How to Fix Error AADSTS650052: The app is trying to access a service (Azure Communication Services) that your organization lacks a service principal for.

Question

How to Fix Error AADSTS650052: The app is trying to access a service (Azure Communication Services) that your organization lacks a service principal for.

Dylan 0

Hi there, I am getting this error when trying to connect Microsoft Teams to Zoho CRM for using the phone service through Azure. Does anyone know how I can fix this?

For confidentiality, I have removed the app ID along with the organization ID.

AADSTS650052: The app is trying to access a service (Azure Communication Services) that your organization lacks a service principal for. Contact your IT Admin to review the configuration of your service subscriptions or consent to the application in order to create the required service principal.

Alekhya Vaddepally 1,670 Reputation points Microsoft External Staff Moderator

2025-04-16T13:35:53.7933333+00:00

HiDylan,

Azure Ad Administrator needs to give consent for the app (ZOHO CRM in this case to reach Azure communication services. It usually makes the essential service principal behind the curtain.

Your administrator can consent it through URL or directly with enterprise applications in the Azure portal.

If the service principal is not automatically made after consent, your administrator may need to manually access or check whether your membership includes ezor communication services.

Ensure that your Azure subscription actually supports Azure Communication Services. You can see it in the Azure portal under "subscription"> Select your membership> Select the "Resource Provider" and make sure that Microsoft. Communication is registered.
https://learn.microsoft.com/en-us/microsoft-365/troubleshoot/active-directory/aadsts65005-error-when-sign-in-cloud#symptoms
https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/application-sign-in-unexpected-user-consent-error#permissions-mismatch-error

if you have any further concerns or queries, please feel free to reach out to us.
Alekhya Vaddepally 1,670 Reputation points Microsoft External Staff Moderator

2025-04-17T08:53:37.79+00:00

HiDylan,
We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution, please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help
Alekhya Vaddepally 1,670 Reputation points Microsoft External Staff Moderator

2025-04-18T11:48:32.8566667+00:00

HiDylan,
We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution, please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help
Dylan 0 Reputation points

2025-04-18T13:09:58.34+00:00

Hi there,

Thanks for your reply. I have tried both methods but it still doesn't work.

After checking I can see the Microsoft communication is registered. I also went and granted admin consent for the organisation to Zoho CRM but it still didn't work.

How can I check if the service principal is made or not after consent?

Is there any other factors which might be contributing to this?

Kind regards,
Dylan
Alekhya Vaddepally 1,670 Reputation points Microsoft External Staff Moderator

2025-04-18T13:38:30.0633333+00:00
HiDylan,
You can verify if your Azure Eddie Tenant has a service principal for Azure Communication Services. This way:

Using Azure Portal

Go to Azure portal:https://portal.azure.com

Search the enterprise applications in the top search bar

In the left menu, select all applications

Use the filter:

Set the application type for all applications

Use keywords like Azure Communication, or if you have then try to search by app ID

See for a service/application related to Azure Communication Services

If nothing comes, the service principal is not built - despite the consent step.
https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/view-applications-portal
Dylan 0 Reputation points

2025-04-19T07:30:55.4533333+00:00

Hi there, I have checked and the service principal is not built. Do you know how I can create this to add a service principal to manage calls in teams and manage chats in teams
Alekhya Vaddepally 1,670 Reputation points Microsoft External Staff Moderator

2025-04-21T09:10:27.81+00:00
Hi Dylan,
You can create service principal by manually by using Azure CLI.

1.login to Azure CLI

az login

2.you can also create service principal using ACS

az ad sp create --id "https://communication.azure.com/"

This Azure will create a service principal associated with communication services. If you get a reaction to success, the principal is now created. This step essentially registers service to your tenant for use by your apps.

3.you can check service principal exists by using command

az ad sp show --id "https://communication.azure.com/"

4.Grant permissions to manage calls/chats in teams

If your goal is to allow an app (Like zoho crm) to manage team calls and chats, you will need to provide additional microsoft graph permissions. What to do or what to do here:

App registration (zoho or your custom app):

Azure Active Directory> App Registration> [Your App]> API permissions

Add the following microsoft graph permissions:

Calls.acicessedia.all

Calls.initiate.all

Calls.initiategroupcall.all

Calls.joingroupcall.all

Calls.joingroupcallasguest.all

Chat.readwrite or chat.readwrite.all

Ensure that these applications are permissions if the app is running without a signed user.

Grants Administrator Consent:

After adding them, click on "Grants Administrator Consent for Your Organ"
https://learn.microsoft.com/en-us/cli/azure/ad/sp?view=azure-cli-latest#az-ad-sp-create
https://learn.microsoft.com/en-us/graph/api/resources/call?view=graph-rest-1.0
Alekhya Vaddepally 1,670 Reputation points Microsoft External Staff Moderator

2025-04-22T08:33:36.9866667+00:00

HiDylan,
We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution, please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help

Your answer

Alekhya Vaddepally 1,670 Reputation points Microsoft External Staff Moderator

2025-04-16T13:35:53.7933333+00:00

HiDylan,

Azure Ad Administrator needs to give consent for the app (ZOHO CRM in this case to reach Azure communication services. It usually makes the essential service principal behind the curtain.

Your administrator can consent it through URL or directly with enterprise applications in the Azure portal.

If the service principal is not automatically made after consent, your administrator may need to manually access or check whether your membership includes ezor communication services.

Ensure that your Azure subscription actually supports Azure Communication Services. You can see it in the Azure portal under "subscription"> Select your membership> Select the "Resource Provider" and make sure that Microsoft. Communication is registered.
https://learn.microsoft.com/en-us/microsoft-365/troubleshoot/active-directory/aadsts65005-error-when-sign-in-cloud#symptoms
https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/application-sign-in-unexpected-user-consent-error#permissions-mismatch-error

if you have any further concerns or queries, please feel free to reach out to us.
Alekhya Vaddepally 1,670 Reputation points Microsoft External Staff Moderator

2025-04-17T08:53:37.79+00:00

HiDylan,
We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution, please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help
Alekhya Vaddepally 1,670 Reputation points Microsoft External Staff Moderator

2025-04-18T11:48:32.8566667+00:00

HiDylan,
We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution, please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help
Dylan 0 Reputation points

2025-04-18T13:09:58.34+00:00

Hi there,

Thanks for your reply. I have tried both methods but it still doesn't work.

After checking I can see the Microsoft communication is registered. I also went and granted admin consent for the organisation to Zoho CRM but it still didn't work.

How can I check if the service principal is made or not after consent?

Is there any other factors which might be contributing to this?

Kind regards,
Dylan
Alekhya Vaddepally 1,670 Reputation points Microsoft External Staff Moderator

2025-04-18T13:38:30.0633333+00:00

HiDylan,
You can verify if your Azure Eddie Tenant has a service principal for Azure Communication Services. This way:

Using Azure Portal

Go to Azure portal:https://portal.azure.com

Search the enterprise applications in the top search bar

In the left menu, select all applications

Use the filter:

Set the application type for all applications

Use keywords like Azure Communication, or if you have then try to search by app ID

See for a service/application related to Azure Communication Services

If nothing comes, the service principal is not built - despite the consent step.
https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/view-applications-portal
Dylan 0 Reputation points

2025-04-19T07:30:55.4533333+00:00

Hi there, I have checked and the service principal is not built. Do you know how I can create this to add a service principal to manage calls in teams and manage chats in teams
Alekhya Vaddepally 1,670 Reputation points Microsoft External Staff Moderator

2025-04-21T09:10:27.81+00:00

Hi Dylan,
You can create service principal by manually by using Azure CLI.

1.login to Azure CLI

az login

2.you can also create service principal using ACS

az ad sp create --id "https://communication.azure.com/"

This Azure will create a service principal associated with communication services. If you get a reaction to success, the principal is now created. This step essentially registers service to your tenant for use by your apps.

3.you can check service principal exists by using command

az ad sp show --id "https://communication.azure.com/"

4.Grant permissions to manage calls/chats in teams

If your goal is to allow an app (Like zoho crm) to manage team calls and chats, you will need to provide additional microsoft graph permissions. What to do or what to do here:

App registration (zoho or your custom app):

Azure Active Directory> App Registration> [Your App]> API permissions

Add the following microsoft graph permissions:

Calls.acicessedia.all

Calls.initiate.all

Calls.initiategroupcall.all

Calls.joingroupcall.all

Calls.joingroupcallasguest.all

Chat.readwrite or chat.readwrite.all

Ensure that these applications are permissions if the app is running without a signed user.

Grants Administrator Consent:

After adding them, click on "Grants Administrator Consent for Your Organ"
https://learn.microsoft.com/en-us/cli/azure/ad/sp?view=azure-cli-latest#az-ad-sp-create
https://learn.microsoft.com/en-us/graph/api/resources/call?view=graph-rest-1.0
Alekhya Vaddepally 1,670 Reputation points Microsoft External Staff Moderator

2025-04-22T08:33:36.9866667+00:00

HiDylan,
We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution, please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help

Share via

How to Fix Error AADSTS650052: The app is trying to access a service (Azure Communication Services) that your organization lacks a service principal for.

Your answer