Error when authorizing Azure AD application

Question

Error when authorizing Azure AD application

Yasitha Pandithawatta 141

One of our client's getting below error after authorizing our application. {"error":{"code":"InvalidAuthenticationToken","message":"Inbound policy evaluation empty. Unkown failure","innerError":{"date":"2024-02-20T05:23:39","request-id":"387abf84-e5ec-4793-8427-fd35a01e71a6","client-request-id":"387abf84-e5ec-4793-8427-fd35a01e71a6"}}} This error returned in the callback after user Accept the permissions. In customer's tenant sign-in logs, it was logged that invalid client secret is provided. But we are pretty sure we provide the correct secret and same application works fine with other customers. What could be the issue here? Is it related to any configuration on customer's tenant?

JamesTran-MSFT 37,251 Reputation points Microsoft Employee Moderator

2024-03-04T21:20:17.9066667+00:00

@Yasitha Pandithawatta

I just wanted to check in and see if you had any other questions or if you were able to resolve this issue?

If you have any other questions, please let me know. Thank you for your time and patience throughout this issue.

If the information helped address your question, please Accept the answer. This will help us and also improve searchability for others in the community who might be researching similar information.

Answer accepted by question author

Imoh S. Etuk 195

Hi, @Yasitha Pandithawatta Sorry about your client's experience. I think the issue has to do with the authentication process or a policy configured in your Microsoft Entra ID. Could you check that the client secret provided is correct and that the client is entering it correctly? If the client secret is correct, as you stated above, could you also check the application configuration in the Entra ID Portal and ensure that it matches the client ID and secret? A few other things you could check are: ensuring that the required permissions are configured properly in the Entra ID (Azure AD ) application; and granting the necessary consent. Also, check if policies are blocking consent. Feel free to let me know if the above helps!

Yasitha Pandithawatta 141 Reputation points

2024-02-28T08:06:17.76+00:00

Hi @Imoh S. Etuk , Thanks for your response. This is a muti-tenant application and we don't see this issue with other customers who are authorizing this app. App Id and secret is correct and we are assuming this is failing due some policies in customer's tenant. What type of policy can it be? Any suggestions on what to asked from customer to check on their tenant?
Imoh S. Etuk 195 Reputation points

2024-02-28T09:31:53.32+00:00

Hi @Yasitha Pandithawatta , Kindly tell the customer to review Conditional Access Policies that might have been configured on their Tenant as Conditional Access Policies can enforce additional security requirements.

In addition, the customer should check Identity Protection Policies to see if they have configured anything that might be triggering risk detections and blocking authentication attempts. Also, you could check to verify that the Azure AD application registration for your multi-tenant application is configured correctly in the customer's tenant by ensuring that the required permissions have been granted and that consent has been given by an administrator. Lastly, you can request access to the Azure AD audit logs or sign-in logs from the customer's tenant. Analyzing these logs can provide insights into the specific error conditions and help diagnose the root cause of the authentication failure. Let me know if this helps!

1 additional answer

Your answer

JamesTran-MSFT 37,251 Reputation points Microsoft Employee Moderator

2024-03-04T21:20:17.9066667+00:00

@Yasitha Pandithawatta

I just wanted to check in and see if you had any other questions or if you were able to resolve this issue?

If you have any other questions, please let me know. Thank you for your time and patience throughout this issue.

If the information helped address your question, please Accept the answer. This will help us and also improve searchability for others in the community who might be researching similar information.
Yasitha Pandithawatta 141 Reputation points

2024-02-28T08:06:17.76+00:00

Hi @Imoh S. Etuk , Thanks for your response. This is a muti-tenant application and we don't see this issue with other customers who are authorizing this app. App Id and secret is correct and we are assuming this is failing due some policies in customer's tenant. What type of policy can it be? Any suggestions on what to asked from customer to check on their tenant?
Imoh S. Etuk 195 Reputation points

2024-02-28T09:31:53.32+00:00

Hi @Yasitha Pandithawatta , Kindly tell the customer to review Conditional Access Policies that might have been configured on their Tenant as Conditional Access Policies can enforce additional security requirements.

In addition, the customer should check Identity Protection Policies to see if they have configured anything that might be triggering risk detections and blocking authentication attempts. Also, you could check to verify that the Azure AD application registration for your multi-tenant application is configured correctly in the customer's tenant by ensuring that the required permissions have been granted and that consent has been given by an administrator. Lastly, you can request access to the Azure AD audit logs or sign-in logs from the customer's tenant. Analyzing these logs can provide insights into the specific error conditions and help diagnose the root cause of the authentication failure. Let me know if this helps!

Answer 1

John 85

I had this error suddenly happen twice today, in an application that has been running fine for over a year, and it resolved itself with no changes. My guess is that something went awry in the MS Graph API infrastructure that manifested itself in this error, because nothing in my environment changed to trigger it, and it resolved without any changes.

So if you see this with an application that has been working, it could be just a temporary issue in the Microsoft cloud somewhere that will resolve itself.

0 comments

Share via

Error when authorizing Azure AD application

1 additional answer

Your answer