AADSTS error codes 90002–90130: the complete list with fixes (part 4 of 5)

Part 4 of my complete AADSTS reference covers every code Microsoft lists from AADSTS90002 to AADSTS90130, in the order of Microsoft's table. These 67 codes are mostly about the request itself: the tenant in the URL, missing or malformed parameters, national clouds, WS-Federation, Graph and consent, and the /common and /consumers endpoints. Each row gives the meaning in plain English, the usual cause and the first check.

How to read these codes#

• Who sees them: mostly developers and admins running scripts. The code comes back in the token endpoint's JSON (error, error_codes, error_description, correlation_id) or on the Microsoft sign-in page when a browser carries the bad request. A request that fails before Entra ID knows which tenant it belongs to, such as 90002, can't appear in your sign-in logs, so the app's output is your evidence.
• Read the authority first. The URL either names a tenant (ID or verified domain) or uses /organizations (work and school accounts), /consumers (personal accounts) or /common (both). Several codes here mean the app picked the wrong one for its supported account types.
• National clouds have their own sign-in hosts, for example login.microsoftonline.us for Azure Government and login.partner.microsoftonline.cn for Microsoft Azure operated by 21Vianet. A tenant can only sign in through its own cloud.
• Capture the request with the browser's developer tools (Network tab, preserve log) or an HTTP capture tool such as Fiddler, which Microsoft suggests for malformed-request errors.

To see the raw error from a script, send a token request and print the JSON body:

$body = @{
    client_id     = '<application-id>'
    client_secret = '<secret>'     # prefer a certificate in production
    scope         = 'https://graph.microsoft.com/.default'
    grant_type    = 'client_credentials'
}
try {
    Invoke-RestMethod -Method Post -ContentType 'application/x-www-form-urlencoded' `
        -Uri 'https://login.microsoftonline.com/<tenant-id>/oauth2/v2.0/token' -Body $body
} catch {
    $_.ErrorDetails.Message | ConvertFrom-Json | Select-Object error, error_codes, error_description
}

Tenant lookup and malformed requests (90002–90027)#

Directory service, national clouds and throttling (90033–900612)#

External users and WS-Federation (90072–90087)#

Graph and consent (90090–90095)#

Partner apps, parameters, device code and endpoints (90099–90130)#

How to verify a fix#

1. Re-run the same request. Good: the token endpoint returns an access_token; if another problem was hiding behind the first, you get a different code in error_codes.
2. Check that the authority in the app's settings matches its Supported account types: a tenant ID or /organizations for work-only apps, and the right cloud's sign-in host.
3. Consent codes: after an admin approves the request under Admin consent requests, the user signs in without the prompt.
4. Transient codes (90006, 90024, 90033, 90090): they should clear on retry with backoff. If they don't, check service health in the Microsoft 365 admin center and open a case with the correlation ID and timestamp.
5. For app-only flows with sign-in logs in Log Analytics, confirm the failures stop:
   KQL

   AADServicePrincipalSignInLogs
   | where TimeGenerated > ago(7d)
   | where ResultType in ("90002", "90014", "900144", "9001023", "90055")
   | summarize Failures = count() by ResultType, ServicePrincipalName, bin(TimeGenerated, 1d)

For reading the entries themselves, see Reading Microsoft Entra sign-in logs like an engineer; for app registration hygiene, see App registrations and service principals.

References#

• Microsoft Entra authentication and authorization error codes (Microsoft Learn): the source table for every code on this page.
• Handle errors and exceptions in MSAL.NET (Microsoft Learn): how apps see these codes, including 90010 with /common.
• Microsoft Entra authentication and national clouds (Microsoft Learn): the sign-in hosts for each cloud instance.