Microsoft sign-in errors (AADSTS700027, 700016, 7000215, 65001, 90002)
What the common AADSTS sign-in codes mean for an App ID connection – certificate is not registered on the app, application not found, consent missing – and the exact fix for each.
Microsoft Entra ID reports sign-in problems with an AADSTS code. The common ones for App ID connections:
| Code | Meaning | Fix |
|---|---|---|
| AADSTS700027 | The certificate is not registered on the app. The certificate the app signs with isn't in the app registration. | Upload the .cer file from Connections → App ID to Entra admin center → App registrations → your app → Certificates & secrets → Certificates. Compare the thumbprint shown in the app with the one in Entra. Uploaded to a different app? Check the Application (client) ID. Changes take a few minutes. |
| AADSTS700016 | Application not found in the directory. | The Application (client) ID or the tenant is wrong, or the app was created in another tenant. Copy the ID again from Overview of the app registration. |
| AADSTS7000215 | Invalid client secret. | Secrets don't work for SharePoint anyway – use a certificate. |
| AADSTS65001 | The user or administrator has not consented. | API permissions → Grant admin consent for <tenant> (a Global or Privileged Role Administrator). |
| AADSTS90002 | Tenant not found. | The tenant name or ID is wrong. Leave the tenant empty on the connection – the app works it out from the SharePoint address. |
| AADSTS50076 / 50079 | MFA is required. | For a Microsoft account (MFA) connection, sign in again and complete MFA. |
| AADSTS53003 | Blocked by Conditional Access. | A policy blocks this sign-in (location, device). Ask your administrator to allow it. |
Step by step: Connect with an App ID (certificate) and, for O365 Migration, Register the app (App ID) in each tenant.
Was this article helpful?
Updated 2026-10-26