write a group without Group.ReadWrite.All", "request": "POST /groups", "httpStatus": 403, "expected": null, "got": "Authorization_RequestDenied", "matchedExpectation": true, "message": "Insufficient privileges to complete the operation." }, { "scenario": "Token issued for a different audience", "request": "GET /users?$top=1", "httpStatus": 401, "expected": null, "got": "InvalidAuthenticationToken", "matchedExpectation": true, "message": "Access token validation failure. Invalid audience." }, { "scenario": "Token with a tampered signature", "request": "GET /users?$top=1", "httpStatus": 401, "expected": null, "got": "InvalidAuthenticationToken", "matchedExpectation": true, "message": "Signature is invalid." }, { "scenario": "No Authorization header at all", "request": "GET /users?$top=1", "httpStatus": 401, "expected": null, "got": "InvalidAuthenticationToken", "matchedExpectation": true, "message": "Access token is empty." }, { "scenario": "Authorization header present but its bearer value empty", "request": "GET /users?$top=1", "httpStatus": 401, "expected": null, "got": "InvalidAuthenticationToken", "matchedExpectation": true, "message": "UnableToParseTokens" }, { "scenario": "Authorization header that is not a JWT", "request": "GET /users?$top=1", "httpStatus": 401, "expected": null, "got": "InvalidAuthenticationToken", "matchedExpectation": true, "message": "Protocol 'Bearer' failed to validate because The token could not be read." }, { "scenario": "Count users without the ConsistencyLevel header", "request": "GET /users?$count=true", "httpStatus": 200, "expected": null, "got": "success", "matchedExpectation": false, "message": "" }, { "scenario": "Count users with ConsistencyLevel: eventual (control)", "request": "GET /users?$count=true", "httpStatus": 200, "expected": null, "got": "success", "matchedExpectation": true, "message": "" }, { "scenario": "Filter on a property that does not exist", "request": "GET /users?$filter=notARealProperty eq 'x'", "httpStatus": 400, "expected": null, "got": "Request_UnsupportedQuery", "matchedExpectation": true, "message": "Property 'notARealProperty' does not exist as a declared property or extension property." }, { "scenario": "Object ID that is not a GUID", "request": "GET /users/not-a-guid", "httpStatus": 404, "expected": null, "got": "Request_ResourceNotFound", "matchedExpectation": true, "message": "Resource 'not-a-guid' does not exist or one of its queried reference-property objects are not present." }, { "scenario": "User object that does not exist", "request": "GET /users/{object-id}", "httpStatus": 404, "expected": null, "got": "Request_ResourceNotFound", "matchedExpectation": true, "message": "Resource '{audience-id}' does not exist or one of its queried reference-property objects are not present." }, { "scenario": "Path segment that does not exist", "request": "GET /users/does/not/exist", "httpStatus": 400, "expected": null, "got": "Request_BadRequest", "matchedExpectation": false, "message": "Unexpected segment DynamicPathSegment. Expected property/$value." }, { "scenario": "Create a user with no required fields", "request": "POST /users", "httpStatus": 400, "expected": null, "got": "Request_BadRequest", "matchedExpectation": true, "message": "A password must be specified to create a new user." }, { "scenario": "Create a second user with the same userPrincipalName", "request": "POST /users", "httpStatus": 400, "expected": null, "got": "Request_BadRequest", "matchedExpectation": false, "message": "Another object with the same value for property userPrincipalName already exists." }, { "scenario": "Count users without the ConsistencyLevel header", "request": "GET /users?$count=true", "httpStatus": 200, "expected": null, "got": "success", "matchedExpectation": true, "message": "" }, { "scenario": "Advanced-query filter (endsWith) without the ConsistencyLevel header", "request": "GET /users?$filter=endsWith(userPrincipalName,'onmicrosoft.com')", "httpStatus": 400, "expected": null, "got": "Request_UnsupportedQuery", "matchedExpectation": true, "message": "Operator 'endsWith' is not supported because the 'ConsistencyLevel:eventual' header is missing. Refer to https://aka.ms/graph-docs/advanced-queries for more information" }, { "scenario": "Advanced-query filter with ConsistencyLevel: eventual (control)", "request": "GET /users?$filter=endsWith(userPrincipalName,'onmicrosoft.com')&$count=true", "httpStatus": 200, "expected": null, "got": "success", "matchedExpectation": true, "message": "" }, { "scenario": "$search without the ConsistencyLevel header", "request": "GET /users?$search=\"displayName:lab\"", "httpStatus": 400, "expected": null, "got": "Request_UnsupportedQuery", "matchedExpectation": true, "message": "Request with $search query parameter only works through MSGraph with a special request header: 'ConsistencyLevel: eventual'" }, { "scenario": "$top above the page-size limit", "request": "GET /users?$top=5000", "httpStatus": 400, "expected": null, "got": "Request_UnsupportedQuery", "matchedExpectation": true, "message": "Invalid page size specified: '5000'. Must be between 1 and 999 inclusive." }, { "scenario": "$select naming a property that does not exist", "request": "GET /users?$select=notARealProperty", "httpStatus": 200, "expected": null, "got": "success", "matchedExpectation": false, "message": "" }, { "scenario": "Same missing object, applications instead of users", "request": "GET /applications/{guid}", "httpStatus": 404, "expected": null, "got": "Request_ResourceNotFound", "matchedExpectation": true, "message": "Resource '{audience-id}' does not exist or one of its queried reference-property objects are not present." }, { "scenario": "Same missing object, groups instead of users", "request": "GET /groups/{guid}", "httpStatus": 403, "expected": null, "got": "Authorization_RequestDenied", "matchedExpectation": false, "message": "Insufficient privileges to complete the operation." }, { "scenario": "Same missing object, servicePrincipals instead of users", "request": "GET /servicePrincipals/{guid}", "httpStatus": 404, "expected": null, "got": "Request_ResourceNotFound", "matchedExpectation": true, "message": "Resource '{audience-id}' does not exist or one of its queried reference-property objects are not present." }, { "scenario": "Same missing object, directoryRoles instead of users", "request": "GET /directoryRoles/{guid}", "httpStatus": 403, "expected": null, "got": "Authorization_RequestDenied", "matchedExpectation": false, "message": "Insufficient privileges to complete the operation." }, { "scenario": "Same missing object, devices instead of users", "request": "GET /devices/{guid}", "httpStatus": 403, "expected": null, "got": "Authorization_RequestDenied", "matchedExpectation": true, "message": "Insufficient privileges to complete the operation." }, { "scenario": "Same missing object, administrativeUnits instead of users", "request": "GET /directory/administrativeUnits/{guid}", "httpStatus": 403, "expected": null, "got": "Authorization_RequestDenied", "matchedExpectation": true, "message": "Insufficient privileges to complete the operation." }, { "scenario": "Same missing object, contacts instead of users", "request": "GET /contacts/{guid}", "httpStatus": 403, "expected": null, "got": "Authorization_RequestDenied", "matchedExpectation": true, "message": "Insufficient privileges to complete the operation." }, { "scenario": "Same missing object, organization instead of users", "request": "GET /organization/{guid}", "httpStatus": 400, "expected": null, "got": "Request_BadRequest", "matchedExpectation": false, "message": "Invalid tenant identifier; it must match that of the requested tenant." }, { "scenario": "Collection-level read, groups", "request": "GET /groups?$top=1", "httpStatus": 403, "expected": null, "got": "Authorization_RequestDenied", "matchedExpectation": true, "message": "Insufficient privileges to complete the operation." }, { "scenario": "Collection-level read, servicePrincipals", "request": "GET /servicePrincipals?$top=1", "httpStatus": 200, "expected": null, "got": "success", "matchedExpectation": true, "message": "" }, { "scenario": "Collection-level read, applications", "request": "GET /applications?$top=1", "httpStatus": 200, "expected": null, "got": "success", "matchedExpectation": true, "message": "" }, { "scenario": "Collection-level read, devices", "request": "GET /devices?$top=1", "httpStatus": 403, "expected": null, "got": "Authorization_RequestDenied", "matchedExpectation": true, "message": "Insufficient privileges to complete the operation." }, { "scenario": "A method the collection does not allow", "request": "DELETE /users", "httpStatus": 405, "expected": null, "got": "Request_BadRequest", "matchedExpectation": true, "message": "Specified HTTP method is not allowed for the request target." }, { "scenario": "Top-level path that is not a Graph resource", "request": "GET /notAResource", "httpStatus": 400, "expected": null, "got": "BadRequest", "matchedExpectation": true, "message": "Resource not found for the segment 'notAResource'." }, { "scenario": "Request body that is not valid JSON", "request": "POST /users", "httpStatus": 400, "expected": null, "got": "BadRequest", "matchedExpectation": true, "message": "Unable to read JSON request payload. Please ensure Content-Type header is set and payload is of valid JSON format." }, { "scenario": "Authorization header with a scheme other than Bearer", "request": "GET /users?$top=1", "httpStatus": 401, "expected": null, "got": "InvalidAuthenticationToken", "matchedExpectation": true, "message": "Protocol 'Bearer' failed to validate because The token could not be read." }, { "scenario": "Delete an object that is already deleted", "request": "DELETE /users/{object-id}", "httpStatus": 404, "expected": null, "got": "Request_ResourceNotFound", "matchedExpectation": true, "message": "Resource '{audience-id}' does not exist or one of its queried reference-property objects are not present." }, { "scenario": "Same sign-in log read on the beta endpoint", "request": "GET /auditLogs/signIns?$top=1", "httpStatus": 403, "expected": null, "got": "Authentication_MSGraphPermissionMissing", "matchedExpectation": true, "message": "The principal does not have any one of the required Microsoft Graph permissions: AuditLog.Read.All to call this API. For more information about Microsoft Graph permissions, please visit https://learn.microsoft.com/graph/permissions-overview." }, { "scenario": "Did the uncounted request actually return @odata.count?", "request": "GET /users?$count=true", "httpStatus": 200, "expected": null, "got": "observation", "matchedExpectation": true, "message": "see countPresent" }, { "scenario": "GET /me with an app-only token", "request": "GET /me", "httpStatus": 400, "expected": null, "got": "BadRequest", "matchedExpectation": true, "message": "/me request is only valid with delegated authentication flow." }, { "scenario": "GET /me/messages with an app-only token", "request": "GET /me/messages", "httpStatus": 400, "expected": null, "got": "BadRequest", "matchedExpectation": true, "message": "/me request is only valid with delegated authentication flow." }, { "scenario": "$skip on a directory collection", "request": "GET /users?$skip=1", "httpStatus": 400, "expected": null, "got": "Request_BadRequest", "matchedExpectation": true, "message": "'$skip' is not supported by the service." }, { "scenario": "$top=0", "request": "GET /users?$top=0", "httpStatus": 400, "expected": null, "got": "Request_UnsupportedQuery", "matchedExpectation": true, "message": "Invalid page size specified: '0'. Must be between 1 and 999 inclusive." }, { "scenario": "$filter with the contains operator", "request": "GET /users?$filter=contains(displayName,'lab')", "httpStatus": 400, "expected": null, "got": "Request_UnsupportedQuery", "matchedExpectation": true, "message": "Filter operator 'Contains' is not supported." }, { "scenario": "$filter and $orderby together without ConsistencyLevel", "request": "GET /users?$filter=startsWith(displayName,'lab')&$orderby=displayName", "httpStatus": 400, "expected": null, "got": "Request_UnsupportedQuery", "matchedExpectation": true, "message": "Sorting not supported for current query." }, { "scenario": "$orderby on a property that does not support it", "request": "GET /users?$orderby=mailNickname", "httpStatus": 400, "expected": null, "got": "Request_UnsupportedQuery", "matchedExpectation": true, "message": "Unsupported sort property 'mailNickname' for 'User'." }, { "scenario": "$expand together with advanced query parameters", "request": "GET /users?$count=true&$expand=manager", "httpStatus": 200, "expected": null, "got": "success", "matchedExpectation": true, "message": "" }, { "scenario": "Create a user with a password the policy rejects", "request": "POST /users", "httpStatus": 400, "expected": null, "got": "Request_BadRequest", "matchedExpectation": true, "message": "The specified password does not comply with password complexity requirements. Please provide a different password." }, { "scenario": "Create a user whose userPrincipalName domain is not in the tenant", "request": "POST /users", "httpStatus": 400, "expected": null, "got": "Request_BadRequest", "matchedExpectation": true, "message": "The domain portion of the userPrincipalName property is invalid. You must use one of the verified domain names in your organization." }, { "scenario": "PATCH a read-only property (id)", "request": "PATCH /users/{object-id}", "httpStatus": 204, "expected": null, "got": "success", "matchedExpectation": false, "message": "" }, { "scenario": "PATCH a property that does not exist", "request": "PATCH /users/{object-id}", "httpStatus": 404, "expected": null, "got": "Request_ResourceNotFound", "matchedExpectation": false, "message": "Resource '' does not exist or one of its queried reference-property objects are not present." }, { "scenario": "PATCH a boolean property with a string", "request": "PATCH /users/{object-id}", "httpStatus": 400, "expected": null, "got": "Request_BadRequest", "matchedExpectation": true, "message": "Cannot convert the literal 'yes' to the expected type 'Edm.Boolean'." }, { "scenario": "A $batch with one good and two failing inner requests", "request": "POST /$batch", "httpStatus": 200, "expected": null, "got": "HTTP 200", "matchedExpectation": true, "message": "inner results: 1:200, 2:404 Request_ResourceNotFound, 3:403 AccessDenied" }, { "scenario": "Burst of up to 400 identical reads, 20 at a time", "request": "GET /users?$top=1 (concurrent)", "httpStatus": 200, "expected": null, "got": "no throttling seen", "matchedExpectation": false, "message": "all 400 requests succeeded" } ] }, { "id": "2026-10-31-graph-round5", "kind": "graph", "date": "2026-10-31", "run": "graph round 5", "method": "Microsoft Graph requests against a lab tenant", "workflow": null, "issue": null, "note": "Graph error-code lab run 2026-10-31: 52/66 scenarios returned the expected code. Application permissions in the token used for this run, read from its own `roles` claim: `Application.ReadWrite.OwnedBy`, `User.ReadWrite.All`. Audience `https://graph.microsoft.com`. Objects created for this run were deleted afterwards. No tokens or secrets are recorded.", "results": [ { "scenario": "Read sign-in logs on a tenant without a premium licence", "request": "GET /auditLogs/signIns?$top=1", "httpStatus": 403, "expected": null, "got": "Authentication_MSGraphPermissionMissing", "matchedExpectation": false, "message": "The principal does not have any one of the required Microsoft Graph permissions: AuditLog.Read.All to call this API. For more information about Microsoft Graph permissions, please visit https://learn.microsoft.com/graph/permissions-overview." }, { "scenario": "Read directory audit logs without AuditLog.Read.All", "request": "GET /auditLogs/directoryAudits?$top=1", "httpStatus": 403, "expected": null, "got": "Authentication_MSGraphPermissionMissing", "matchedExpectation": false, "message": "The principal does not have any one of the required Microsoft Graph permissions: AuditLog.Read.All to call this API. For more information about Microsoft Graph permissions, please visit https://learn.microsoft.com/graph/permissions-overview." }, { "scenario": "Read Conditional Access policies without Policy.Read.All", "request": "GET /identity/conditionalAccess/policies", "httpStatus": 403, "expected": null, "got": "AccessDenied", "matchedExpectation": false, "message": "You cannot perform the requested operation, required scopes are missing in the token." }, { "scenario": "Write a group without Group.ReadWrite.All", "request": "POST /groups", "httpStatus": 403, "expected": null, "got": "Authorization_RequestDenied", "matchedExpectation": true, "message": "Insufficient privileges to complete the operation." }, { "scenario": "Token issued for a different audience", "request": "GET /users?$top=1", "httpStatus": 401, "expected": null, "got": "InvalidAuthenticationToken", "matchedExpectation": true, "message": "Access token validation failure. Invalid audience." }, { "scenario": "Token with a tampered signature", "request": "GET /users?$top=1", "httpStatus": 401, "expected": null, "got": "InvalidAuthenticationToken", "matchedExpectation": true, "message": "Signature is invalid." }, { "scenario": "No Authorization header at all", "request": "GET /users?$top=1", "httpStatus": 401, "expected": null, "got": "InvalidAuthenticationToken", "matchedExpectation": true, "message": "Access token is empty." }, { "scenario": "Authorization header present but its bearer value empty", "request": "GET /users?$top=1", "httpStatus": 401, "expected": null, "got": "InvalidAuthenticationToken", "matchedExpectation": true, "message": "UnableToParseTokens" }, { "scenario": "Authorization header that is not a JWT", "request": "GET /users?$top=1", "httpStatus": 401, "expected": null, "got": "InvalidAuthenticationToken", "matchedExpectation": true, "message": "Protocol 'Bearer' failed to validate because The token could not be read." }, { "scenario": "Count users without the ConsistencyLevel header", "request": "GET /users?$count=true", "httpStatus": 200, "expected": null, "got": "success", "matchedExpectation": false, "message": "" }, { "scenario": "Count users with ConsistencyLevel: eventual (control)", "request": "GET /users?$count=true", "httpStatus": 200, "expected": null, "got": "success", "matchedExpectation": true, "message": "" }, { "scenario": "Filter on a property that does not exist", "request": "GET /users?$filter=notARealProperty eq 'x'", "httpStatus": 400, "expected": null, "got": "Request_UnsupportedQuery", "matchedExpectation": true, "message": "Property 'notARealProperty' does not exist as a declared property or extension property." }, { "scenario": "Object ID that is not a GUID", "request": "GET /users/not-a-guid", "httpStatus": 404, "expected": null, "got": "Request_ResourceNotFound", "matchedExpectation": true, "message": "Resource 'not-a-guid' does not exist or one of its queried reference-property objects are not present." }, { "scenario": "User object that does not exist", "request": "GET /users/{object-id}", "httpStatus": 404, "expected": null, "got": "Request_ResourceNotFound", "matchedExpectation": true, "message": "Resource '{audience-id}' does not exist or one of its queried reference-property objects are not present." }, { "scenario": "Path segment that does not exist", "request": "GET /users/does/not/exist", "httpStatus": 400, "expected": null, "got": "Request_BadRequest", "matchedExpectation": false, "message": "Unexpected segment DynamicPathSegment. Expected property/$value." }, { "scenario": "Create a user with no required fields", "request": "POST /users", "httpStatus": 400, "expected": null, "got": "Request_BadRequest", "matchedExpectation": true, "message": "A password must be specified to create a new user." }, { "scenario": "Create a second user with the same userPrincipalName", "request": "POST /users", "httpStatus": 400, "expected": null, "got": "Request_BadRequest", "matchedExpectation": false, "message": "Another object with the same value for property userPrincipalName already exists." }, { "scenario": "Count users without the ConsistencyLevel header", "request": "GET /users?$count=true", "httpStatus": 200, "expected": null, "got": "success", "matchedExpectation": true, "message": "" }, { "scenario": "Advanced-query filter (endsWith) without the ConsistencyLevel header", "request": "GET /users?$filter=endsWith(userPrincipalName,'onmicrosoft.com')", "httpStatus": 400, "expected": null, "got": "Request_UnsupportedQuery", "matchedExpectation": true, "message": "Operator 'endsWith' is not supported because the 'ConsistencyLevel:eventual' header is missing. Refer to https://aka.ms/graph-docs/advanced-queries for more information" }, { "scenario": "Advanced-query filter with ConsistencyLevel: eventual (control)", "request": "GET /users?$filter=endsWith(userPrincipalName,'onmicrosoft.com')&$count=true", "httpStatus": 200, "expected": null, "got": "success", "matchedExpectation": true, "message": "" }, { "scenario": "$search without the ConsistencyLevel header", "request": "GET /users?$search=\"displayName:lab\"", "httpStatus": 400, "expected": null, "got": "Request_UnsupportedQuery", "matchedExpectation": true, "message": "Request with $search query parameter only works through MSGraph with a special request header: 'ConsistencyLevel: eventual'" }, { "scenario": "$top above the page-size limit", "request": "GET /users?$top=5000", "httpStatus": 400, "expected": null, "got": "Request_UnsupportedQuery", "matchedExpectation": true, "message": "Invalid page size specified: '5000'. Must be between 1 and 999 inclusive." }, { "scenario": "$select naming a property that does not exist", "request": "GET /users?$select=notARealProperty", "httpStatus": 200, "expected": null, "got": "success", "matchedExpectation": false, "message": "" }, { "scenario": "Same missing object, applications instead of users", "request": "GET /applications/{guid}", "httpStatus": 404, "expected": null, "got": "Request_ResourceNotFound", "matchedExpectation": true, "message": "Resource '{audience-id}' does not exist or one of its queried reference-property objects are not present." }, { "scenario": "Same missing object, groups instead of users", "request": "GET /groups/{guid}", "httpStatus": 403, "expected": null, "got": "Authorization_RequestDenied", "matchedExpectation": false, "message": "Insufficient privileges to complete the operation." }, { "scenario": "Same missing object, servicePrincipals instead of users", "request": "GET /servicePrincipals/{guid}", "httpStatus": 404, "expected": null, "got": "Request_ResourceNotFound", "matchedExpectation": true, "message": "Resource '{audience-id}' does not exist or one of its queried reference-property objects are not present." }, { "scenario": "Same missing object, directoryRoles instead of users", "request": "GET /directoryRoles/{guid}", "httpStatus": 403, "expected": null, "got": "Authorization_RequestDenied", "matchedExpectation": false, "message": "Insufficient privileges to complete the operation." }, { "scenario": "Same missing object, devices instead of users", "request": "GET /devices/{guid}", "httpStatus": 403, "expected": null, "got": "Authorization_RequestDenied", "matchedExpectation": true, "message": "Insufficient privileges to complete the operation." }, { "scenario": "Same missing object, administrativeUnits instead of users", "request": "GET /directory/administrativeUnits/{guid}", "httpStatus": 403, "expected": null, "got": "Authorization_RequestDenied", "matchedExpectation": true, "message": "Insufficient privileges to complete the operation." }, { "scenario": "Same missing object, contacts instead of users", "request": "GET /contacts/{guid}", "httpStatus": 403, "expected": null, "got": "Authorization_RequestDenied", "matchedExpectation": true, "message": "Insufficient privileges to complete the operation." }, { "scenario": "Same missing object, organization instead of users", "request": "GET /organization/{guid}", "httpStatus": 400, "expected": null, "got": "Request_BadRequest", "matchedExpectation": false, "message": "Invalid tenant identifier; it must match that of the requested tenant." }, { "scenario": "Collection-level read, groups", "request": "GET /groups?$top=1", "httpStatus": 403, "expected": null, "got": "Authorization_RequestDenied", "matchedExpectation": true, "message": "Insufficient privileges to complete the operation." }, { "scenario": "Collection-level read, servicePrincipals", "request": "GET /servicePrincipals?$top=1", "httpStatus": 200, "expected": null, "got": "success", "matchedExpectation": true, "message": "" }, { "scenario": "Collection-level read, applications", "request": "GET /applications?$top=1", "httpStatus": 200, "expected": null, "got": "success", "matchedExpectation": true, "message": "" }, { "scenario": "Collection-level read, devices", "request": "GET /devices?$top=1", "httpStatus": 403, "expected": null, "got": "Authorization_RequestDenied", "matchedExpectation": true, "message": "Insufficient privileges to complete the operation." }, { "scenario": "A method the collection does not allow", "request": "DELETE /users", "httpStatus": 405, "expected": null, "got": "Request_BadRequest", "matchedExpectation": true, "message": "Specified HTTP method is not allowed for the request target." }, { "scenario": "Top-level path that is not a Graph resource", "request": "GET /notAResource", "httpStatus": 400, "expected": null, "got": "BadRequest", "matchedExpectation": true, "message": "Resource not found for the segment 'notAResource'." }, { "scenario": "Request body that is not valid JSON", "request": "POST /users", "httpStatus": 400, "expected": null, "got": "BadRequest", "matchedExpectation": true, "message": "Unable to read JSON request payload. Please ensure Content-Type header is set and payload is of valid JSON format." }, { "scenario": "Authorization header with a scheme other than Bearer", "request": "GET /users?$top=1", "httpStatus": 401, "expected": null, "got": "InvalidAuthenticationToken", "matchedExpectation": true, "message": "Protocol 'Bearer' failed to validate because The token could not be read." }, { "scenario": "Delete an object that is already deleted", "request": "DELETE /users/{object-id}", "httpStatus": 404, "expected": null, "got": "Request_ResourceNotFound", "matchedExpectation": true, "message": "Resource '{audience-id}' does not exist or one of its queried reference-property objects are not present." }, { "scenario": "Same sign-in log read on the beta endpoint", "request": "GET /auditLogs/signIns?$top=1", "httpStatus": 403, "expected": null, "got": "Authentication_MSGraphPermissionMissing", "matchedExpectation": true, "message": "The principal does not have any one of the required Microsoft Graph permissions: AuditLog.Read.All to call this API. For more information about Microsoft Graph permissions, please visit https://learn.microsoft.com/graph/permissions-overview." }, { "scenario": "Did the uncounted request actually return @odata.count?", "request": "GET /users?$count=true", "httpStatus": 200, "expected": null, "got": "observation", "matchedExpectation": true, "message": "see countPresent" }, { "scenario": "GET /me with an app-only token", "request": "GET /me", "httpStatus": 400, "expected": null, "got": "BadRequest", "matchedExpectation": true, "message": "/me request is only valid with delegated authentication flow." }, { "scenario": "GET /me/messages with an app-only token", "request": "GET /me/messages", "httpStatus": 400, "expected": null, "got": "BadRequest", "matchedExpectation": true, "message": "/me request is only valid with delegated authentication flow." }, { "scenario": "$skip on a directory collection", "request": "GET /users?$skip=1", "httpStatus": 400, "expected": null, "got": "Request_BadRequest", "matchedExpectation": true, "message": "'$skip' is not supported by the service." }, { "scenario": "$top=0", "request": "GET /users?$top=0", "httpStatus": 400, "expected": null, "got": "Request_UnsupportedQuery", "matchedExpectation": true, "message": "Invalid page size specified: '0'. Must be between 1 and 999 inclusive." }, { "scenario": "$filter with the contains operator", "request": "GET /users?$filter=contains(displayName,'lab')", "httpStatus": 400, "expected": null, "got": "Request_UnsupportedQuery", "matchedExpectation": true, "message": "Filter operator 'Contains' is not supported." }, { "scenario": "$filter and $orderby together without ConsistencyLevel", "request": "GET /users?$filter=startsWith(displayName,'lab')&$orderby=displayName", "httpStatus": 400, "expected": null, "got": "Request_UnsupportedQuery", "matchedExpectation": true, "message": "Sorting not supported for current query." }, { "scenario": "$orderby on a property that does not support it", "request": "GET /users?$orderby=mailNickname", "httpStatus": 400, "expected": null, "got": "Request_UnsupportedQuery", "matchedExpectation": true, "message": "Unsupported sort property 'mailNickname' for 'User'." }, { "scenario": "$expand together with advanced query parameters", "request": "GET /users?$count=true&$expand=manager", "httpStatus": 200, "expected": null, "got": "success", "matchedExpectation": true, "message": "" }, { "scenario": "Create a user with a password the policy rejects", "request": "POST /users", "httpStatus": 400, "expected": null, "got": "Request_BadRequest", "matchedExpectation": true, "message": "The specified password does not comply with password complexity requirements. Please provide a different password." }, { "scenario": "Create a user whose userPrincipalName domain is not in the tenant", "request": "POST /users", "httpStatus": 400, "expected": null, "got": "Request_BadRequest", "matchedExpectation": true, "message": "The domain portion of the userPrincipalName property is invalid. You must use one of the verified domain names in your organization." }, { "scenario": "PATCH a read-only property (id)", "request": "PATCH /users/{object-id}", "httpStatus": 204, "expected": null, "got": "success", "matchedExpectation": false, "message": "" }, { "scenario": "PATCH a property that does not exist", "request": "PATCH /users/{object-id}", "httpStatus": 404, "expected": null, "got": "Request_ResourceNotFound", "matchedExpectation": false, "message": "Resource '' does not exist or one of its queried reference-property objects are not present." }, { "scenario": "PATCH a boolean property with a string", "request": "PATCH /users/{object-id}", "httpStatus": 400, "expected": null, "got": "Request_BadRequest", "matchedExpectation": true, "message": "Cannot convert the literal 'yes' to the expected type 'Edm.Boolean'." }, { "scenario": "A $batch with one good and two failing inner requests", "request": "POST /$batch", "httpStatus": 200, "expected": null, "got": "HTTP 200", "matchedExpectation": true, "message": "inner results: 1:200, 2:404 Request_ResourceNotFound, 3:403 AccessDenied" }, { "scenario": "Control: $count=true WITH ConsistencyLevel eventual", "request": "GET /users?$count=true", "httpStatus": 200, "expected": null, "got": "success", "matchedExpectation": true, "message": "" }, { "scenario": "Control: was @odata.count present WITH the header?", "request": "GET /users?$count=true + ConsistencyLevel", "httpStatus": 200, "expected": null, "got": "observation", "matchedExpectation": true, "message": "@odata.count present: true" }, { "scenario": "Fix for \"Sorting not supported\": add the header and $count", "request": "GET /users?$filter=startsWith(displayName,'lab')&$orderby=displayName&$count=true", "httpStatus": 200, "expected": null, "got": "success", "matchedExpectation": true, "message": "" }, { "scenario": "Fix for $search: add the header", "request": "GET /users?$search=\"displayName:lab\"", "httpStatus": 200, "expected": null, "got": "success", "matchedExpectation": true, "message": "" }, { "scenario": "Fix for contains: use startsWith instead", "request": "GET /users?$filter=startsWith(displayName,'lab')", "httpStatus": 200, "expected": null, "got": "success", "matchedExpectation": true, "message": "" }, { "scenario": "Fix for $skip: page without it", "request": "GET /users?$top=1", "httpStatus": 200, "expected": null, "got": "success", "matchedExpectation": true, "message": "" }, { "scenario": "Fix for /me with an app-only token: GET /users/", "request": "GET /users/{object-id}", "httpStatus": 200, "expected": null, "got": "success", "matchedExpectation": true, "message": "" }, { "scenario": "Does a PATCH of a read-only property actually change it?", "request": "PATCH /users/{object-id}", "httpStatus": 204, "expected": null, "got": "success", "matchedExpectation": true, "message": "" }, { "scenario": "After that PATCH, is the id unchanged?", "request": "GET /users/?$select=id", "httpStatus": 200, "expected": null, "got": "observation", "matchedExpectation": true, "message": "id unchanged: true" }, { "scenario": "Burst of up to 400 identical reads, 20 at a time", "request": "GET /users?$top=1 (concurrent)", "httpStatus": 200, "expected": null, "got": "no throttling seen", "matchedExpectation": false, "message": "all 400 requests succeeded" } ] }, { "id": "2026-10-31-round8", "kind": "token-endpoint", "date": "2026-10-31", "run": "round 8", "method": "token-endpoint and device-code requests against a lab tenant", "workflow": ".github/workflows/lab-error-codes.yml", "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/72", "note": "message is the first line of error_description as recorded in the issue.", "results": [ { "scenario": "User does not exist", "request": null, "httpStatus": null, "expected": "50034", "got": "50034", "matchedExpectation": true, "message": "AADSTS50034: The user account {EUII Hidden} does not exist in the {tenant-id} directory. To sign into this application, the account mus" }, { "scenario": "Wrong password", "request": null, "httpStatus": null, "expected": "50126", "got": "50126", "matchedExpectation": true, "message": "AADSTS50126: Error validating credentials due to invalid username or password." }, { "scenario": "Account disabled", "request": null, "httpStatus": null, "expected": "50057", "got": "50057", "matchedExpectation": true, "message": "AADSTS50057: The user account is disabled." }, { "scenario": "Must change password at next sign-in", "request": null, "httpStatus": null, "expected": "50055 / 50144 / 50173", "got": "50055", "matchedExpectation": true, "message": "AADSTS50055: The password is expired." }, { "scenario": "Correct password (security defaults / MFA / consent decide)", "request": null, "httpStatus": null, "expected": "success / 50076 / 50079 / 65001 / 50072", "got": "success", "matchedExpectation": true, "message": "" }, { "scenario": "Unknown client ID", "request": null, "httpStatus": null, "expected": "700016", "got": "700016", "matchedExpectation": true, "message": "AADSTS700016: Application with identifier '{app-id}' was not found in the directory '{tenant-id}'. This can" }, { "scenario": "Resource does not exist in tenant", "request": null, "httpStatus": null, "expected": "500011", "got": "500011", "matchedExpectation": true, "message": "AADSTS500011: The resource principal named https://does-not-exist.brambrinkmeier.com was not found in the tenant named {tenant-id}. Thi" }, { "scenario": "Tenant does not exist", "request": null, "httpStatus": null, "expected": "90002", "got": "90002", "matchedExpectation": true, "message": "AADSTS90002: Tenant '{tenant-id}' not found. Check to make sure you have the correct tenant ID and are signing into the correct cloud. " }, { "scenario": "Password parameter missing", "request": null, "httpStatus": null, "expected": "900144", "got": "900144", "matchedExpectation": true, "message": "AADSTS900144: The request body must contain the following parameter: 'password'." }, { "scenario": "Token request with a browser Origin header from a non-SPA client", "request": null, "httpStatus": null, "expected": "9002326", "got": "9002326", "matchedExpectation": true, "message": "AADSTS9002326: Cross-origin token redemption is permitted only for the 'Single-Page Application' client-type. Request origin: 'https://lab.brambrinkmeier.com'." }, { "scenario": "Malformed tenant identifier", "request": null, "httpStatus": null, "expected": "900023", "got": "900023", "matchedExpectation": true, "message": "AADSTS900023: Specified tenant identifier 'not_a_valid~tenant' is neither a valid DNS name, nor a valid external domain." }, { "scenario": "Password longer than 256 characters", "request": null, "httpStatus": null, "expected": "50052", "got": "50052", "matchedExpectation": true, "message": "AADSTS50052: The password entered exceeds the maximum length. Please reach out to your admin to reset the password." }, { "scenario": "Deleted user signs in", "request": null, "httpStatus": null, "expected": "500341 / 50034", "got": "success", "matchedExpectation": false, "message": "" }, { "scenario": "Device code that was never issued", "request": null, "httpStatus": null, "expected": "70020 / 70000 / 9002313", "got": "7000014", "matchedExpectation": false, "message": "AADSTS7000014: The provided value for the input parameter 'device_code' is not valid." }, { "scenario": "Device code requested on /consumers by a work-account app", "request": null, "httpStatus": null, "expected": "90133 / 9002331 / 700016", "got": "700016", "matchedExpectation": true, "message": "AADSTS700016: Application with identifier '{app-id}' was not found in the directory '{tenant-id}'. This can" }, { "scenario": "Both scope and resource sent", "request": null, "httpStatus": null, "expected": "9010010", "got": "9010010", "matchedExpectation": true, "message": "AADSTS9010010: The resource parameter provided in the request doesn't match with the requested scopes." }, { "scenario": "Confidential client sends no credential", "request": null, "httpStatus": null, "expected": "7000218", "got": "7000216", "matchedExpectation": false, "message": "AADSTS7000216: 'client_assertion', 'client_secret' or 'request' is required for the 'client_credentials' grant type." }, { "scenario": "Client assertion that is not a JWT", "request": null, "httpStatus": null, "expected": "9002313 / 50027 / 700027", "got": "50027", "matchedExpectation": true, "message": "AADSTS50027: JWT token is invalid or malformed." }, { "scenario": "Unknown client_assertion_type", "request": null, "httpStatus": null, "expected": "9002313 / 700027", "got": "90023", "matchedExpectation": false, "message": "AADSTS90023: Unexpected client assertion type." }, { "scenario": "Device code on /common by a single-tenant app", "request": null, "httpStatus": null, "expected": "90133 / 700016 / 50194", "got": "50059", "matchedExpectation": false, "message": "AADSTS50059: No tenant-identifying information found in either the request or implied by any provided credentials." }, { "scenario": "Device code on /organizations by a single-tenant app", "request": null, "httpStatus": null, "expected": "90133 / 700016 / 50194", "got": "50059", "matchedExpectation": false, "message": "AADSTS50059: No tenant-identifying information found in either the request or implied by any provided credentials." }, { "scenario": "Repeated wrong passwords (smart lockout)", "request": null, "httpStatus": null, "expected": "50053", "got": "50053", "matchedExpectation": true, "message": "AADSTS50053: The account is locked, you've tried to sign in too many times with an incorrect user ID or password." }, { "scenario": "Token request over TLS 1.0", "request": null, "httpStatus": null, "expected": "1002016", "got": null, "matchedExpectation": false, "message": "no response: ECONNRESET" }, { "scenario": "Client assertion expired", "request": null, "httpStatus": null, "expected": "700024", "got": "700024", "matchedExpectation": true, "message": "AADSTS700024: Client assertion is not within its valid time range. Current time: 2026-10-31T00:07:21.2184562Z, assertion valid from 2026-10-30T23:51:21.0000000Z" }, { "scenario": "Device code issued but nobody has signed in yet", "request": null, "httpStatus": null, "expected": "70016", "got": "70016", "matchedExpectation": true, "message": "AADSTS70016: OAuth 2.0 device flow error. Authorization is pending. Continue polling." }, { "scenario": "Device code polled too fast", "request": null, "httpStatus": null, "expected": "70016 / 70020", "got": "70016", "matchedExpectation": true, "message": "AADSTS70016: OAuth 2.0 device flow error. Authorization is pending. Continue polling." }, { "scenario": "Device code redeemed with a different client ID", "request": null, "httpStatus": null, "expected": "70016 / 7000215 / 70002", "got": "90023", "matchedExpectation": false, "message": "AADSTS90023: ClientId passed in the request doesn't match the one in cache" }, { "scenario": "Device code lifetime as issued", "request": null, "httpStatus": null, "expected": "recorded", "got": "recorded", "matchedExpectation": true, "message": "expires_in 900 seconds, polling interval 5 seconds" }, { "scenario": "Per-user MFA scenarios (round 8)", "request": null, "httpStatus": null, "expected": "50079 family", "got": "error", "matchedExpectation": false, "message": "Graph PATCH /users/{object-id}/authentication/requirements: HTTP 400 {\"error\":{\"code\":\"BadRequest\",\"message\":\"Resource not found for th" }, { "scenario": "Refresh token before revocation (control)", "request": null, "httpStatus": null, "expected": "success", "got": "success", "matchedExpectation": true, "message": "" }, { "scenario": "Refresh token after the admin revoked sessions", "request": null, "httpStatus": null, "expected": "50173 / 700082 / 50076", "got": "50173", "matchedExpectation": true, "message": "AADSTS50173: The provided grant has expired due to it being revoked, a fresh auth token is needed. The user might have changed or reset their password. The gran" }, { "scenario": "Federated credential: no credential configured at all", "request": null, "httpStatus": null, "expected": "70025", "got": "70025", "matchedExpectation": true, "message": "AADSTS70025: The client '{app-id}'(lab-fic-target-41146039117) has no configured federated identity credentials." }, { "scenario": "Federated credential matches", "request": null, "httpStatus": null, "expected": "success", "got": "700226", "matchedExpectation": false, "message": "AADSTS700226: Only MSI tokens may be used as Federated Identity Credentials for AAD issuer." }, { "scenario": "Federated credential: subject does not match", "request": null, "httpStatus": null, "expected": "700213 / 70021", "got": "700213", "matchedExpectation": true, "message": "AADSTS700213: No matching federated identity record found for presented assertion subject '{guid}'. Check your federated identity " }, { "scenario": "Federated credential: issuer does not match", "request": null, "httpStatus": null, "expected": "700211 / 70021", "got": "700211", "matchedExpectation": true, "message": "AADSTS700211: No matching federated identity record found for presented assertion issuer 'https://login.microsoftonline.com/{tenant-id}" }, { "scenario": "Federated credential: audience does not match", "request": null, "httpStatus": null, "expected": "700212 / 700213 / 70021", "got": "7002121", "matchedExpectation": false, "message": "AADSTS7002121: No matching federated identity record found for presented assertion audience '{audience-id}'. The Audience for the federat" }, { "scenario": "Federated credential: subject differs only by case", "request": null, "httpStatus": null, "expected": "7002138 / 700213", "got": "7002138", "matchedExpectation": true, "message": "AADSTS7002138: No matching federated identity record found for presented assertion subject '{guid}'. The subject matches with case" }, { "scenario": "Wrong client secret", "request": null, "httpStatus": null, "expected": "7000215", "got": "7000215", "matchedExpectation": true, "message": "AADSTS7000215: Invalid client secret provided. Ensure the secret being sent in the request is the client secret value, not the client secret ID, for a secret ad" }, { "scenario": "Confidential client does ROPC without a secret", "request": null, "httpStatus": null, "expected": "7000218", "got": "7000218", "matchedExpectation": true, "message": "AADSTS7000218: The request body must contain the following parameter: 'client_assertion' or 'client_secret'." }, { "scenario": "Correct client secret (control)", "request": null, "httpStatus": null, "expected": "success", "got": "success", "matchedExpectation": true, "message": "" }, { "scenario": "SPA-registered client redeems without an Origin header", "request": null, "httpStatus": null, "expected": "9002327 / 65001", "got": "65001", "matchedExpectation": true, "message": "AADSTS65001: The user or administrator has not consented to use the application with ID '{app-id}' named 'lab-spa-41146039117'. Send" }, { "scenario": "Personal-accounts-only app on a tenant endpoint", "request": null, "httpStatus": null, "expected": "9002331", "got": "9002346", "matchedExpectation": false, "message": "AADSTS9002346: Application '{app-id}'(lab-msa-only-41146039117) is configured for use by Microsoft Account users only. Please use th" }, { "scenario": "Application disabled for sign-in", "request": null, "httpStatus": null, "expected": "7000112", "got": "7000112", "matchedExpectation": true, "message": "AADSTS7000112: Application '{app-id}'(lab-disabled-sp-41146039117) is disabled." }, { "scenario": "App-only token for an API that requires assignment", "request": null, "httpStatus": null, "expected": "501051", "got": "501051", "matchedExpectation": true, "message": "AADSTS501051: Application '{app-id}'(lab-fic-holder-41146039117) is not assigned to a role for the application 'api://{guid}" }, { "scenario": "Deleted user signs in, about 12 minutes after deletion", "request": null, "httpStatus": null, "expected": "500341 / 50034", "got": "50034", "matchedExpectation": true, "message": "AADSTS50034: The user account {EUII Hidden} does not exist in the {tenant-id} directory. To sign into this application, the account mus" } ] }, { "id": "2026-10-31-round9", "kind": "token-endpoint", "date": "2026-10-31", "run": "round 9", "method": "token-endpoint and device-code requests against a lab tenant", "workflow": null, "issue": "https://github.com/GrantZero604/Brambrinkmeier.com/issues/73", "note": "The per-user MFA scenario failed and was then removed; see the script comment.", "results": [ { "scenario": "User does not exist", "request": null, "httpStatus": null, "expected": "50034", "got": "50034", "matchedExpectation": true, "message": "AADSTS50034: The user account {EUII Hidden} does not exist in the {tenant-id} directory. To sign into this application, the account mus" }, { "scenario": "Wrong password", "request": null, "httpStatus": null, "expected": "50126", "got": "50126", "matchedExpectation": true, "message": "AADSTS50126: Error validating credentials due to invalid username or password." }, { "scenario": "Account disabled", "request": null, "httpStatus": null, "expected": "50057", "got": "50057", "matchedExpectation": true, "message": "AADSTS50057: The user account is disabled." }, { "scenario": "Must change password at next sign-in", "request": null, "httpStatus": null, "expected": "50055 / 50144 / 50173", "got": "50055", "matchedExpectation": true, "message": "AADSTS50055: The password is expired." }, { "scenario": "Correct password (security defaults / MFA / consent decide)", "request": null, "httpStatus": null, "expected": "success / 50076 / 50079 / 65001 / 50072", "got": "success", "matchedExpectation": true, "message": "" }, { "scenario": "Unknown client ID", "request": null, "httpStatus": null, "expected": "700016", "got": "700016", "matchedExpectation": true, "message": "AADSTS700016: Application with identifier '{app-id}' was not found in the directory '{tenant-id}'. This can" }, { "scenario": "Resource does not exist in tenant", "request": null, "httpStatus": null, "expected": "500011", "got": "500011", "matchedExpectation": true, "message": "AADSTS500011: The resource principal named https://does-not-exist.brambrinkmeier.com was not found in the tenant named {tenant-id}. Thi" }, { "scenario": "Tenant does not exist", "request": null, "httpStatus": null, "expected": "90002", "got": "90002", "matchedExpectation": true, "message": "AADSTS90002: Tenant '{tenant-id}' not found. Check to make sure you have the correct tenant ID and are signing into the correct cloud. " }, { "scenario": "Password parameter missing", "request": null, "httpStatus": null, "expected": "900144", "got": "900144", "matchedExpectation": true, "message": "AADSTS900144: The request body must contain the following parameter: 'password'." }, { "scenario": "Token request with a browser Origin header from a non-SPA client", "request": null, "httpStatus": null, "expected": "9002326", "got": "9002326", "matchedExpectation": true, "message": "AADSTS9002326: Cross-origin token redemption is permitted only for the 'Single-Page Application' client-type. Request origin: 'https://lab.brambrinkmeier.com'." }, { "scenario": "Malformed tenant identifier", "request": null, "httpStatus": null, "expected": "900023", "got": "900023", "matchedExpectation": true, "message": "AADSTS900023: Specified tenant identifier 'not_a_valid~tenant' is neither a valid DNS name, nor a valid external domain." }, { "scenario": "Password longer than 256 characters", "request": null, "httpStatus": null, "expected": "50052", "got": "50052", "matchedExpectation": true, "message": "AADSTS50052: The password entered exceeds the maximum length. Please reach out to your admin to reset the password." }, { "scenario": "Deleted user signs in", "request": null, "httpStatus": null, "expected": "500341 / 50034", "got": "success", "matchedExpectation": false, "message": "" }, { "scenario": "Device code that was never issued", "request": null, "httpStatus": null, "expected": "70020 / 70000 / 9002313", "got": "7000014", "matchedExpectation": false, "message": "AADSTS7000014: The provided value for the input parameter 'device_code' is not valid." }, { "scenario": "Device code requested on /consumers by a work-account app", "request": null, "httpStatus": null, "expected": "90133 / 9002331 / 700016", "got": "700016", "matchedExpectation": true, "message": "AADSTS700016: Application with identifier '{app-id}' was not found in the directory '{tenant-id}'. This can" }, { "scenario": "Both scope and resource sent", "request": null, "httpStatus": null, "expected": "9010010", "got": "success", "matchedExpectation": false, "message": "" }, { "scenario": "Confidential client sends no credential", "request": null, "httpStatus": null, "expected": "7000218", "got": "7000216", "matchedExpectation": false, "message": "AADSTS7000216: 'client_assertion', 'client_secret' or 'request' is required for the 'client_credentials' grant type." }, { "scenario": "Client assertion that is not a JWT", "request": null, "httpStatus": null, "expected": "9002313 / 50027 / 700027", "got": "50027", "matchedExpectation": true, "message": "AADSTS50027: JWT token is invalid or malformed." }, { "scenario": "Unknown client_assertion_type", "request": null, "httpStatus": null, "expected": "9002313 / 700027", "got": "90023", "matchedExpectation": false, "message": "AADSTS90023: Unexpected client assertion type." }, { "scenario": "Device code on /common by a single-tenant app", "request": null, "httpStatus": null, "expected": "90133 / 700016 / 50194", "got": "50059", "matchedExpectation": false, "message": "AADSTS50059: No tenant-identifying information found in either the request or implied by any provided credentials." }, { "scenario": "Device code on /organizations by a single-tenant app", "request": null, "httpStatus": null, "expected": "90133 / 700016 / 50194", "got": "50059", "matchedExpectation": false, "message": "AADSTS50059: No tenant-identifying information found in either the request or implied by any provided credentials." }, { "scenario": "Token request over TLS 1.0", "request": null, "httpStatus": null, "expected": "1002016", "got": null, "matchedExpectation": false, "message": "no response: ECONNRESET" }, { "scenario": "Device code issued but nobody has signed in yet", "request": null, "httpStatus": null, "expected": "70016", "got": "70016", "matchedExpectation": true, "message": "AADSTS70016: OAuth 2.0 device flow error. Authorization is pending. Continue polling." }, { "scenario": "Device code polled too fast", "request": null, "httpStatus": null, "expected": "70016 / 70020", "got": "70016", "matchedExpectation": true, "message": "AADSTS70016: OAuth 2.0 device flow error. Authorization is pending. Continue polling." }, { "scenario": "Device code redeemed with a different client ID", "request": null, "httpStatus": null, "expected": "70016 / 7000215 / 70002", "got": "90023", "matchedExpectation": false, "message": "AADSTS90023: ClientId passed in the request doesn't match the one in cache" }, { "scenario": "Device code lifetime as issued", "request": null, "httpStatus": null, "expected": "recorded", "got": "recorded", "matchedExpectation": true, "message": "expires_in 900 seconds, polling interval 5 seconds" }, { "scenario": "Per-user MFA scenarios (round 8)", "request": null, "httpStatus": null, "expected": "50079 family", "got": "error", "matchedExpectation": false, "message": "Graph PATCH /users/{object-id}/authentication/requirements: HTTP 400 {\"error\":{\"code\":\"BadRequest\",\"message\":\"Resource not found for th" }, { "scenario": "Refresh token before revocation (control)", "request": null, "httpStatus": null, "expected": "success", "got": "success", "matchedExpectation": true, "message": "" }, { "scenario": "Refresh token after the admin revoked sessions", "request": null, "httpStatus": null, "expected": "50173 / 700082 / 50076", "got": "50173", "matchedExpectation": true, "message": "AADSTS50173: The provided grant has expired due to it being revoked, a fresh auth token is needed. The user might have changed or reset their password. The gran" }, { "scenario": "Federated credential: no credential configured at all", "request": null, "httpStatus": null, "expected": "70025", "got": "70025", "matchedExpectation": true, "message": "AADSTS70025: The client '{app-id}'(lab-fic-target-41150019626) has no configured federated identity credentials." }, { "scenario": "Federated credential matches", "request": null, "httpStatus": null, "expected": "success", "got": "700226", "matchedExpectation": false, "message": "AADSTS700226: Only MSI tokens may be used as Federated Identity Credentials for AAD issuer." }, { "scenario": "Federated credential: subject does not match", "request": null, "httpStatus": null, "expected": "700213 / 70021", "got": "700213", "matchedExpectation": true, "message": "AADSTS700213: No matching federated identity record found for presented assertion subject '{guid}'. Check your federated identity " }, { "scenario": "Federated credential: issuer does not match", "request": null, "httpStatus": null, "expected": "700211 / 70021", "got": "700211", "matchedExpectation": true, "message": "AADSTS700211: No matching federated identity record found for presented assertion issuer 'https://login.microsoftonline.com/{tenant-id}" }, { "scenario": "Federated credential: audience does not match", "request": null, "httpStatus": null, "expected": "700212 / 700213 / 70021", "got": "7002121", "matchedExpectation": false, "message": "AADSTS7002121: No matching federated identity record found for presented assertion audience '{audience-id}'. The Audience for the federat" }, { "scenario": "Federated credential: subject differs only by case", "request": null, "httpStatus": null, "expected": "7002138 / 700213", "got": "7002138", "matchedExpectation": true, "message": "AADSTS7002138: No matching federated identity record found for presented assertion subject '{guid}'. The subject matches with case" }, { "scenario": "Wrong client secret", "request": null, "httpStatus": null, "expected": "7000215", "got": "7000215", "matchedExpectation": true, "message": "AADSTS7000215: Invalid client secret provided. Ensure the secret being sent in the request is the client secret value, not the client secret ID, for a secret ad" }, { "scenario": "Confidential client does ROPC without a secret", "request": null, "httpStatus": null, "expected": "7000218", "got": "7000218", "matchedExpectation": true, "message": "AADSTS7000218: The request body must contain the following parameter: 'client_assertion' or 'client_secret'." }, { "scenario": "Correct client secret (control)", "request": null, "httpStatus": null, "expected": "success", "got": "success", "matchedExpectation": true, "message": "" }, { "scenario": "SPA-registered client redeems without an Origin header", "request": null, "httpStatus": null, "expected": "9002327 / 65001", "got": "65001", "matchedExpectation": true, "message": "AADSTS65001: The user or administrator has not consented to use the application with ID '{app-id}' named 'lab-spa-41150019626'. Send" }, { "scenario": "Personal-accounts-only app on a tenant endpoint", "request": null, "httpStatus": null, "expected": "9002331", "got": "9002346", "matchedExpectation": false, "message": "AADSTS9002346: Application '{app-id}'(lab-msa-only-41150019626) is configured for use by Microsoft Account users only. Please use th" }, { "scenario": "Application disabled for sign-in", "request": null, "httpStatus": null, "expected": "7000112", "got": "7000112", "matchedExpectation": true, "message": "AADSTS7000112: Application '{app-id}'(lab-disabled-sp-41150019626) is disabled." }, { "scenario": "App-only token for an API that requires assignment", "request": null, "httpStatus": null, "expected": "501051", "got": "501051", "matchedExpectation": true, "message": "AADSTS501051: Application '{app-id}'(lab-fic-holder-41150019626) is not assigned to a role for the application 'api://{guid}" }, { "scenario": "Deleted user signs in, about 12 minutes after deletion", "request": null, "httpStatus": null, "expected": "500341 / 50034", "got": "50034", "matchedExpectation": true, "message": "AADSTS50034: The user account {EUII Hidden} does not exist in the {tenant-id} directory. To sign into this application, the account mus" } ] } ] }