Authorization Issue with Azure Communication Services: AADSTS650052 - Service Principal Missing

Question

Authorization Issue with Azure Communication Services: AADSTS650052 - Service Principal Missing

Samuel JN 21

Hi Team,
We are part of an integration team working on integrating Microsoft Azure Communication Services (ACS) with Microsoft Teams for calls and chat functionalities.

During the authorization process using Microsoft Identity Platform (OAuth 2.0), many users encounter the following error:

AADSTS650052: The app is trying to access a service 'client_id' (Azure Communication Services) that your organization 'tenant_id' lacks a service principal for. Contact your IT Admin to review the configuration of your service subscriptions or consent to the application in order to create the required service principal.

We are using delegated permissions and following the standard OAuth flow.

The app has been registered and Azure Communication Services is enabled in our tenant.

However, customer tenants (who use our ACS-integrated services) encounter the above error during authorization.

The error seems to indicate Azure AD cannot find or create a service principal for ACS in the customer tenant.

Our Questions:

Is this due to missing enterprise app/service principal for Azure Communication Services in the customer's tenant?

Or is admin consent required to create the service principal?

Should they go to Azure Portal > Enterprise Applications and add ACS manually?

Should we ask them to grant admin consent to our app via a specific URL?

We want to provide clear instructions to our customers so they can avoid this issue or resolve it quickly.
We would greatly appreciate detailed guidance and official documentation links (if any) to share with our customers and to streamline the setup.

Thank you in advance for your help!

Alekhya Vaddepally 1,015 Reputation points Microsoft External Staff Moderator

2025-04-29T12:31:48.49+00:00
Hi Samuel JN,
In Azure Ad, each app or service (eg ACS) should be registered with your tenant before it can be accessed safely. This registration occurs automatically when a administrator agrees to the app, which also makes an essential service principal in your directory.

Therefore, when your users try to certify with delegated permissions, and ACS has not been agreed before, they hit the error as the app does not yet exist as an enterprise app in your tenant.

To solve this, an Azure Ad Administrator in your tenant requires the admin for the application.

Make a service principal for ACS in your tenant

Allow your users to certify and use ACS features like call or chat through their integration

Please follow these instructions:

Sign in the app to your Azure Ad Administrator using this URL format and consent:

https://login.microsoftonline.com/<CUSTOMER_TENANT_ID>/adminconsent?client_id=<YOUR_APP_CLIENT_ID>

Change your tenant ID (or with "normal" <customer_tenant_id> if you support multi-tenant Aath), and <RER_APP_CLIENT_ID> with the client ID of your Azure Ad App.

After the administrator consent, Azure will create the required service principal for ACS in your directory.

https://learn.microsoft.com/en-us/entra/identity-platform/v2-admin-consent
https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/grant-admin-consent?pivots=portal
if you have any further concerns or queries, please feel free to reach out to us.
Samuel JN 21 Reputation points

2025-04-30T09:34:31.38+00:00

We followed your instructions, but we are still encountering the same issue when providing admin consent for the client application. Is this related to a licensing issue? If so, what license does the customer need to grant consent for ACS?
Alekhya Vaddepally 1,015 Reputation points Microsoft External Staff Moderator

2025-05-02T09:46:05.22+00:00

Hi Samuel JN,
We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution, please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.
Alekhya Vaddepally 1,015 Reputation points Microsoft External Staff Moderator

2025-05-05T09:36:51.33+00:00

Hi Samuel JN, We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution, please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.
Samuel JN 21 Reputation points

2025-05-05T10:54:00.11+00:00

Hi @Alekhya Vadapally ,

Sorry, I missed your reply. We will follow the instructions and let you know if this works or not.
Alekhya Vaddepally 1,015 Reputation points Microsoft External Staff Moderator

2025-05-06T10:09:06.3766667+00:00

Hi Samuel JN, We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution, please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.
Alekhya Vaddepally 1,015 Reputation points Microsoft External Staff Moderator

2025-05-07T11:38:19.18+00:00

Hi Samuel JN, We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution, please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.

1 answer

Your answer

Alekhya Vaddepally 1,015 Reputation points Microsoft External Staff Moderator

2025-04-29T12:31:48.49+00:00

Hi Samuel JN,
In Azure Ad, each app or service (eg ACS) should be registered with your tenant before it can be accessed safely. This registration occurs automatically when a administrator agrees to the app, which also makes an essential service principal in your directory.

Therefore, when your users try to certify with delegated permissions, and ACS has not been agreed before, they hit the error as the app does not yet exist as an enterprise app in your tenant.

To solve this, an Azure Ad Administrator in your tenant requires the admin for the application.

Make a service principal for ACS in your tenant

Allow your users to certify and use ACS features like call or chat through their integration

Please follow these instructions:

Sign in the app to your Azure Ad Administrator using this URL format and consent:

https://login.microsoftonline.com/<CUSTOMER_TENANT_ID>/adminconsent?client_id=<YOUR_APP_CLIENT_ID>

Change your tenant ID (or with "normal" <customer_tenant_id> if you support multi-tenant Aath), and <RER_APP_CLIENT_ID> with the client ID of your Azure Ad App.

After the administrator consent, Azure will create the required service principal for ACS in your directory.

https://learn.microsoft.com/en-us/entra/identity-platform/v2-admin-consent
https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/grant-admin-consent?pivots=portal
if you have any further concerns or queries, please feel free to reach out to us.
Samuel JN 21 Reputation points

2025-04-30T09:34:31.38+00:00

We followed your instructions, but we are still encountering the same issue when providing admin consent for the client application. Is this related to a licensing issue? If so, what license does the customer need to grant consent for ACS?
Alekhya Vaddepally 1,015 Reputation points Microsoft External Staff Moderator

2025-05-02T09:46:05.22+00:00

Hi Samuel JN,
We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution, please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.
Alekhya Vaddepally 1,015 Reputation points Microsoft External Staff Moderator

2025-05-05T09:36:51.33+00:00

Hi Samuel JN, We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution, please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.
Samuel JN 21 Reputation points

2025-05-05T10:54:00.11+00:00

Hi @Alekhya Vadapally ,

Sorry, I missed your reply. We will follow the instructions and let you know if this works or not.
Alekhya Vaddepally 1,015 Reputation points Microsoft External Staff Moderator

2025-05-06T10:09:06.3766667+00:00

Hi Samuel JN, We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution, please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.
Alekhya Vaddepally 1,015 Reputation points Microsoft External Staff Moderator

2025-05-07T11:38:19.18+00:00

Hi Samuel JN, We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution, please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.

Answer 1

Hi Samuel JN,

Azure communication services requires that the customer tenant licensed properly and provides ACS resources in Azure. If the service is not competent or licensed, Azure ad cannot make the concerned service principal during consent - leading to this accurate error.
Verify that ACS is available and licensed in customer tenant
Here the customer administrator can take steps to solve it:
Ensure that the azure communication services are available and supported in the customer's Azure membership.
Not all azure sectors support ACS, and ACS should be deployed at least once to the tenant of the customer for the service principal.
To check availability:
https://learn.microsoft.com/en-us/azure/communication-services/overview#availability
Provision an Azure Communication Service Resources in the customer's Azure portal: Travel:
https://portal.azure.com
"Create a resource"> search for Azure Communication Services Create an ACS resource in their membership (even one dummy does one thing - it only insensate the tenant)

Once ACS has become a resource, recover the administrator consent process using URL as before:

https://login.microsoftonline.com/<TENANT_ID>/adminconsent?client_id=<YOUR_APP_CLIENT_ID>

https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/grant-admin-consent?pivots=portal
if you have any further concerns or queries, please feel free to reach out to us.

Share via

Authorization Issue with Azure Communication Services: AADSTS650052 - Service Principal Missing

1 answer

Your answer