fairfax / Sign-in errors / AADSTS700016

AADSTS700016: UnauthorizedClient_DoesNotMatchRequest

The app wasn't found in the tenant. In US government setups a common cause is an app registered in one cloud (for example Azure Government) while the token request goes to the other cloud's sign-in host, where the app doesn't exist.

How to fix it

Check which cloud the app registration lives in and send the request to that cloud's sign-in host, with that tenant's ID.

Note: Microsoft's row for this code doesn't mention clouds. The cause above is the common one in US government setups, so check it against yours.

What Microsoft says

“AADSTS700016 | UnauthorizedClient_DoesNotMatchRequest - The application wasn't found in the directory/tenant. This can happen if the application has not been installed by the administrator of the tenant or consented to by any user in the tenant. You might have misconfigured the identifier value for the application or sent your authentication request to the wrong tenant.”

Source: Microsoft Entra authentication and authorization error codes, page updated 2026-06-15, checked 2026-10-12.

• “Microsoft Entra ID for US Government | https://login.microsoftonline.us” (National clouds)

Decode it from the command line

pip install fairfax
fairfax explain AADSTS700016 --tenant gcchigh      # or paste the whole error message

To find the commercial sign-in host in your code before it fails, run fairfax scan src/ --tenant gcchigh --azure government.

Other cross-cloud sign-in errors

• AADSTS50049: NoSuchInstanceForDiscovery
• AADSTS90002: InvalidTenantName
• AADSTS90038: NationalCloudTenantRedirection
• AADSTS90051: InvalidNationalCloudId
• AADSTS900382: Confidential Client isn't supported in Cross Cloud request
• AADSTS900432: Confidential Client isn't supported in Cross Cloud request
• AADSTS900439: USGClientNotSupportedOnPublicEndpoint
• AADSTS1000104: XCB2BResourceCloudNotAllowedOnIdentityTenant